NetScaler C2 Beaconing to Rare External Destination Post-Exploit

Ibrahim Saud@tektrix

•updated Sep 28, 2026•4•0•15

Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.