{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 10, "direct_entities": 23, "direct_relationships": 32, "invalid_iocs": 0, "iocs": 10, "mentioned": 3, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 1 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 54, "excluded_graph_objects": 282, "graph_complete": true, "graph_objects": 23, "graph_relationships": 32, "mitre_context_complete": true, "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "status_as_of": "2026-10-08T07:51:50+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha256" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.352Z", "created_at": "2026-10-01T08:06:44.834Z", "modified": "2026-10-03T04:37:09.211Z", "updated_at": "2026-10-03T04:37:09.211Z" }, "description_available": false, "entity_type": "Indicator", "id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "51b4288a-935f-4583-9ba1-70e75d436755", "source_name": "ThreatFox source reference", "url": "https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--9989fb64-7861-5f4b-a72a-de765492e9c2", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:33.431Z", "updated_at": "2026-10-01T08:22:49.189Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "1af69263-d226-4265-b863-927245a5eae6", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--84539ee3-78bc-5a7e-b2aa-357602e7ce8a", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:33.626Z", "updated_at": "2026-10-01T08:06:34.448Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "31a1f934-e5f5-41f9-b7a5-d280ea267ee1", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--a1e30374-aafd-53e2-a0e8-1dbd99a3c748", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.273Z", "created_at": "2026-10-01T08:06:28.871Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-01T08:06:29.218Z", "updated_at": "2026-10-01T08:06:29.218Z" }, "description_available": false, "entity_type": "Malware", "id": "354299df-8841-40ff-9beb-866e6cf89260", "is_inferred": false, "labels": [], "lang": "en", "name": "main.py", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "malware--492fc529-f4d1-5900-a054-6db08a100d80", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "ipv4" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.325Z", "created_at": "2026-10-01T08:06:39.649Z", "modified": "2026-10-03T04:36:45.036Z", "updated_at": "2026-10-03T04:36:45.036Z" }, "description_available": true, "entity_type": "Indicator", "id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "hygiene", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "51b4288a-935f-4583-9ba1-70e75d436755", "source_name": "ThreatFox source reference", "url": "https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771" } ], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--108666a2-54ce-5691-81d3-0a6a20b2ef4e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.337Z", "created_at": "2026-10-01T08:06:41.350Z", "modified": "2026-10-03T00:49:12.123Z", "updated_at": "2026-10-03T00:49:12.123Z" }, "description_available": false, "entity_type": "Indicator", "id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--81e0b7fb-3b3c-5860-875d-3023bef7a58a", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:36.536Z", "updated_at": "2026-10-03T00:47:03.338Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "45361aae-1b00-42ea-a254-3196f7049d57", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--777c4d80-fabd-5f1a-8648-2d5551e11bc9", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "url" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.342Z", "created_at": "2026-10-01T08:06:42.377Z", "modified": "2026-10-03T04:38:38.326Z", "updated_at": "2026-10-03T04:38:38.326Z" }, "description_available": false, "entity_type": "Indicator", "id": "55c799c1-ab7a-44ab-a547-080eb1020929", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "51b4288a-935f-4583-9ba1-70e75d436755", "source_name": "ThreatFox source reference", "url": "https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--791e0afe-6c38-5b21-95a2-8f554eec417a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.349Z", "created_at": "2026-10-01T08:06:42.739Z", "modified": "2026-10-03T00:50:15.585Z", "updated_at": "2026-10-03T00:50:15.585Z" }, "description_available": false, "entity_type": "Indicator", "id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--ba5253b9-49fd-5c04-a80e-762d16ce2c0d", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:36.548Z", "updated_at": "2026-10-03T04:37:21.510Z" }, "description_available": true, "entity_type": "IPv4-Addr", "id": "6ad7c0d1-ffea-4d4e-9561-168f5c7f3988", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--a25f3601-e7be-5991-8f01-865b56d69574", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:36.562Z", "updated_at": "2026-10-03T04:37:28.195Z" }, "description_available": true, "entity_type": "IPv4-Addr", "id": "81346bbd-11e7-491e-b884-9a4c7ed8b2f6", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "31.56.197.72", "id": "0a83fb10-cb8b-43c4-ad42-4f2f5f711432", "source_name": "Shodan", "url": "https://www.shodan.io/host/31.56.197.72" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--8e5ec41c-7edb-562e-a22e-5d325ab7e03e", "type": "IPv4Addr" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:38.184Z", "updated_at": "2026-10-03T04:38:31.783Z" }, "description_available": false, "entity_type": "Url", "id": "ac66423c-c594-4a71-8fff-ce38f7bdae97", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "url--0bfb7b91-3843-5428-8ed6-e7f3baf90884", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.330Z", "created_at": "2026-10-01T08:06:40.019Z", "modified": "2026-10-03T00:48:35.642Z", "updated_at": "2026-10-03T00:48:35.642Z" }, "description_available": false, "entity_type": "Indicator", "id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--bd8c5b14-cdb5-53e1-935e-089e3b009a9e", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-09-27T00:00:00.000Z", "created_at": "2026-09-27T20:47:14.970Z", "modified": "2026-10-01T08:06:31.181Z", "updated_at": "2026-10-01T08:06:31.181Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-88771", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-88771", "id": "06c9dd90-7190-465a-b4e4-1dfde14bd056", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "vulnerability--ffd248e0-8f5c-5fa9-8a08-bf788da49f49", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "ipv4" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.339Z", "created_at": "2026-10-01T08:06:41.345Z", "modified": "2026-10-03T04:37:32.427Z", "updated_at": "2026-10-03T04:37:32.427Z" }, "description_available": true, "entity_type": "Indicator", "id": "c83ff903-ad71-46df-a036-de7338e78681", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "51b4288a-935f-4583-9ba1-70e75d436755", "source_name": "ThreatFox source reference", "url": "https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--62266b69-728d-552d-8126-800323733176", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:38.991Z", "updated_at": "2026-10-01T08:06:39.267Z" }, "description_available": false, "entity_type": "StixFile", "id": "cb82c970-6844-478e-bfdb-99f7753180b2", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "file--d41890fe-2fd1-5cf4-af53-7e1e6c70a323", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.274Z", "created_at": "2026-10-01T08:06:29.023Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-01T08:06:29.587Z", "updated_at": "2026-10-01T08:06:29.587Z" }, "description_available": false, "entity_type": "Malware", "id": "cde92d73-8049-4f90-bd71-2867869f0431", "is_inferred": false, "labels": [], "lang": "en", "name": "update_c08937.pl", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "malware--a0f9240f-231a-51ee-9dc5-da323c76f4f4", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:38.997Z", "updated_at": "2026-10-03T04:36:59.627Z" }, "description_available": false, "entity_type": "StixFile", "id": "cf628e58-a855-45dc-9a57-7d75371e47b8", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "file--ac4e640d-af71-5af5-81f3-6952b89a0da5", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:33.601Z", "updated_at": "2026-10-03T04:36:38.025Z" }, "description_available": true, "entity_type": "IPv4-Addr", "id": "d2edab35-d997-43c6-b086-ae49e828c272", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "hygiene", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "ipv4-addr--b2f2d145-1391-5f83-872e-ccfd714149a5", "type": "IPv4Addr" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-01T08:06:38.926Z", "updated_at": "2026-10-01T08:06:39.103Z" }, "description_available": false, "entity_type": "Url", "id": "ee8012a9-4f50-4fc2-ae7f-826da7d1d881", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "url--7f13d536-68f3-58bf-b1d3-cdd041927466", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "ipv4" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.334Z", "created_at": "2026-10-01T08:06:40.866Z", "modified": "2026-10-03T04:37:26.785Z", "updated_at": "2026-10-03T04:37:26.785Z" }, "description_available": true, "entity_type": "Indicator", "id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "51b4288a-935f-4583-9ba1-70e75d436755", "source_name": "ThreatFox source reference", "url": "https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--8f5b6d03-3178-5ff4-ac91-3ac51584d220", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.332Z", "created_at": "2026-10-01T08:06:40.028Z", "modified": "2026-10-03T00:48:14.597Z", "updated_at": "2026-10-03T00:48:14.597Z" }, "description_available": false, "entity_type": "Indicator", "id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--4cfa6abe-2c97-5665-9220-432b61c0e62c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.345Z", "created_at": "2026-10-01T08:06:42.752Z", "modified": "2026-10-03T00:50:25.312Z", "updated_at": "2026-10-03T00:50:25.312Z" }, "description_available": false, "entity_type": "Indicator", "id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "indicator--b12b2f10-9c4b-50bb-9a5d-4386f72480a0", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.354Z", "created_at": "2026-10-01T08:07:37.979Z", "modified": "2026-10-01T08:07:39.617Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:39.617Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_name": null, "from_type": "Indicator", "id": "2c1f5173-4552-4d6d-929d-962471e8a437", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--312b65b6-4ceb-5f1f-b4c8-96f5adbff0a8", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.404Z", "created_at": "2026-10-01T08:08:29.821Z", "modified": "2026-10-01T08:08:30.497Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:30.497Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_name": null, "from_type": "Indicator", "id": "34835fec-0a55-4f3b-af3d-d2a63a73cfd0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--36ab5af8-cf31-5a58-aa9f-c45b649b8c19", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.404Z", "created_at": "2026-10-01T08:08:25.843Z", "modified": "2026-10-01T08:08:27.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:27.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_name": null, "from_type": "Indicator", "id": "3c899eab-c1be-4747-8379-5de0f8e109fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--43cd0c0c-d15a-58d6-ab0c-7ba3570113b7", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.392Z", "created_at": "2026-10-01T08:08:15.275Z", "modified": "2026-10-01T08:08:15.439Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:15.439Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_name": null, "from_type": "Indicator", "id": "4498b2c8-5352-4af4-9f98-0fd574f24889", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--6e5fd677-e3ef-52db-9e4e-a96dd429fce7", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.333Z", "created_at": "2026-10-01T08:07:34.306Z", "modified": "2026-10-01T08:07:34.724Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:34.724Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_name": null, "from_type": "Indicator", "id": "476a34a2-682d-482a-a767-79a1b93bff6e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--876ea5c6-2cfa-51cd-a253-774e1df55406", "toId": "31a1f934-e5f5-41f9-b7a5-d280ea267ee1", "to_id": "31a1f934-e5f5-41f9-b7a5-d280ea267ee1", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.452Z", "created_at": "2026-10-01T08:09:21.590Z", "modified": "2026-10-01T08:09:21.802Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:21.802Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_name": null, "from_type": "Indicator", "id": "4809bcac-11d7-42de-8a46-fe696836f340", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--0e59fc3a-dbd4-514d-a38b-a57eb012b547", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.440Z", "created_at": "2026-10-01T08:09:08.907Z", "modified": "2026-10-01T08:09:09.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:09.200Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_name": null, "from_type": "Indicator", "id": "57178d06-2b48-4f88-bba3-4ff442033182", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--21e79076-433f-5134-9448-e4b2a9c666c3", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.336Z", "created_at": "2026-10-01T08:07:35.368Z", "modified": "2026-10-03T08:18:30.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T08:18:30.177Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_name": null, "from_type": "Indicator", "id": "5c12bdc2-2bf9-442e-b281-6ab9c8b9cc40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--d692f76f-600f-583a-9674-8368c6d85054", "toId": "6ad7c0d1-ffea-4d4e-9561-168f5c7f3988", "to_id": "6ad7c0d1-ffea-4d4e-9561-168f5c7f3988", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.312Z", "created_at": "2026-10-01T08:07:32.346Z", "modified": "2026-10-01T08:07:32.554Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:32.554Z" }, "description_available": false, "entity_type": "targets", "fromId": "cde92d73-8049-4f90-bd71-2867869f0431", "from_id": "cde92d73-8049-4f90-bd71-2867869f0431", "from_name": "update_c08937.pl", "from_type": "Malware", "id": "5f352ef4-0e1c-4013-8288-5eaa911a1086", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--d170d230-d632-5c07-96bb-baf31efac707", "toId": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "to_id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "to_name": "CVE-2026-88771", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.427Z", "created_at": "2026-10-01T08:08:55.437Z", "modified": "2026-10-01T08:08:55.779Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:55.779Z" }, "description_available": false, "entity_type": "indicates", "fromId": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_id": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_name": null, "from_type": "Indicator", "id": "61fbfd53-9405-4d8a-b381-02fd5869f600", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--9da37cb2-2292-517d-b92f-869b5941e7d5", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.331Z", "created_at": "2026-10-01T08:07:34.112Z", "modified": "2026-10-01T08:07:34.441Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:34.441Z" }, "description_available": false, "entity_type": "based-on", "fromId": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_name": null, "from_type": "Indicator", "id": "7b353e53-eeb7-4916-9f79-c5c78dcbf5a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--f18ffdf7-070b-59d4-9dab-757361ff3226", "toId": "1af69263-d226-4265-b863-927245a5eae6", "to_id": "1af69263-d226-4265-b863-927245a5eae6", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.380Z", "created_at": "2026-10-01T08:08:03.164Z", "modified": "2026-10-01T08:08:03.303Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:03.303Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_name": null, "from_type": "Indicator", "id": "7fc87080-fc09-4265-8f37-165362ebefb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--7ccdcd0f-84ac-5cce-a190-85c8475fa51d", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.380Z", "created_at": "2026-10-01T08:08:12.533Z", "modified": "2026-10-01T08:08:12.948Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:12.948Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "from_name": null, "from_type": "Indicator", "id": "83d2b7a6-0103-469e-b3cb-217e5052d2d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--82a6563f-a922-5efc-b6e5-7b1c4a6fb25a", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.329Z", "created_at": "2026-10-01T08:07:33.240Z", "modified": "2026-10-03T08:18:25.110Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T08:18:25.110Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_name": null, "from_type": "Indicator", "id": "87513292-914a-4dd6-a5c5-e061ecdc09c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--7c3febe5-1f44-50a8-81c1-5eb18529e89b", "toId": "d2edab35-d997-43c6-b086-ae49e828c272", "to_id": "d2edab35-d997-43c6-b086-ae49e828c272", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.340Z", "created_at": "2026-10-01T08:07:35.716Z", "modified": "2026-10-03T08:18:30.951Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T08:18:30.951Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c83ff903-ad71-46df-a036-de7338e78681", "from_id": "c83ff903-ad71-46df-a036-de7338e78681", "from_name": null, "from_type": "Indicator", "id": "8768a1f7-9c86-4b38-b763-9e0216f7860b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--72af1ed2-7c50-529e-9111-eeb5bfc958fc", "toId": "81346bbd-11e7-491e-b884-9a4c7ed8b2f6", "to_id": "81346bbd-11e7-491e-b884-9a4c7ed8b2f6", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.441Z", "created_at": "2026-10-01T08:09:09.694Z", "modified": "2026-10-01T08:09:10.067Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:10.067Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_name": null, "from_type": "Indicator", "id": "88f8dd65-6874-446c-ad82-5772cbd89255", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--d5fe513d-9178-582b-ad1c-afafa0f85186", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.427Z", "created_at": "2026-10-01T08:08:56.336Z", "modified": "2026-10-01T08:08:56.688Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:56.688Z" }, "description_available": false, "entity_type": "indicates", "fromId": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_id": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_name": null, "from_type": "Indicator", "id": "91ff2d67-9bc8-4a5c-a32f-1b1eedcf5bfb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--037e668e-7e4f-5d23-a7c8-cb51a85727b1", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.392Z", "created_at": "2026-10-01T08:08:15.670Z", "modified": "2026-10-01T08:08:15.865Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:15.865Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "from_name": null, "from_type": "Indicator", "id": "95dba736-8607-4f11-b430-2fd73836a285", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--ce4504c5-4a55-57b3-99c2-061f5a5fb3be", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.351Z", "created_at": "2026-10-01T08:07:37.336Z", "modified": "2026-10-01T08:07:37.654Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:37.654Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_name": null, "from_type": "Indicator", "id": "9c2dd020-f267-4d8f-b830-4b8437e6c497", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--d438fbac-368f-5568-9631-d3facd3b2616", "toId": "cb82c970-6844-478e-bfdb-99f7753180b2", "to_id": "cb82c970-6844-478e-bfdb-99f7753180b2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.466Z", "created_at": "2026-10-01T08:09:36.167Z", "modified": "2026-10-01T08:09:36.755Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:36.755Z" }, "description_available": false, "entity_type": "indicates", "fromId": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_name": null, "from_type": "Indicator", "id": "a2bb4418-c331-429d-9ecc-e6f179aaac03", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--6d90f242-5b2d-5e79-b230-d7d9766b5b9d", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.355Z", "created_at": "2026-10-01T08:07:43.768Z", "modified": "2026-10-01T08:07:45.075Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:45.075Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "from_name": null, "from_type": "Indicator", "id": "a94ec752-ffb6-43e7-a156-8479882ce8f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--6bb45e58-40cf-5576-87c4-fcd018c0f8f5", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.344Z", "created_at": "2026-10-01T08:07:36.988Z", "modified": "2026-10-03T08:18:36.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T08:18:36.835Z" }, "description_available": false, "entity_type": "based-on", "fromId": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_id": "55c799c1-ab7a-44ab-a547-080eb1020929", "from_name": null, "from_type": "Indicator", "id": "c6077266-0064-4db6-813b-07de49ea9791", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--8d14b77c-c307-5306-84c3-ea2d8c270758", "toId": "ac66423c-c594-4a71-8fff-ce38f7bdae97", "to_id": "ac66423c-c594-4a71-8fff-ce38f7bdae97", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.465Z", "created_at": "2026-10-01T08:09:35.371Z", "modified": "2026-10-01T08:09:35.554Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:35.554Z" }, "description_available": false, "entity_type": "indicates", "fromId": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_name": null, "from_type": "Indicator", "id": "c7145363-de9a-49fa-956f-a1e826a48596", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--a4a90c78-8f52-537a-b2b2-13bb4099e8bd", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.338Z", "created_at": "2026-10-01T08:07:35.718Z", "modified": "2026-10-01T08:07:36.785Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:36.785Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "from_name": null, "from_type": "Indicator", "id": "c95f01b9-6804-48d3-8b88-856276e2ccc4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--cde24f68-0bfd-520d-a3a2-7cb1b367ee8f", "toId": "45361aae-1b00-42ea-a254-3196f7049d57", "to_id": "45361aae-1b00-42ea-a254-3196f7049d57", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.368Z", "created_at": "2026-10-01T08:07:52.760Z", "modified": "2026-10-01T08:07:52.918Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:52.918Z" }, "description_available": false, "entity_type": "indicates", "fromId": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_name": null, "from_type": "Indicator", "id": "d805983a-f1e1-4711-b954-3c533cf92234", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--6a8a87a8-ab99-55c9-8c41-6ce0993e22e6", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.416Z", "created_at": "2026-10-01T08:08:41.700Z", "modified": "2026-10-01T08:08:42.902Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:42.902Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83ff903-ad71-46df-a036-de7338e78681", "from_id": "c83ff903-ad71-46df-a036-de7338e78681", "from_name": null, "from_type": "Indicator", "id": "daaa1a23-ad3c-4d57-b71f-6fecc4dcf9fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--a9811a84-af40-5bcf-a50d-b0bb4032690c", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.453Z", "created_at": "2026-10-01T08:09:22.072Z", "modified": "2026-10-01T08:09:22.322Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:09:22.322Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "from_name": null, "from_type": "Indicator", "id": "e14a7e32-1304-4068-823b-08ae7db5587a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--d136f732-63b2-5478-b8f5-9911c3d7c227", "toId": "cde92d73-8049-4f90-bd71-2867869f0431", "to_id": "cde92d73-8049-4f90-bd71-2867869f0431", "to_name": "update_c08937.pl", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.367Z", "created_at": "2026-10-01T08:07:52.382Z", "modified": "2026-10-01T08:07:52.527Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:52.527Z" }, "description_available": false, "entity_type": "indicates", "fromId": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "from_name": null, "from_type": "Indicator", "id": "e245a423-7f55-44c4-b0b5-8480e61bb02e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--9c87c8ee-ce7a-5991-9f61-994f0c31badf", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.354Z", "created_at": "2026-10-01T08:07:37.724Z", "modified": "2026-10-03T08:18:28.225Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T08:18:28.225Z" }, "description_available": false, "entity_type": "based-on", "fromId": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "from_name": null, "from_type": "Indicator", "id": "ed31da66-9f9f-4737-a67c-18f2345d86cc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--1523b5dd-04f2-5eb6-914b-ecb584197726", "toId": "cf628e58-a855-45dc-9a57-7d75371e47b8", "to_id": "cf628e58-a855-45dc-9a57-7d75371e47b8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.415Z", "created_at": "2026-10-01T08:08:40.788Z", "modified": "2026-10-01T08:08:40.995Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:08:40.995Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83ff903-ad71-46df-a036-de7338e78681", "from_id": "c83ff903-ad71-46df-a036-de7338e78681", "from_name": null, "from_type": "Indicator", "id": "f7f15c4d-e671-4833-adcd-c7284710dbc7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--b55c366a-f923-57e0-bf13-31dc45024761", "toId": "354299df-8841-40ff-9beb-866e6cf89260", "to_id": "354299df-8841-40ff-9beb-866e6cf89260", "to_name": "main.py", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.347Z", "created_at": "2026-10-01T08:07:37.142Z", "modified": "2026-10-01T08:07:37.482Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:37.482Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "from_name": null, "from_type": "Indicator", "id": "fa60695d-5bcb-4929-aff9-56af398ca902", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--2e044682-6223-54ec-8b28-304909f911c0", "toId": "ee8012a9-4f50-4fc2-ae7f-826da7d1d881", "to_id": "ee8012a9-4f50-4fc2-ae7f-826da7d1d881", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T08:06:28.312Z", "created_at": "2026-10-01T08:07:18.931Z", "modified": "2026-10-01T08:07:19.222Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-01T08:07:19.222Z" }, "description_available": false, "entity_type": "targets", "fromId": "354299df-8841-40ff-9beb-866e6cf89260", "from_id": "354299df-8841-40ff-9beb-866e6cf89260", "from_name": "main.py", "from_type": "Malware", "id": "fd7fbe70-f302-48d6-8fec-c9a7be6d4136", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "standard_id": "relationship--3bd382d0-c7f6-53c5-a465-b5b9f2544d62", "toId": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "to_id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "to_name": "CVE-2026-88771", "to_type": "Vulnerability" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "173[.]40[.]135[.]209", "description_available": false, "object_id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "object_ids": [ "1af69263-d226-4265-b863-927245a5eae6", "baa03fb2-37a0-4a24-b05a-8690cc1e463c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "baa03fb2-37a0-4a24-b05a-8690cc1e463c", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "173.40.135.209" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "1af69263-d226-4265-b863-927245a5eae6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "173.40.135.209" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "173.40.135.209" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "31[.]56[.]197[.]72", "description_available": true, "object_id": "c83ff903-ad71-46df-a036-de7338e78681", "object_ids": [ "81346bbd-11e7-491e-b884-9a4c7ed8b2f6", "c83ff903-ad71-46df-a036-de7338e78681" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c83ff903-ad71-46df-a036-de7338e78681", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "31.56.197.72" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "81346bbd-11e7-491e-b884-9a4c7ed8b2f6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "31.56.197.72" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "31.56.197.72" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45[.]141[.]21[.]130", "description_available": true, "object_id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "object_ids": [ "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "d2edab35-d997-43c6-b086-ae49e828c272" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3787ecf8-c554-4ad1-8c4f-37a7e9fc4cb6", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-01T04:55:59.000Z", "validity_status": "revoked", "value": "45.141.21.130" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "d2edab35-d997-43c6-b086-ae49e828c272", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45.141.21.130" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-01T04:55:59.000Z", "validity_status": "revoked", "value": "45.141.21.130" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "47[.]230[.]224[.]154", "description_available": false, "object_id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "object_ids": [ "31a1f934-e5f5-41f9-b7a5-d280ea267ee1", "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fd2af25c-d907-4a17-b4bd-0a1c630bb1ed", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "47.230.224.154" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "31a1f934-e5f5-41f9-b7a5-d280ea267ee1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "47.230.224.154" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "47.230.224.154" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "62[.]133[.]62[.]80", "description_available": true, "object_id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "object_ids": [ "6ad7c0d1-ffea-4d4e-9561-168f5c7f3988", "f46c867b-0d13-46a1-8d4b-5459ab0da71e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f46c867b-0d13-46a1-8d4b-5459ab0da71e", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "62.133.62.80" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "6ad7c0d1-ffea-4d4e-9561-168f5c7f3988", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "62.133.62.80" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "62.133.62.80" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "70[.]172[.]58[.]168", "description_available": false, "object_id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "object_ids": [ "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "45361aae-1b00-42ea-a254-3196f7049d57" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3bb85901-d2f9-40c8-8590-2e7a1416a2d7", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "70.172.58.168" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "45361aae-1b00-42ea-a254-3196f7049d57", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "70.172.58.168" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "ipv4", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "70.172.58.168" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938", "description_available": false, "object_id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "object_ids": [ "083fd3d5-072c-4e96-aaa2-59ac347edd83", "cf628e58-a855-45dc-9a57-7d75371e47b8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "083fd3d5-072c-4e96-aaa2-59ac347edd83", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2027-07-18T16:05:42.557Z", "validity_status": "active", "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cf628e58-a855-45dc-9a57-7d75371e47b8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "sha256", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2027-07-18T16:05:42.557Z", "validity_status": "active", "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c", "description_available": false, "object_id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "object_ids": [ "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "cb82c970-6844-478e-bfdb-99f7753180b2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "65add8bd-354c-438a-9cb7-7e9ab55c9a1d", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2027-07-18T16:05:42.557Z", "validity_status": "active", "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cb82c970-6844-478e-bfdb-99f7753180b2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "sha256", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2027-07-18T16:05:42.557Z", "validity_status": "active", "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//64[.]94[.]85[.]67[:]443/update_c08937[.]pl", "description_available": false, "object_id": "55c799c1-ab7a-44ab-a547-080eb1020929", "object_ids": [ "55c799c1-ab7a-44ab-a547-080eb1020929", "ac66423c-c594-4a71-8fff-ce38f7bdae97" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "55c799c1-ab7a-44ab-a547-080eb1020929", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "http://64.94.85.67:443/update_c08937.pl" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "ac66423c-c594-4a71-8fff-ce38f7bdae97", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://64.94.85.67:443/update_c08937.pl" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "url", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "http://64.94.85.67:443/update_c08937.pl" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//64[.]94[.]85[.]67[:]443/update_result_3567cs[.]tgz", "description_available": false, "object_id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "object_ids": [ "ee8012a9-4f50-4fc2-ae7f-826da7d1d881", "fe8653ad-2341-47f0-9a2d-28713b66dbd9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fe8653ad-2341-47f0-9a2d-28713b66dbd9", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "http://64.94.85.67:443/update_result_3567cs.tgz" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "ee8012a9-4f50-4fc2-ae7f-826da7d1d881", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://64.94.85.67:443/update_result_3567cs.tgz" } ], "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", "type": "url", "valid_from": "2026-10-01T04:55:58.000Z", "valid_until": "2026-10-21T10:30:37.434Z", "validity_status": "active", "value": "http://64.94.85.67:443/update_result_3567cs.tgz" } ], "mentioned": [ { "confidence": 50, "evidence_id": "354299df-8841-40ff-9beb-866e6cf89260", "name": "main.py", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "cde92d73-8049-4f90-bd71-2867869f0431", "name": "update_c08937.pl", "role": "mentionné", "type": "Malware" }, { "confidence": 80, "evidence_id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179", "name": "CVE-2026-88771", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T04:55:57.380Z", "created_at": "2026-10-01T08:09:51.009Z", "modified": "2026-10-03T00:48:37.692Z", "published": "2026-10-01T04:55:57.380Z", "updated_at": "2026-10-03T00:48:37.692Z" }, "description_available": true, "id": "af54747b-e75c-41af-a4ce-4167e125ab54", "is_inferred": false, "labels": [ "citrix netscaler", "command-injection", "configuration-exfiltration", "credential-creation", "cve-2026-88771", "main.py", "pre-authentication", "reverse-shell", "update_c08937.pl", "web-shell" ], "lang": "en", "name": "Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-10-01T04:55:57.380Z", "references": [ { "external_id": null, "id": "97bc8cc1-4733-4e7f-8b90-61b8c9749a47", "source_name": "alien-vault", "url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" }, { "external_id": "6abde7dd3f829cf6b721cfaa", "id": "36d02f76-e6cb-4737-a2b6-49255c1ed8f3", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6abde7dd3f829cf6b721cfaa" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" }, "targets": [], "techniques": [], "vulnerabilities": [ "CVE-2026-88771" ] }, "report_id": "af54747b-e75c-41af-a4ce-4167e125ab54", "schema_version": 1, "selected_date": "2026-10-01", "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" }