By Divya
Publication Date: 2026-10-13 12:12:00
Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances.
Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation and payload delivery.
In contrast, the other showed signs of exploitation without confirmed follow-on malicious activity. The attackers used their access to install a customized FreeBSD-compatible Platypus agent, turning the network edge device into a potential persistent remote-access foothold.
Citrix NetScaler Zero-Days
The campaign began around September 24, 2026, targeting internet-exposed Citrix NetScaler ADC and Gateway instances through vulnerabilities CVE-2026-88771 and CVE-2026-88772.
