# CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware Affiliates Alongside Valid VPN Credentials and RMM Tool Abuse

> Citrix NetScaler ADC/Gateway CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory over-read enabling session hijacking and MFA bypass, was exploited from June 23, ahead of a public PoC on July 4, per the NCSC CTO weekly digest. Arctic Wolf Labs reports Anubis ransomware affiliates using it, or valid VPN credentials, for initial access, then abusing legitimate RMM tools, cloudflared tunnelling and cloud-transfer tools before encryption.

- **Published:** 2026-10-27T10:16:38Z
- **Last reviewed:** 2026-10-27T10:16:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4526
- **ID:** TL-2026-4526
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Anubis ransomware affiliates
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-5777, CVE-2026-48558, CVE-2026-31432, CVE-2026-31433, CVE-2026-43503, CVE-2026-46331, CVE-2026-46242, CVE-2026-43074, CVE-2026-8451, CVE-2026-3055

## Description

The NCSC CTO weekly summary (week ending July 5th, 2026) reports that exploitation of CVE-2025-5777, a memory over-read in Citrix NetScaler ADC and NetScaler Gateway configured as a Gateway or AAA virtual server, began on June 23, nearly two weeks before a public proof-of-concept was released on July 4. The flaw stems from insufficient input validation and leaks small amounts of memory (a few bytes, particularly when control characters terminate the read), which can expose session material and allow session hijacking and MFA bypass. Citrix published fixes in advisory CTX693420. Secondary sources cite a CVSS v4.0 score of 9.3.

Arctic Wolf Labs (published June 30, 2026) documents Anubis ransomware intrusions since the start of 2026 that began with either valid VPN credentials or CitrixBleed 2 exploitation. VPN logins were observed from VPS/hosting ASNs (AS20473 The Constant Company, AS55286 ServerMania; example source 45.227.254.25). Anubis is a ransomware-as-a-service operation that emerged in late 2024 as a rebrand of Sphinx and was announced on the RAMP forum on February 23, 2025; The Hacker News (July 2, 2026) reports 91 victims on its leak site, an 80% affiliate revenue share, and a /WIPEMODE module that reduces files to 0 KB regardless of payment. Victims are mainly healthcare, business services, manufacturing, technology and financial services, with over half in the U.S.

Post-access tradecraft: affiliates move over RDP, SMB and PsExec (PSEXESVC.exe); deploy legitimate RMM tools (ScreenConnect via relay.promotds.us, Zoho Assist, MeshAgent as mvtcs.exe, Remotely Desktop, UltraVNC, Total Software Deployment, mRemoteNG); and attempt alternate outbound paths using cloudflared, authenticated proxies (AS44477 Stark Industries, AS399629 BL Networks) and SSH-based SOCKS tunnelling. Credentials are harvested with Mimikatz staged in C:\Users\Public\Videos\ and C:\x64\, browser credential export (Chrome, Edge) and ntds.dit extraction (C:\audit\Active Directory\ntds.dit). Data is staged and exfiltrated with S3 Browser, rclone, s5cmd, WinSCP and PuTTY, including SFTP transfers from a Synology NAS. Operators focus on Remote Desktop Services servers, domain controllers, hypervisors (Hyper-V), backup-adjacent systems and NAS devices. Defense evasion includes disabling Microsoft Defender real-time protection, SophosUninstall attempts, PCHunter artifacts, clearing Windows event logs and deleting the encryptor after execution. Encryptors seen: win.exe, wmi.exe, s.exe, {6-digit}_win64_encrypt.exe (Windows) and {6-digit}_encrypt_x86_64 (Linux); encrypted files get the .anubis extension and a RESTORE FILES.html note; Microsoft detects it as Ransom:Win64/Anubis.A.

The NCSC digest also covers unrelated items that are recorded here as context only: Linux ksmbd remote unauthenticated out-of-bounds writes (CVE-2026-31432/31433) found by LLM-driven vulnerability hunting; Linux local privilege escalations (CVE-2026-43503 DirtyClone, CVE-2026-46331 pedit COW, CVE-2026-46242 Bad Epoll, CVE-2026-43074 epoll race); SimpleHelp OIDC authentication bypass (CVE-2026-48558) giving a technician session; PTC Windchill/FlexPLM RCE under active exploitation (PTC statement June 25); the North Korea-linked PolinRider campaign (162 malicious release artifacts across 108 packages: 80 Go modules, 10 Packagist packages, one Chrome extension); and a July 2025 intrusion where BumbleBee, delivered by SEO poisoning of a trojanized ManageEngine OpManager installer, dropped an AdaptixC2 beacon, dumped NTDS.dit from a domain controller, exfiltrated via FileZilla/SFTP and deployed Akira ransomware. The digest is a secondary aggregator and states no IPs, domains or hashes; network IOCs below come from the Arctic Wolf report. BeaconBeagle lookups for 45.76.79.92 and 45.227.254.25 returned HTTP 404 (no record).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1569.002 System Services: Service Execution
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.003 OS Credential Dumping: NTDS
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1485 Data Destruction

## Sources

- [CTO at NCSC Summary: Week Ending July 5th, 2026](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-july-b99)
- [From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks (Arctic Wolf Labs)](https://arcticwolf.com/?p=133342)
- [Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials (The Hacker News)](https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html)
- [Anubis ransomware exploits CitrixBleed 2 and RMM tools (Techzine)](https://www.techzine.eu/news/security/142624/anubis-ransomware-exploits-citrixbleed-2-and-rmm-tools)
- [CitrixBleed 2 powers Anubis ransomware intrusions (SecPod)](https://www.secpod.com/learn/security-research/citrix-bleed-2-powers-anubis-ransomware-intrusions)
- [CVE-2025-5777 vulnerability entry (SentinelOne)](https://www.sentinelone.com/vulnerability-database/cve-2025-5777/)
- [CitrixBleed 2: Critical NetScaler Flaw Exposes Sensitive Memory Contents to Remote Attackers (Centripetal)](https://www.centripetal.ai/threat-research/citrixbleed-2-critical-netscaler-flaw-exposes-sensitive-memory-contents-to-remote-attackers)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4526