# Mandiant finds NetScaler attacks predated detection by more than three weeks

_Published Wednesday, September 30, 2026 at 4:21 PM EDT · Security · Latest · Tier 2 — Notable_

![Mandiant finds NetScaler attacks predated detection by more than three weeks — Primary](https://cyberscoop.com/wp-content/uploads/sites/3/2026/09/GettyImages-2190684145.jpg)

Mandiant says attackers exploited Citrix NetScaler vulnerability CVE-2026-88772 from at least Sept. 3, more than three weeks before attacks were confirmed. Researchers told CyberScoop that organizations across North America and Europe were likely compromised; Mandiant Consulting's chief technology officer said dozens of organizations were impacted.

The investigation found tools used to gain privileged access, move through networks and steal data. One intrusion used tunneler malware for internal reconnaissance and credential theft. Mandiant is still responding to active intrusions and says new evidence could change the campaign timeline.

## Sources

- [CyberScoop](https://cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/)

---
Canonical: https://techandbusiness.org/newswire/8GAOGtVaCWlRqR1CMT6CTp
Published: 2026-09-30T20:21:20.672Z
Story chronology: 2026-09-29T21:30:22.000Z
Retrieved: 2026-09-30T22:22:04.165Z
Publisher: Tech & Business (techandbusiness.org)