# CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access Broker for DragonForce Ransomware Deployment

> An initial access broker, possibly affiliated with the DragonForce ransomware cartel, is exploiting the CitrixBleed 2 pre-authentication memory-overread vulnerability (CVE-2025-5777) in Citrix NetScaler ADC/Gateway appliances to harvest NSC_AAAC session cookies, bypass MFA via session replay, escalate to SYSTEM via Windows registry symlink abuse of the AppMgmt service, and deploy DragonForce ransomware.

- **Published:** 2026-07-09T00:00:00Z
- **Last reviewed:** 2026-07-10T13:06:22.429Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1150
- **ID:** TL-2026-1150
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** DragonForce-affiliated Initial Access Broker
- **Detections:** 9 · **IOCs:** 43 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-5777

## Description

Huntress documented a consistent seven-step attack chain across at least six intrusions between January and June 2026, with the fastest observed compromise-to-encryption time under one hour. The operation begins with exploitation of CVE-2025-5777 ("CitrixBleed 2"), an out-of-bounds read vulnerability (CWE-125, combined with CWE-908 use of uninitialized resource and CWE-457 use of uninitialized variable) in Citrix NetScaler ADC and Gateway appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The attacker sends malformed POST requests to the /p/u/doAuthentication.do pre-authentication login endpoint with an empty login parameter; the appliance fails to validate the missing input and reflects an uninitialized stack buffer inside an <InitialValue> XML element of the response, leaking roughly 127 bytes of adjacent heap memory per request. By repeatedly polling the endpoint the attacker harvests valid NSC_AAAC session cookies belonging to already-authenticated VPN users, which are then replayed to hijack sessions and bypass multi-factor authentication entirely, since MFA is never re-prompted for an already-valid session token. Vulnerable versions are NetScaler ADC/Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS/NDcPP before 13.1-37.235-FIPS/NDcPP, and 12.1-FIPS before 12.1-55.328-FIPS. The bug was disclosed by Citrix on 2025-06-17, scope-expanded and patched by 2025-06-23, and added to the CISA KEV catalog on 2025-07-10 after GreyNoise observed exploitation attempts beginning 2025-06-23 — nearly two weeks before public PoC release. It is functionally and thematically related to the original CitrixBleed (CVE-2023-4966) and has separately been linked to Cl0p ransomware activity. Huntress explicitly ruled out CVE-2026-4368 (a NetScaler session-management time-of-check/time-of-use flaw) as the vector in these specific intrusions.

Once inside the internal network with a hijacked session, the operator pivots to a Windows privilege-escalation technique abusing REG_LINK symbolic link values. A symbolic link is created under the RdpBus device-class GUID pointing at the Group Policy state hierarchy (...\\Group Policy State\\Machine\\GPO-List\\test). Running gpupdate triggers a policy refresh in the SYSTEM context; because the registry write follows the attacker-controlled symlink, the refresh redirects SYSTEM-context writes into protected service configuration keys, specifically hijacking the AppMgmt (Application Management) service's configuration. The attacker then issues "cmd.exe /c sc start AppMgmt >nul 2>nul", causing the Service Control Manager to launch the hijacked AppMgmt configuration as SYSTEM. The hijacked service executes "net user <account> <password> /add /y" to create a backdoor local administrator account (observed names: ctxsvc, CtxAppVCOMService, test), after which the operator restores the original registry state to reduce forensic visibility.

With a SYSTEM-level backdoor account established, the operator installs commodity remote-access tooling for durable persistence and hands-on-keyboard access, deploying ScreenConnect (via installers named us.msi, SC.msi, 1111.msi) and Zoho Assist (za.msi), staged through archives fetched from the temp.sh anonymous file-sharing service (asas.zip, ex.zip, and files matching *_update.zip, protected with the password "loko123"). ScreenConnect relay traffic was observed terminating at relay.dltsolutions[.]top, relay.eurofin[.]digital:8041, and vpts[.]us, using ScreenConnect instance IDs 9963f404a99f0fc4 and aee74a66ea5bb239; a Netbird-based relay was also observed at opa[.]tlsd[.]shop. Privilege-escalation dropper binaries were named eng.exe, legal.exe, exsym.exe, as.exe, and exp6.exe.

From the persistent foothold the operator performs credential dumping (consistent with Mimikatz-style OS credential access), host and domain enumeration, and lateral movement toward domain controllers using tooling consistent with Impacket and RemCom for remote command execution and tool transfer. In the most advanced observed intrusion, this culminated in environment-wide deployment of DragonForce ransomware via an executable named 1.exe (SHA256 c4fcae3847946173bf0b3cedf5d97a9e3d18090023842f942ba544fa7fda180d). DragonForce is a ransomware-as-a-service operation, active since August 2023, that rebranded in 2025 as a self-styled "ransomware cartel" running an affiliate program with an 80% revenue share; the cartel is associated with high-profile UK retail attacks (Marks & Spencer, Co-op, Harrods) and deploys two primary Windows payload families — one derived from leaked LockBit 3.0 builder code and a second built on the leaked ContiV3 source with added Bring-Your-Own-Vulnerable-Driver (BYOVD) EDR-killing capability, scheduled-task persistence, and expanded encryption customization. Separately reported DragonForce-affiliated activity has weaponized a Go-based backdoor ("Backdoor.Turn") that abuses Microsoft Teams TURN relay servers to tunnel C2 traffic disguised as legitimate Teams network flows, injecting into DbgView64.exe for stealth; this backdoor is typically installed post-encryption to preserve resale access to victim environments. Huntress' detection guidance centers on: high-rate failed-login floods from a single source IP against the NetScaler login endpoint; binary/unprintable characters in the User field of AAA LOGIN_FAILED audit events; the log strings "Login request is not expected to be encrypted" and "X509 cert not found"; and authenticated session activity from an IP address that has zero corresponding successful/failed authentication events on the appliance (evidence of pure session-token replay rather than fresh login).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1212 Exploitation for Credential Access
- T1548 Abuse Elevation Control Mechanism
- T1068 Exploitation for Privilege Escalation
- T1136 Create Account
- T1112 Modify Registry
- T1505 Server Software Component
- T1047 Windows Management Instrumentation
- T1569 System Services
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1003 OS Credential Dumping
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1055 Process Injection
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1090 Proxy
- T1071 Application Layer Protocol
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1134 Access Token Manipulation
- T1036 Masquerading
- T1484 Domain or Tenant Policy Modification
- T1543 Create or Modify System Process
- T1133 External Remote Services
- T1098 Account Manipulation
- T1547 Boot or Logon Autostart Execution
- T1087 Account Discovery
- T1033 System Owner/User Discovery
- T1010 Application Window Discovery
- T1082 System Information Discovery

## Sources

- [CitrixBleed 2 & DragonForce Ransomware](https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware)
- [CVE-2025-5777 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2025-5777)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises](https://thehackernews.com/2025/07/cisa-adds-citrix-netscaler-cve-2025.html)
- [How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777)](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/)
- [CitrixBleed 2: When Memory Leaks Become Session Hijacks](https://www.splunk.com/en_us/blog/security/citrixbleed-vulnerability-detection-mitigation.html)
- [CVE-2025-5777: Citrix Bleed 2 Memory Leak Vulnerability Explained](https://www.picussecurity.com/resource/blog/cve-2025-5777-citrix-bleed-2-memory-leak-vulnerability-explained)
- [CVE-2025-5777 (CitrixBleed 2) Exposes NetScaler Gateway Devices to Remote Exploitation](https://socradar.io/blog/cve-2025-5777-citrixbleed-2-netscaler-gateway-devices/)
- [CVE-2025-5777: Citrix Bleed 2 Opens Old Wounds](https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/)
- [CVE-2025-5777: Citrix NetScaler Bleed 2](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-5777/)
- [CVE-2025-5777 (CitrixBleed 2) - GitHub PoC](https://github.com/win3zz/CVE-2025-5777)
- [DragonForce Ransomware Group](https://www.group-ib.com/blog/dragonforce-ransomware/)
- [Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden](https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor)
- [Ransomware Spotlight: DragonForce](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce)
- [Retail Under Fire: Inside the DragonForce Ransomware Attacks on Industry Giants](https://www.picussecurity.com/resource/blog/dragonforce-ransomware-attacks-retail-giants)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1150