NOTROBIN
- Primary motivation
- espionage
- Sophistication
- expert
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:59:03
Targeted industries: technology-and-telecommunications
Context
Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with its exploits. In effect, the hackers exploit the flaw to get access to the server, kill any existing malware, set up their own backdoor, then block off the vulnerable code from future exploit attempts by mitigation.
Reports & references
- theregister.co.uk — Hackers Patch Citrix Vulnerability (report)
- Mandiant — Vigilante Deploying Mitigation For Citrix Netscaler Vulnerability While Maintaining Backdoor (report)