Weekly Threat Digest: Citrix NetScaler Zero-Days, ShinyHunters and NeedyMantis
HiveForce Labs reports two attacks, four exploited vulnerabilities and two tracked adversaries for 28 September to 4 October 2026, led by Citrix NetScaler zero-days and renewed ShinyHunters exploitation of Oracle PeopleSoft.
Summary
HiveForce Labs reports a sharp rise in cyber threats over the past week. Two major attacks were detected, four vulnerabilities were actively exploited, and two threat actor groups were closely tracked. Together, they point to growing malicious activity worldwide.
Citrix has confirmed two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772. Attackers exploited both as zero-days before any fix existed. The first flaw lets an unauthenticated attacker run commands on the device, even in the default setup. The second is a memory overflow that can cause code execution or a denial of service when DTLS is enabled, which is the default for VPN virtual servers. Since NetScaler sits at the network edge and handles VPN, remote access, and user logins, a hacked device gives attackers a way into internal systems.
ShinyHunters (UNC6240) is again mass-exploiting the critical Oracle PeopleSoft PeopleTools flaw CVE-2026-35273. The group bypasses WAF rules by URL-encoding a single character in the PSEMHUB path, which lets it reach unpatched systems. It has dropped web shells, the SIDEEYE backdoor, Neo-reGeorg tunnels, and MeshAgent across education, healthcare, government, and other sectors to steal data and demand ransom. Organizations should patch immediately and not rely on WAF rules alone. These incidents show a rising trend of attacks that mix technical exploits with social engineering, so timely patching, constant monitoring, and layered defenses remain essential.
Insights
Attackers are walking in through things we trust, from edge devices and built-in Apple tools to everyday software and a WAF we assumed was enough.
Attackers used CVE-2026-88771 and CVE-2026-88772 before any fix existed, so every unpatched day is a day of exposure.
Getting in is just step one. The real damage comes from how long they stay, so patch fast, then check who's already inside.
Apple's CVE-2026-86950 can run an attacker's code just from opening a crafted file, so one tap is all it takes.
ShinyHunters has renewed mass exploitation of Oracle's CVE-2026-35273, so patch immediately and hunt for web shells and tunnels.
NeedyMantis reaches telecom, education, nonprofit, healthcare, and government networks, so Storm-3069 can be in any of them.
Attack Details
SIDEEYE
- Type
- Multi-stage backdoor
- Associated actor
- ShinyHunters
- Overview
- A multi-stage C++ backdoor delivered in-memory on compromised Windows PeopleSoft servers, capable of stealing browser and desktop-application credentials, file/process management, interactive reverse shell, and reverse-proxy tunneling.
- Delivery method
- Trojanized
Ple64.exeinstaller - Targeted CVE
CVE-2026-35273- Affected platform
- Oracle PeopleSoft PeopleTools
- Impact
- Credential theft, remote control
- Patch link
- oracle.com/security-alerts/alert-cve-2026-35273.html
NeedyMantis
- Type
- Modular backdoor
- Associated actor
- Storm-3069
- Overview
- A modular, post-compromise backdoor used by the China-based threat actor Storm-3069 to keep hidden, long-term access to networks it has already broken into. Attackers place a trusted program such as Poedit, curl, Vim, or TightVNC next to a malicious DLL and an encrypted archive, so the trusted program loads the malware without raising suspicion, then spread the bundle to other machines with the Impacket toolkit.
- Delivery method
- DLL sideloading
- Affected platform
- Windows
- Impact
- Persistent access, system reconnaissance, defense evasion, remote control
Vulnerability Details
| CVE ID | Name | Affected product | Actors / attacks | CWE | Associated TTPs |
|---|---|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler Improper Input Validation | Citrix NetScaler ADC & Gateway (14.1 before 14.1-73.37; 13.1 before 13.1-64.23; 14.1-FIPS before 14.1-73.37 FIPS; 13.1-FIPS & 13.1-NDcPP before 13.1-37.279) | - | CWE-20 | T1190, T1059 |
| CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler ADC & Gateway (ADC before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and 13.1-64.23) | - | CWE-119 | T1190, T1059, T1499 |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write | Apple iOS and iPadOS (before 26.7.1), macOS Tahoe (before 26.7.1), macOS Sequoia (before 15.8.1) | - | CWE-787 | T1059, T1203 |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | Oracle PeopleSoft Enterprise PeopleTools (versions 8.61, 8.62) | ShinyHunters; SIDEEYE | CWE-306 | T1190, T1059 |
Patch links
Actor Details
ShinyHunters (aka UNC6240)
- Motive
- Financial gain
- Targeted industries
- Higher education, technology, IT services, healthcare, agriculture, transportation, government
- Targeted regions
- Worldwide
- Targeted CVE
CVE-2026-35273- Attacks / ransomware
- SIDEEYE
- Affected product
- Oracle PeopleSoft
- TTPs
T1595Active Scanning;T1595.002Vulnerability Scanning;T1596Search Open Technical Databases;T1596.003Digital Certificates;T1596.005Scan Databases;T1190Exploit Public-Facing Application;T1059Command and Scripting Interpreter;T1059.003Windows Command Shell;T1059.004Unix Shell;T1505Server Software Component;T1505.003Web Shell;T1027Obfuscated Files or Information;T1140Deobfuscate/Decode Files or Information;T1553Subvert Trust Controls;T1553.002Code Signing;T1552Unsecured Credentials;T1552.001Credentials In Files;T1110Brute Force;T1110.003Password Spraying;T1555Credentials from Password Stores;T1555.003Credentials from Web Browsers;T1082System Information Discovery;T1016System Network Configuration Discovery;T1021Remote Services;T1021.004SSH;T1105Ingress Tool Transfer;T1071Application Layer Protocol;T1071.001Web Protocols;T1572Protocol Tunneling;T1090Proxy;T1219Remote Access Software;T1560Archive Collected Data;T1560.001Archive via Utility;T1048Exfiltration Over Alternative Protocol;T1491Defacement;T1491.001Internal Defacement
Storm-3069
- Origin
- China
- Motive
- Information theft, espionage
- Targeted industries
- Telecommunications, Education, Healthcare, Nonprofits, Government
- Targeted regions
- Worldwide
- Attacks / ransomware
- NeedyMantis
- TTPs
T1129Shared Modules;T1543Create or Modify System Process;T1574Hijack Execution Flow;T1036Masquerading;T1027Obfuscated Files or Information;T1140Deobfuscate/Decode Files or Information;T1622Debugger Evasion;T1082System Information Discovery;T1033System Owner/User Discovery;T1057Process Discovery;T1083File and Directory Discovery;T1570Lateral Tool Transfer;T1021Remote Services;T1071Application Layer Protocol;T1573Encrypted Channel;T1132Data Encoding;T1105Ingress Tool Transfer;T1041Exfiltration Over C2 Channel;T1543.003Windows Service;T1574.002DLL;T1036.005Match Legitimate Resource Name or Location;T1036.008Masquerade File Type;T1027.013Encrypted/Encoded File;T1027.015Compression;T1027.007Dynamic API Resolution;T1021.002SMB/Windows Admin Shares;T1071.001Web Protocols;T1573.001Symmetric Cryptography;T1132.001Standard Encoding
Recommendations
- 01Security TeamsUse this digest to prioritize the four exploited vulnerabilities and block the indicators related to the threat actors ShinyHunters and Storm-3069, and the malware SIDEEYE and NeedyMantis.
- 02Uni5 UsersHivePro Uni5 customers can action this digest on the Uni5 dashboard: run a scan to discover the assets impacted by the four exploited vulnerabilities, and test the efficacy of security controls by simulating attacks related to ShinyHunters, SIDEEYE and NeedyMantis in Breach and Attack Simulation (BAS).
Indicators of Compromise (IoCs)
| Attack | Type | Value |
|---|---|---|
| SIDEEYE | SHA256 | 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3 |
| SIDEEYE | IPv4 | 162[.]219[.]30[.]165 |
| NeedyMantis | SHA256 | e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 |
Top MITRE ATT&CK TTPs
Threat Advisories
- Citrix NetScaler Zero-Days Under Active Exploitation
- Apple CoreGraphics Flaw Exploited in Targeted Attacks
- From Zero-Day to N-Day: ShinyHunters Renews Oracle PeopleSoft Mass Exploitation
- NeedyMantis: The Patient Predator Hiding in Plain Sight
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)