CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access Broker for DragonForce Ransomware Deployment
CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access (TL-2026-1150), also tracked as CitrixBleed 2, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-07-09 and last reviewed 2026-07-10. It is attributed to DragonForce-affiliated Initial Access Broker with medium confidence, affects Citrix NetScaler ADC, references 1 CVE (CVE-2025-5777), maps to 42 MITRE ATT&CK techniques (T1003, T1005, T1010), and is covered by 9 detection rules and 43 indicators of compromise.
Key facts for TL-2026-1150
- Threat ID
- TL-2026-1150
- Also known as
- CitrixBleed 2, Citrix Bleed 2
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-09
- Last reviewed
- 2026-07-10
- Attribution
- DragonForce-affiliated Initial Access Broker
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, professional services, retail, finance, health, government administration
- Target regions
- North America, Europe, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 43
- Updates
- 2026-07-10 · revalidated 1× · latest source
Malware and tooling in CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
Malware and tooling: DragonForce, Atera, NetBird, PSEXEC, ScreenConnect, ScreenConnect Instance ID 9963f404a99f0fc4, ScreenConnect Instance ID aee74a66ea5bb239, Zoho Assist
An initial access broker, possibly affiliated with the DragonForce ransomware cartel, is exploiting the CitrixBleed 2 pre-authentication memory-overread vulnerability (CVE-2025-5777) in Citrix NetScaler ADC/Gateway appliances to harvest NSC_AAAC session cookies, bypass MFA via session replay, escalate to SYSTEM via Windows registry symlink abuse of the AppMgmt service, and deploy DragonForce ransomware.
How CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access works
Huntress documented a consistent seven-step attack chain across at least six intrusions between January and June 2026, with the fastest observed compromise-to-encryption time under one hour. The operation begins with exploitation of CVE-2025-5777 ("CitrixBleed 2"), an out-of-bounds read vulnerability (CWE-125, combined with CWE-908 use of uninitialized resource and CWE-457 use of uninitialized variable) in Citrix NetScaler ADC and Gateway appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The attacker sends malformed POST requests to the /p/u/doAuthentication.do pre-authentication login endpoint with an empty login parameter; the appliance fails to validate the missing input and reflects an uninitialized stack buffer inside an <InitialValue> XML element of the response, leaking roughly 127 bytes of adjacent heap memory per request. By repeatedly polling the endpoint the attacker harvests valid NSC_AAAC session cookies belonging to already-authenticated VPN users, which are then replayed to hijack sessions and bypass multi-factor authentication entirely, since MFA is never re-prompted for an already-valid session token. Vulnerable versions are NetScaler ADC/Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS/NDcPP before 13.1-37.235-FIPS/NDcPP, and 12.1-FIPS before 12.1-55.328-FIPS. The bug was disclosed by Citrix on 2025-06-17, scope-expanded and patched by 2025-06-23, and added to the CISA KEV catalog on 2025-07-10 after GreyNoise observed exploitation attempts beginning 2025-06-23 — nearly two weeks before public PoC release. It is functionally and thematically related to the original CitrixBleed (CVE-2023-4966) and has separately been linked to Cl0p ransomware activity. Huntress explicitly ruled out CVE-2026-4368 (a NetScaler session-management time-of-check/time-of-use flaw) as the vector in these specific intrusions.
Once inside the internal network with a hijacked session, the operator pivots to a Windows privilege-escalation technique abusing REG_LINK symbolic link values. A symbolic link is created under the RdpBus device-class GUID pointing at the Group Policy state hierarchy (...\\Group Policy State\\Machine\\GPO-List\ est). Running gpupdate triggers a policy refresh in the SYSTEM context; because the registry write follows the attacker-controlled symlink, the refresh redirects SYSTEM-context writes into protected service configuration keys, specifically hijacking the AppMgmt (Application Management) service's configuration. The attacker then issues "cmd.exe /c sc start AppMgmt >nul 2>nul", causing the Service Control Manager to launch the hijacked AppMgmt configuration as SYSTEM. The hijacked service executes "net user <account> <password> /add /y" to create a backdoor local administrator account (observed names: ctxsvc, CtxAppVCOMService, test), after which the operator restores the original registry state to reduce forensic visibility.
With a SYSTEM-level backdoor account established, the operator installs commodity remote-access tooling for durable persistence and hands-on-keyboard access, deploying ScreenConnect (via installers named us.msi, SC.msi, 1111.msi) and Zoho Assist (za.msi), staged through archives fetched from the temp.sh anonymous file-sharing service (asas.zip, ex.zip, and files matching *_update.zip, protected with the password "loko123"). ScreenConnect relay traffic was observed terminating at relay.dltsolutions[.]top, relay.eurofin[.]digital:8041, and vpts[.]us, using ScreenConnect instance IDs 9963f404a99f0fc4 and aee74a66ea5bb239; a Netbird-based relay was also observed at opa[.]tlsd[.]shop. Privilege-escalation dropper binaries were named eng.exe, legal.exe, exsym.exe, as.exe, and exp6.exe.
From the persistent foothold the operator performs credential dumping (consistent with Mimikatz-style OS credential access), host and domain enumeration, and lateral movement toward domain controllers using tooling consistent with Impacket and RemCom for remote command execution and tool transfer. In the most advanced observed intrusion, this culminated in environment-wide deployment of DragonForce ransomware via an executable named 1.exe (SHA256 c4fcae3847946173bf0b3cedf5d97a9e3d18090023842f942ba544fa7fda180d). DragonForce is a ransomware-as-a-service operation, active since August 2023, that rebranded in 2025 as a self-styled "ransomware cartel" running an affiliate program with an 80% revenue share; the cartel is associated with high-profile UK retail attacks (Marks & Spencer, Co-op, Harrods) and deploys two primary Windows payload families — one derived from leaked LockBit 3.0 builder code and a second built on the leaked ContiV3 source with added Bring-Your-Own-Vulnerable-Driver (BYOVD) EDR-killing capability, scheduled-task persistence, and expanded encryption customization. Separately reported DragonForce-affiliated activity has weaponized a Go-based backdoor ("Backdoor.Turn") that abuses Microsoft Teams TURN relay servers to tunnel C2 traffic disguised as legitimate Teams network flows, injecting into DbgView64.exe for stealth; this backdoor is typically installed post-encryption to preserve resale access to victim environments. Huntress' detection guidance centers on: high-rate failed-login floods from a single source IP against the NetScaler login endpoint; binary/unprintable characters in the User field of AAA LOGIN_FAILED audit events; the log strings "Login request is not expected to be encrypted" and "X509 cert not found"; and authenticated session activity from an IP address that has zero corresponding successful/failed authentication events on the appliance (evidence of pure session-token replay rather than fresh login).
MITRE ATT&CK techniques used in TL-2026-1150
Credential Access
T1003 OS Credential Dumping; T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1556 Modify Authentication Process
Collection
Discovery
T1010 Application Window Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1134 Access Token Manipulation
Execution
T1047 Windows Management Instrumentation; T1569 System Services
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1484 Domain or Tenant Policy Modification; T1543 Create or Modify System Process; T1548 Abuse Elevation Control Mechanism
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1133 External Remote Services; T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution
credential-access
T1111 Multi-Factor Authentication Interception
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Affected products and versions in CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
- Citrix — NetScaler ADC
Vulnerable versions: 14.1 before 14.1-43.56; 13.1 before 13.1-58.32; 13.1-FIPS/NDcPP before 13.1-37.235-FIPS/NDcPP; 12.1-FIPS before 12.1-55.328-FIPS
Fixed in: 14.1-43.56; 13.1-58.32; 13.1-37.235-FIPS/NDcPP; 12.1-55.328-FIPS - Citrix — NetScaler Gateway
Vulnerable versions: 14.1 before 14.1-43.56; 13.1 before 13.1-58.32; 13.1-FIPS/NDcPP before 13.1-37.235-FIPS/NDcPP; 12.1-FIPS before 12.1-55.328-FIPS
Fixed in: 14.1-43.56; 13.1-58.32; 13.1-37.235-FIPS/NDcPP; 12.1-55.328-FIPS
Remediation for CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
Patches
- Citrix NetScaler ADC and Gateway 14.1-43.56 and later
- Citrix NetScaler ADC and Gateway 13.1-58.32 and later
- Citrix NetScaler ADC 13.1-FIPS and NDcPP 13.1-37.235-FIPS/NDcPP and later
- Citrix NetScaler ADC 12.1-FIPS 12.1-55.328-FIPS and later
Immediate actions
- Patch NetScaler ADC/Gateway to 14.1-43.56, 13.1-58.32, 13.1-37.235-FIPS/NDcPP, or 12.1-55.328-FIPS or later immediately
- Terminate all active ICA and PCoIP sessions after patching to invalidate potentially stolen NSC_AAAC session cookies
- Kill all active sessions via 'kill icaconnection -all' and 'kill aaa session -all' on NetScaler appliances
- Audit local and domain accounts for unauthorized backdoor accounts (ctxsvc, CtxAppVCOMService, test, or similarly named)
- Hunt for and remove unauthorized ScreenConnect, Zoho Assist, and Netbird installations
- Forward NetScaler AAA and access logs to a SIEM immediately, as on-appliance log retention rotates rapidly
- Block known relay infrastructure: relay.dltsolutions[.]top, relay.eurofin[.]digital, vpts[.]us, opa[.]tlsd[.]shop
Workarounds
- No effective workaround short of patching; disabling AAA/Gateway virtual server functionality removes exposure but breaks remote access
Longer-term hardening
- Deploy EDR with behavioral detection tuned to registry symlink abuse and AppMgmt service start anomalies
- Enforce MFA re-validation on session resumption rather than trusting long-lived session cookies
- Segment NetScaler management/AAA infrastructure from internal Active Directory trust paths
- Implement network egress filtering to block unauthorized remote-access tool installers and anonymous file-sharing domains (temp.sh)
- Deploy detections for Microsoft Teams TURN-relay C2 abuse patterns associated with DragonForce Backdoor.Turn
CVEs associated with CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
Weaknesses (CWE) in CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
CWE-125, CWE-908, CWE-457, CWE-287, CWE-20
Timeline of CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
- Citrix discloses CVE-2025-5777 (CitrixBleed 2) memory overread vulnerability in NetScaler ADC/Gateway
- GreyNoise observes active exploitation attempts against CVE-2025-5777 begin, nearly two weeks before public PoC release; Citrix expands advisory scope and releases patches
- Public proof-of-concept exploit code for CVE-2025-5777 published on GitHub
- CISA adds CVE-2025-5777 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation
- Earliest of six Huntress-tracked intrusions in the CitrixBleed 2-to-DragonForce campaign begins (January-June 2026 window)
- In the same case, a legitimate employee authenticates at 13:07 UTC; the identical stolen session is driven from an attacker IP at 13:28 UTC — a 21-minute reuse window, with zero successful logins ever recorded from that attacker IP.
- In one investigated case, the attacker floods the NetScaler authentication endpoint with malformed pre-auth login POSTs, generating 5,937 AAA LOGIN_FAILED events with non-printable data in the User field over roughly 5 hours, harvesting a valid session token via the CVE-2025-5777 memory-overread.
- Security researchers report DragonForce-affiliated Go-based Backdoor.Turn abusing Microsoft Teams TURN relays for covert C2
- Observation window for the six identified intrusions closes; Huntress finalizes cross-victim correlation showing a single standardized operator playbook, aided by Citrix session printer auto-mapping artifacts embedding attacker workstation hostnames in Windows Application event logs across unrelated victims.
- Fastest observed intrusion in the campaign: full compromise from session hijack through DragonForce ransomware deployment in under one hour
- IT Security Guru and other outlets report on the Huntress findings, amplifying awareness of the repeatable CitrixBleed 2-to-DragonForce attack chain.
- Huntress publishes detailed seven-step attack chain analysis linking CVE-2025-5777 exploitation to DragonForce ransomware deployment across six intrusions
- Cyber Security News publishes a summary of the campaign, cited as the TL-Intel hunt source for the follow-up report.
Update history for TL-2026-1150
- 2026-07-10 — CitrixBleed 2 (CVE-2025-5777) Session Token Theft Leading to DragonForce Ransomware via a Standardized Seven-Stage Playbook: What changed No severity/exploitability/status/CVSS escalation — all fields (CRITICAL, ACTIVE, CVSS 9.3) confirmed unchanged. The update instead deepens the existing record with concrete case-level forensic detail and a materially broader M
Sources cited for CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
- CitrixBleed 2 & DragonForce Ransomware
- CVE-2025-5777 Detail - NVD
- CISA Adds One Known Exploited Vulnerability to Catalog
- CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises
- How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777)
- CitrixBleed 2: When Memory Leaks Become Session Hijacks
- CVE-2025-5777: Citrix Bleed 2 Memory Leak Vulnerability Explained
- CVE-2025-5777 (CitrixBleed 2) Exposes NetScaler Gateway Devices to Remote Exploitation
- CVE-2025-5777: Citrix Bleed 2 Opens Old Wounds
- CVE-2025-5777: Citrix NetScaler Bleed 2
- CVE-2025-5777 (CitrixBleed 2) - GitHub PoC
- DragonForce Ransomware Group
- Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden
- Ransomware Spotlight: DragonForce
- Retail Under Fire: Inside the DragonForce Ransomware Attacks on Industry Giants
Threats related to CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation
- CitrixBleed-Class NetScaler ADC/Gateway SAML AuthnRequest Memory Disclosure (CVE-2026-8451) Exploited Within 24 Hours of Disclosure
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2 (CVE-2025-5777) Exploitation Wave
- Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab)
- Black Basta Ransomware Operation - Organizational Breakdown & 2025 Shutdown
Detection coverage for TL-2026-1150
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1150 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.