Threat reportRansomwareTL-2026-4526
CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware Affiliates Alongside Valid VPN Credentials and RMM Tool Abuse
CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware (TL-2026-4526), also tracked as CitrixBleed 2, is a critical-severity ransomware operation scored CVSS 9.3, first published 2026-10-27. It is attributed to Anubis ransomware affiliates with medium confidence, affects Citrix / NetScaler NetScaler ADC and NetScaler Gateway (configured as, references 10 CVEs (CVE-2025-5777, CVE-2026-48558, CVE-2026-31432), maps to 15 MITRE ATT&CK techniques (T1003.003, T1021.001, T1021.002), and is covered by 9 detection rules and 26 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Anubis ransomware affiliates
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4526
- Threat ID
- TL-2026-4526
- Also known as
- CitrixBleed 2, Anubis ransomware intrusions
- Severity
- CRITICAL
- CVSS
- 9.3
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Anubis ransomware affiliates
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, business services, manufacturing, technology, finance
- Target regions
- North America, united kingdom, australia, france, canada
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
Malware and tooling: Anubis Ransomware, MimiKatz, Ransom:Win64/Anubis.A, Ultra VNC, anubis, PSEXEC, Rclone - S1040, S3 Browser, ScreenConnect, Total Software Deployment, WinSCP, Zoho Assist
How CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware works
Citrix NetScaler ADC/Gateway CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory over-read enabling session hijacking and MFA bypass, was exploited from June 23, ahead of a public PoC on July 4, per the NCSC CTO weekly digest. Arctic Wolf Labs reports Anubis ransomware affiliates using it, or valid VPN credentials, for initial access, then abusing legitimate RMM tools, cloudflared tunnelling and cloud-transfer tools before encryption.
The NCSC CTO weekly summary (week ending July 5th, 2026) reports that exploitation of CVE-2025-5777, a memory over-read in Citrix NetScaler ADC and NetScaler Gateway configured as a Gateway or AAA virtual server, began on June 23, nearly two weeks before a public proof-of-concept was released on July 4. The flaw stems from insufficient input validation and leaks small amounts of memory (a few bytes, particularly when control characters terminate the read), which can expose session material and allow session hijacking and MFA bypass. Citrix published fixes in advisory CTX693420. Secondary sources cite a CVSS v4.0 score of 9.3.
Arctic Wolf Labs (published June 30, 2026) documents Anubis ransomware intrusions since the start of 2026 that began with either valid VPN credentials or CitrixBleed 2 exploitation. VPN logins were observed from VPS/hosting ASNs (AS20473 The Constant Company, AS55286 ServerMania; example source 45.227.254.25). Anubis is a ransomware-as-a-service operation that emerged in late 2024 as a rebrand of Sphinx and was announced on the RAMP forum on February 23, 2025; The Hacker News (July 2, 2026) reports 91 victims on its leak site, an 80% affiliate revenue share, and a /WIPEMODE module that reduces files to 0 KB regardless of payment. Victims are mainly healthcare, business services, manufacturing, technology and financial services, with over half in the U.S.
Post-access tradecraft: affiliates move over RDP, SMB and PsExec (PSEXESVC.exe); deploy legitimate RMM tools (ScreenConnect via relay.promotds.us, Zoho Assist, MeshAgent as mvtcs.exe, Remotely Desktop, UltraVNC, Total Software Deployment, mRemoteNG); and attempt alternate outbound paths using cloudflared, authenticated proxies (AS44477 Stark Industries, AS399629 BL Networks) and SSH-based SOCKS tunnelling. Credentials are harvested with Mimikatz staged in C:\Users\Public\Videos\ and C:\x64\, browser credential export (Chrome, Edge) and ntds.dit extraction (C:\audit\Active Directory\ntds.dit). Data is staged and exfiltrated with S3 Browser, rclone, s5cmd, WinSCP and PuTTY, including SFTP transfers from a Synology NAS. Operators focus on Remote Desktop Services servers, domain controllers, hypervisors (Hyper-V), backup-adjacent systems and NAS devices. Defense evasion includes disabling Microsoft Defender real-time protection, SophosUninstall attempts, PCHunter artifacts, clearing Windows event logs and deleting the encryptor after execution. Encryptors seen: win.exe, wmi.exe, s.exe, {6-digit}_win64_encrypt.exe (Windows) and {6-digit}_encrypt_x86_64 (Linux); encrypted files get the .anubis extension and a RESTORE FILES.html note; Microsoft detects it as Ransom:Win64/Anubis.A.
The NCSC digest also covers unrelated items that are recorded here as context only: Linux ksmbd remote unauthenticated out-of-bounds writes (CVE-2026-31432/31433) found by LLM-driven vulnerability hunting; Linux local privilege escalations (CVE-2026-43503 DirtyClone, CVE-2026-46331 pedit COW, CVE-2026-46242 Bad Epoll, CVE-2026-43074 epoll race); SimpleHelp OIDC authentication bypass (CVE-2026-48558) giving a technician session; PTC Windchill/FlexPLM RCE under active exploitation (PTC statement June 25); the North Korea-linked PolinRider campaign (162 malicious release artifacts across 108 packages: 80 Go modules, 10 Packagist packages, one Chrome extension); and a July 2025 intrusion where BumbleBee, delivered by SEO poisoning of a trojanized ManageEngine OpManager installer, dropped an AdaptixC2 beacon, dumped NTDS.dit from a domain controller, exfiltrated via FileZilla/SFTP and deployed Akira ransomware. The digest is a secondary aggregator and states no IPs, domains or hashes; network IOCs below come from the Arctic Wolf report. BeaconBeagle lookups for 45.76.79.92 and 45.227.254.25 returned HTTP 404 (no record).
MITRE ATT&CK techniques used in TL-2026-4526
Credential Access
T1003.003 OS Credential Dumping: NTDS; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Impact
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Execution
T1569.002 System Services: Service Execution
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
- Citrix / NetScaler — NetScaler ADC and NetScaler Gateway (configured as Gateway or AAA virtual server)
Vulnerable versions: Builds prior to the fixes in CTX693420
Fixed in: See Citrix advisory CTX693420 - SimpleHelp — SimpleHelp (OIDC authentication, CVE-2026-48558)
Vulnerable versions: Not stated in source
Fixed in: Not stated in source - Linux kernel — ksmbd (CVE-2026-31432, CVE-2026-31433)
Vulnerable versions: Not stated in source
Fixed in: Not stated in source
Remediation for CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
Patches
- Apply fixed NetScaler ADC/Gateway builds listed in Citrix advisory CTX693420
Immediate actions
- Patch CVE-2025-5777 per Citrix advisory CTX693420 and terminate all active ICA/PCoIP/NetScaler Gateway sessions after patching
- Reset VPN and administrative credentials and review VPN logins from hosting ASNs AS20473 and AS55286
- Block the network IOCs and typosquatted domains listed (azuremicrosoft.us, promotds.us)
- Audit endpoints for unapproved RMM tools (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment) and cloudflared
Workarounds
- Restrict RMM installation to an allowlist and restrict outbound tunnelling (cloudflared, SOCKS over SSH) at the egress firewall
Longer-term hardening
- Enforce tamper protection on endpoint security tooling
- Restrict execution from staging directories (C:\Users\Public, C:\PerfLogs, C:\Apps) via application control
- Segment Hyper-V, NAS and virtualization management from user endpoints
- Maintain offline, tested backups
- Alert on clustered authentication anomalies, RMM deployment, credential access and exfiltration tooling before encryption
CVEs associated with CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
CVE-2025-5777, CVE-2026-48558, CVE-2026-31432, CVE-2026-31433, CVE-2026-43503, CVE-2026-46331, CVE-2026-46242, CVE-2026-43074, CVE-2026-8451, CVE-2026-3055
Weaknesses (CWE) in CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
Timeline of CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
- Anubis ransomware emerged in late 2024 as a rebrand of Sphinx ransomware (month approximated; Arctic Wolf states 'late 2024').
- Anubis RaaS formally announced on the RAMP forum.
- Arctic Wolf begins investigating Anubis intrusions involving valid VPN credentials and CitrixBleed 2 exploitation (start of 2026).
- In-the-wild exploitation of CVE-2025-5777 begins, per the NCSC CTO digest, nearly two weeks before a public PoC.
- PTC reports heightened threat activity against Windchill/FlexPLM and urges immediate patching (reported in the same digest).
- Arctic Wolf Labs publishes analysis of Anubis tooling from CitrixBleed 2 to cloudflared.
- The Hacker News reports ransomware groups turning to CitrixBleed 2; Anubis leak site lists 91 victims, 11 in June 2026.
- Public proof-of-concept for CVE-2025-5777 released; NCSC CTO weekly summary published.
Sources cited for CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware
- CTO at NCSC Summary: Week Ending July 5th, 2026
- From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks (Arctic Wolf Labs)
- Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials (The Hacker News)
- Anubis ransomware exploits CitrixBleed 2 and RMM tools (Techzine)
- CitrixBleed 2 powers Anubis ransomware intrusions (SecPod)
- CVE-2025-5777 vulnerability entry (SentinelOne)
- CitrixBleed 2: Critical NetScaler Flaw Exposes Sensitive Memory Contents to Remote Attackers (Centripetal)
Detection coverage for TL-2026-4526
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4526 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.