Ledger / Sep 2025
Criminals discuss weaponizing HexStrike AI against Citrix NetScaler zero-days
Suspected
Check Point reports underground discussion and claims, not confirmed attack telemetry; the Storm-1575 attribution appears only in later secondary coverage.
Within hours of HexStrike AI's release, underground channels discussed using it against freshly disclosed Citrix zero-days. The framework connects LLMs to 150+ security tools through MCP.
“malicious actors began discussing how to weaponize it”Check Point
Sources
- Hexstrike-AI: When LLMs Meet Zero-Day ExploitationCheck Point · 3 Sep 2025 · primary source
- Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of DisclosureThe Hacker News · 3 Sep 2025 · secondary source
- Date
- Sep 2025
- Disclosed
- 3 Sep 2025
- Actor
- Underground forum actors (later attributed in press to Storm-1575) (criminal), as attributed by Check Point
- Targets
- Citrix NetScaler ADC/Gateway (CVE-2025-7775, -7776, -8424)
- What the AI did
- Vuln research, Exploit dev, Agentic intrusion, Ops automation
- Model
- unspecified LLMs via HexStrike AI MCP server
- Model family
- Open-source harness
- Model basis
- unknown
- Autonomy
- semi-autonomous
- Outcome
- Forum claims of exploitation and sale of compromised appliances; Check Point said it lacked proof of use in attacks at publication.