October at Validin: Improvements to Open Directories, Advanced Search, and new research investigating a NetScaler RCE

Welcome back to Validin’s monthly newsletter and thank you for inviting us into your inbox. This October, we've rolled out a new batch of Validin updates, including expanded Open Directories capabilities, more flexible Advanced Search queries, and improved visibility into historical host responses. We're also happy to share lots of community research this month that uses Validin to discover exploits and phishing kits.

The Validin Team

PLATFORM UPDATES

Product Updates: Open Directories, Advanced Search, and Host Response History

This month, we've shipped several improvements to Validin to make investigating internet-facing infrastructure easier. Open Directories now appears on domain and IP detail pages, surfaces individual matching files in search results, and offers a new API. We've also added OR queries to Advanced Search, and introduced Host Responses timelines and table presets to make tracking infrastructure changes easier.

👉 Read the full writeup here

BY THE NUMBERS

Top-viewed threat actor profiles and how their ranking changed from last month. If you're logged into Validin, you can view the full profiles:

1. MuddyWater (+4)
2. Kimsuky
3. Lazarus Group
4. ClickFix (-3)
5. Scattered Spider (new)

RESEARCH

Citrix NetScaler Exploit Found in Validin Open Directories

New research from mokki.sh uncovers a Remote Code Execution (RCE) tool targeting a critical Citrix NetScaler vulnerability, CVE-2026-88771, inside an open directory collected and indexed by Validin. The tool is a Nuclei YAML template designed to exploit an unauthenticated RCE vulnerability, which could give attackers root-level access to vulnerable NetScaler appliances. The directory also includes the actual exploitation tooling, with Chinese-language comments.

👉 Read the writeup from mokki.sh here

IN CASE YOU MISSED IT

New from Vega Security: Google Drive Phishing

Check out this great research from the Vega Security team, which uses Validin to uncover infrastructure behind a Google Drive phishing campaign.

Read it here

P7 DarkSword Variant Emerges

The iVerify team identified a new variant of the DarkSword iOS exploit kit and used Validin alongside custom tooling to find the use of this variant across the broader internet.

Find the writeup here