NetScaler attackers tunnel into internal networks with a new Python proxy

The two tools split the work. WHIPSHOT, a PHP web shell, pulls Base64-encoded commands out of native HTTP headers, runs them, and returns the output ^[6]. SLAPSHOT, a Python tunneler, takes its orders from WHIPSHOT and forwards arbitrary TCP streams to internal hosts ^[7]. Google says it watched the actor relay traffic through that proxy in one incident to run internal reconnaissance and steal credentials by hand ^[8]. If no session or command arrives within ten minutes, SLAPSHOT removes its port and lock files and shuts down, thinning the forensic trail ^[15].

Installation hides inside ordinary web-server config. One variant enables the mod_php engine, registers .sig files as executable PHP, and maps inbound .ico image requests under /vpn/media/ onto matching .sig files ^[10]. "For example, clients accessing /vpn/media/e6ee7c85.ico would be served by the dropped PHP web shell e6ee7c85.sig," Google said ^[11].

The disguise leaves traces in the logs. "In at least one case, web server access logs showed GET requests returning HTTP 404 responses, but exhibiting elevated processing durations and multi-kilobyte response sizes," Google said ^[13]. The same logs point past a single victim. "In subsequent days, the actor attempted access to non-existent .sig files, which generated missing-file errors in httperror-vpn logs implying the files were not there. This may be an indication of attackers managing similar web shells in multiple compromised environments," Google said ^[14].

The flaw hands over root before authentication. "Exploitation of CVE-2026-88772 bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine (NSPPE) to establish initial root-level access," Google said ^[3]. The trigger sits in the DTLS handshake: "transmitting specially malformed or fragmented record headers induces heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform," Google said ^[5].

Google places the incident in a wider run on internet-facing gear. "This campaign underscores the continued targeting of edge devices to gain initial access to victim networks," Google said ^[16].