Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE4 IOCs
New Citrix NetScaler SAML Flaw Triggers Crashes and Suspected Exploitation Attempts
Diamond Model
Indicators of Compromise
Indicators of Compromise4
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-88772 ddosexploitintel-blog | High | 81 | Sep 28, 26 |
| CVE | CVE-2026-88771 ddosexploitintel-blog | High | 82 | Sep 27, 26 |
| MD5 | b160cbd4eef2625db160cbd4eef2625d exploitfile-hashintel-blog | Medium | 53 | Oct 3, 26 |
| SHA256 | 2824be10929bdc604753c70a67a1c3312d8f34cc954092cc4403eed16fc993d9 exploitfile-hashintel-blog | Medium | 53 | Oct 3, 26 |
IOC Relationship Graph
IOC Relationship Graph4 total IOCs
CVEMD5SHA256