The Implant Survives the Upgrade: NetScaler Root Access and Three Million Defense Records

by: Craig WoodPublished on: 05/10/2026

Mandiant found root-level implants on exploited NetScaler appliances and says upgrading alone will not evict them. Six KEV additions, one hacked tanker.

Threat IntelligenceCISA KEVCitrix NetScalerFortiMailCMMCDIBMaritime CybersecurityPSYber360
The Implant Survives the Upgrade: NetScaler Root Access and Three Million Defense Records