# Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation

> Multiple ransomware-as-a-service operations, including Anubis, The Gentlemen, VECT, and TeamPCP (formerly CipherForce), are actively exploiting the Citrix Bleed 2 authentication bypass/memory-overread flaw (CVE-2025-5777, CVSS 9.3) in NetScaler ADC/Gateway for initial access, alongside a Bring Your Own Vulnerable Driver (BYOVD) technique abusing the Kontron ktapi.sys driver to blind EDR, and abuse of legitimate RMM tools (ScreenConnect, Zoho Assist, MeshAgent) for persistence.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1086
- **ID:** TL-2026-1086
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Anubis
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-5777

## Description

Since June 2026, threat intelligence has confirmed active exploitation of CVE-2025-5777 ("Citrix Bleed 2"), a critical insufficient-input-validation vulnerability in Citrix NetScaler ADC and Gateway that produces a memory overread, allowing unauthenticated remote attackers to leak session tokens and other sensitive memory contents from vulnerable appliances. Leaked session tokens allow attackers to hijack authenticated sessions and bypass multi-factor authentication entirely, echoing the original 2023 CitrixBleed (CVE-2023-4966) flaw. CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities (KEV) catalog on July 10, 2025, confirming in-the-wild exploitation; GreyNoise recorded a scanning/exploitation spike peaking around July 11, 2025 that has continued into 2026 as ransomware affiliates weaponize the flaw for initial access against internet-facing NetScaler Gateway/AAA virtual servers.

Anubis, a ransomware-as-a-service operation that emerged in late 2024 as a rebrand of the "Sphinx" prototype and formally launched in February 2025, has claimed 91 victims to date (11 in June 2026 alone), with over 50% of victims based in the United States and additional victims in the UK, Australia, France, and Canada, spanning healthcare, business services, manufacturing, technology, and financial services. Anubis is notable for an integrated destructive wiper capability (/WIPEMODE) that reduces files to 0 KB regardless of whether the ransom is paid, removing any recovery incentive even for paying victims. Anubis offers affiliates flexible monetization: an 80% payout RaaS model, a 40% cut extortion-assist model, and a 50% cut post-compromise extortion model.

The Gentlemen, first observed in mid-2025, has escalated its EDR-evasion tradecraft by deploying a zero-day BYOVD exploit against the Kontron ktapi.sys driver (previously undocumented as attacker tooling) to gain kernel-level access and disable EDR/antivirus protections, in addition to prior use of other vulnerable drivers (ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, inpoutx64.sys, wsftprm.sys) as part of an EDR-killer framework capable of disabling 400+ security processes.

VECT, a newer ransomware strain, partnered with TeamPCP (the May 2026 rebrand of the CipherForce ransomware operation, which had claimed 6 victims as of February 2026) in March 2026. VECT's encryption implementation contains a flaw that permanently destroys files larger than 128KB, making recovery impossible even with a valid decryptor.

Across these campaigns, common post-exploitation TTPs include: abuse of valid VPN credentials (e.g., Cisco AnyConnect) for initial access alongside NetScaler exploitation; RDP/SMB-based lateral movement; PsExec for remote service creation; disabling of Windows Defender and uninstalling Sophos endpoint protection; clearing of Windows event logs; use of Cloudflare Tunnel (cloudflared) for covert network tunneling and C2; a Go-based backdoor with SOCKS proxy capability; and data exfiltration via S3 Browser, rclone, s5cmd, WinSCP, and PuTTY. Persistence is frequently established through abuse of legitimate remote monitoring and management (RMM) tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, allowing attackers to blend into normal administrative traffic.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1219 Remote Access Tools
- T1543.003 Windows Service
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1553.002 Code Signing
- T1140 Deobfuscate/Decode Files or Information
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1005 Data from Local System
- T1090 Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1567.002 Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1485 Data Destruction
- T1489 Service Stop
- T1595.002 Vulnerability Scanning
- T1588.005 Exploits

## Sources

- [Ransomware Groups Turn to Citrix Bleed 2 and BYOVD Techniques for Initial Access](https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html)
- [CVE-2025-5777 Detail](https://nvd.nist.gov/vuln/detail/cve-2025-5777)
- [CVE-2025-5777 - Citrix Support Knowledge Base (CTX693420)](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420)
- [CitrixBleed 2: Critical NetScaler Flaw Exposes Sensitive Memory Contents to Remote Attackers](https://www.centripetal.ai/threat-research/citrixbleed-2-critical-netscaler-flaw-exposes-sensitive-memory-contents-to-remote-attackers)
- [CVE-2025-5777: Citrix Bleed 2 Opens Old Wounds](https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/)
- [CVE-2025-5777: Citrix NetScaler Bleed 2](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-5777/)
- [CitrixBleed 2: When Memory Leaks Become Session Hijacks](https://www.splunk.com/en_us/blog/security/citrixbleed-vulnerability-detection-mitigation.html)
- [CVE-2025-5777: Citrix Bleed 2 Memory Leak Vulnerability Explained](https://www.picussecurity.com/resource/blog/cve-2025-5777-citrix-bleed-2-memory-leak-vulnerability-explained)
- [CVE-2025-5777 Exposes Citrix NetScaler to Dangerous Memory Leak Attacks](https://www.imperva.com/blog/cve-2025-5777-exposes-citrix-netscaler-to-dangerous-memory-leak-attacks/)
- [June 27 Advisory: Multiple Vulnerabilities in NetScaler Gateway & ADC CVE-2025-5777 & CVE-2025-6543 & CVE-2025-5439](https://www.censys.com/advisory/cve-2025-5777-cve-2025-6543-cve-2025-5439)
- [CVE-2025-5777 (CitrixBleed 2) Exposes NetScaler Gateway Devices to Remote Exploitation](https://socradar.io/blog/cve-2025-5777-citrixbleed-2-netscaler-gateway-devices/)
- [Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper](https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html)
- [Wipe, leak, extort: The crazy hybrid playbook of Anubis ransomware](https://blog.barracuda.com/2025/07/11/wipe--leak--extort--the-crazy-hybrid-playbook-of-anubis-ransomwa)
- [Anubis Ransomware-as-a-Service Kit Adds Data Wiper](https://www.darkreading.com/data-privacy/anubis-ransomware-as-a-service-kit-adds-data-wiper)
- [Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets' EDRs](https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1086