IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
CVEHighVerifiedSignal 81/100EPSS 1.3%

CVE-2026-88772

First Seen
Sep 28, 2026
Last Seen
Oct 10, 2026
Sep 28
First Seen
13d ago
Oct 10
Last Seen
yesterday
15
Reports
source reports
88%
Confidence
high
Found in 15 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
EPSS Score
1.30%
EPSS Percentile
69.3th
Confidence
88%
Signal Score
81 / 100
IDS Rule
No
CVE Intelligence
Exploit Probability1.30%
69.3th percentile of all CVEs
Threat Context
Tags

Feed Intelligence Summary

15 reports88% confidence
SO
SOCRadar
4d ago
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
10 IOCs in report
NS
Nextron Systems
5d ago
Update on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Expanded THOR Detection Coverage
2 IOCs in report
PA
Palo Alto Networks
5d ago
Blinder Tunnel Campaign Targets Iraqi Infrastructure
22 IOCs in report
SP
SOC Prime
6d ago
CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments
3 IOCs in report
CP
Check Point Research
6d ago
5th October – Threat Intelligence Report
5 IOCs in report
CP
Cyber Press
Oct 3, 2026
New Citrix NetScaler SAML Flaw Triggers Crashes and Suspected Exploitation Attempts
4 IOCs in report
TH
ThreatMon
Oct 2, 2026
The NetScaler Zero-Day Siege and Pre-Auth RCE Chains : Technical Analysis and Exposure Assessment
6 IOCs in report
HA
HawkEye
Oct 2, 2026
Weekly Threat Landscape Digest – Week 40
42 IOCs in report
GT
Google Threat Intelligence (GTIG / Mandiant)
Sep 29, 2026
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
4 IOCs in report
NS
Nextron Systems
Sep 29, 2026
New THOR Detection Coverage for Citrix NetScaler CVE-2026-88771 and CVE-2026-88772
4 IOCs in report

Activity Timeline

15 total obs
Oct 7Sep 28

Threat Activity Heatmap

· Peak: 2026-09-28
Less
More
Mon
Wed
Fri
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
·
Jul
·
·
·
Aug
·
·
·
·
Sep
·
·
·
24h
0
Dormant
7d
5
Moderate
30d
15
Critical
3mo
15
Critical
Threat ScoreHigh Risk
81
SIGNAL
Signal Score
88%
Confidence
15
Reports
First seenSep 28, 2026
Last seenOct 10, 2026
Verified IOC

VirusTotal

Not checked

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 13 days ago · Last seen 1 day ago
Appeared in 15 threat reports from 10 sources
Associated with: APT35, Cl0p, TA419, Play, UNC1549
Used by malware: Chisel, Play, PowerShell Empire, Cobalt Strike, META Stealer, Cl0p