Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor

Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances.

Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation and payload delivery.

In contrast, the other showed signs of exploitation without confirmed follow-on malicious activity. The attackers used their access to install a customized FreeBSD-compatible Platypus agent, turning the network edge device into a potential persistent remote-access foothold.

Citrix NetScaler Zero-Days

The campaign began around September 24, 2026, targeting internet-exposed Citrix NetScaler ADC and Gateway instances through vulnerabilities CVE-2026-88771 and CVE-2026-88772.

CVE-2026-88771 is a pre-authentication command-injection flaw. Attackers can submit crafted data that resembles a crash message from the NSPPE packet engine, embedding shell commands in a value later written into NetScaler logs.

A vulnerable error-handling script, ns_monuploadd_err.pl, processes this logged content through a shell command, potentially executing the injected payload.

The vulnerability is not limited to a single URL path; any NetScaler component that logs attacker-controlled HTTP input, including login values, headers, blocked requests, or User-Agent strings, could provide a pathway to the vulnerable logging and processing sequence.

A major detection challenge is that payload execution may be delayed until the monitoring script runs, potentially by up to 24 hours.

CVE-2026-88772 is a pre-authentication DTLS memory overflow issue in the NetScaler Packet Processing Engine. It affects systems with DTLS enabled, which is the default setting on VPN virtual servers unless explicitly disabled by administrators.

The issue arises when malformed DTLS handshake fragments are reassembled into NetScaler buffers and copied into a fixed-size scratch buffer without sufficient bounds checking.

After exploiting the vulnerabilities, the attackers deployed a modified Platypus implant using a one-line bootstrap command that downloaded an installer with curl and piped it to the shell (sh).

Platypus is an open-source, Go-based remote management platform that supports remote shells, file operations, peer communications, plugin execution, updates, persistence, privilege escalation, timestomping, and self-removal.

The threat actor adapted the software to run on FreeBSD, the operating system beneath Citrix NetScaler appliances, and packaged the implant as a Perl-related (.pl) payload.

Investigators found the installation command in the NetScaler ns.log records. It used a unique token that allowed the attacker’s infrastructure to validate the installation and identify the compromised appliance.

The recovered artifacts included a FreeBSD implant, a Windows agent hosted on the same command-and-control infrastructure, and a bootstrap installer, all linked to a single private fork of Platypus.

The FreeBSD and Windows versions shared the same Go toolchain, build string, commit identifier, timestamp, and Ed25519 plugin-signing key. The agents were compiled on September 28, 2026, and the C2 certificate was issued about an hour later, showing rapid infrastructure preparation after the NetScaler exploitation activity.

This incident illustrates how publicly available tools can reduce the time between initial access and sustained control. Instead of developing custom post-compromise malware, operators can fork a mature project, modify it for a specific platform, and add capabilities absent in the public version.

Platypus has also appeared in previous malicious infrastructures. Lumen’s Black Lotus Labs reported that the JDY botnet ecosystem used Platypus to manage some compromised IoT and SOHO devices; the broader JDY network was assessed as a China-linked reconnaissance capability that facilitated rapid vulnerability exploitation.

Organizations using Citrix NetScaler appliances should immediately apply Citrix-provided fixes and mitigations, review ns.log and other appliance logs for suspicious authentication strings or crash-message artifacts, and investigate any unexpected files or activity under the /var/tmp/ directory.

Defenders should also search for suspicious curl | sh executions, unusual outbound TLS connections, mTLS enrollment behavior, unauthorized FreeBSD binaries, and indications of Platypus or Termite-style remote-management activity.

Because the observed implant may self-remove or fail during registration, preserving logs and triaging quickly are essential, even if no payload remains on disk.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.