IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
CVEHighVerifiedSignal 82/100EPSS 1.1%

CVE-2026-88771

First Seen
Sep 27, 2026
Last Seen
Oct 10, 2026
Sep 27
First Seen
14d ago
Oct 10
Last Seen
yesterday
17
Reports
source reports
88%
Confidence
high
Found in 17 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
EPSS Score
1.06%
EPSS Percentile
63.3th
Confidence
88%
Signal Score
82 / 100
IDS Rule
No
CVE Intelligence
Exploit Probability1.06%
63.3th percentile of all CVEs
Threat Context
Tags

Feed Intelligence Summary

17 reports88% confidence
SO
SOCRadar
4d ago
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
10 IOCs in report
NS
Nextron Systems
5d ago
Update on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Expanded THOR Detection Coverage
2 IOCs in report
SO
SOCRadar
5d ago
CVE-2026-88779: Citrix NetScaler Zero-Day
3 IOCs in report
PA
Palo Alto Networks
5d ago
Blinder Tunnel Campaign Targets Iraqi Infrastructure
22 IOCs in report
SP
SOC Prime
5d ago
CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments
3 IOCs in report
CP
Check Point Research
6d ago
5th October – Threat Intelligence Report
5 IOCs in report
CP
Cyber Press
Oct 3, 2026
New Citrix NetScaler SAML Flaw Triggers Crashes and Suspected Exploitation Attempts
4 IOCs in report
TH
ThreatMon
Oct 2, 2026
The NetScaler Zero-Day Siege and Pre-Auth RCE Chains : Technical Analysis and Exposure Assessment
6 IOCs in report
HA
HawkEye
Oct 2, 2026
Weekly Threat Landscape Digest – Week 40
42 IOCs in report
GT
Google Threat Intelligence (GTIG / Mandiant)
Sep 29, 2026
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
4 IOCs in report

Activity Timeline

16 total obs
Oct 7Sep 28

Threat Activity Heatmap

· Peak: 2026-09-28
Less
More
Mon
Wed
Fri
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
·
Jul
·
·
·
Aug
·
·
·
·
Sep
·
·
·
24h
0
Dormant
7d
6
Moderate
30d
16
Critical
3mo
16
Critical
Threat ScoreHigh Risk
82
SIGNAL
Signal Score
88%
Confidence
17
Reports
First seenSep 27, 2026
Last seenOct 10, 2026
Verified IOC

VirusTotal

Not checked

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 14 days ago · Last seen 1 day ago
Appeared in 17 threat reports from 10 sources
Associated with: APT35, Cl0p, TA419, Play, UNC1549
Used by malware: Play, Chisel, PowerShell Empire, Cobalt Strike, META Stealer, Cl0p