APT / THREAT GROUP

NOTROBIN

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with its exploits. In effect, the hackers exploit the flaw to get access to the server, kill any existing malware, set up their own backdoor, then block off the vulnerable code from future exploit attempts by mitigation.

Threat Analysis

NOTROBIN is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/

→https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html

Quick Facts

TypeAPT / Threat Group

Aliases3

SourceMalpedia

Also Known As

NOTROBINremove_bdself.notrobin

External Intelligence

Malpedia: elf.notrobin

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search NOTROBIN