# Ransomware Groups Weaponize Citrix Bleed 2: A New Wave of Supply Chain–Fueled Attacks


Threat actors affiliated with the Anubis ransomware operation are actively exploiting CVE-2025-5777 (Citrix Bleed 2) to establish initial network access, according to recent threat intelligence. The campaign demonstrates a troubling convergence of attack techniques: legitimate remote monitoring tools, supply chain credential theft, and bring-your-own-vulnerable-driver (BYOVD) tactics that collectively bypass traditional perimeter defenses.


## The Threat: Citrix Bleed 2 as a Gateway


CVE-2025-5777, disclosed as Citrix Bleed 2, is a critical authentication bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances. The flaw allows unauthenticated attackers to access sensitive information and, in some cases, achieve remote code execution without requiring valid credentials.


Unlike Citrix Bleed (CVE-2024-21626), which demanded pre-authentication session hijacking, Bleed 2 represents a more direct path into enterprise networks. Attackers can:


  • Bypass authentication layers protecting VPN and application gateways
  • Extract session tokens and encrypted credentials
  • Pivot into internal networks without triggering traditional access controls
  • Maintain persistence through legitimate administrative interfaces

    • The Anubis group has been observed using Citrix Bleed 2 as the opening move in a multi-stage attack sequence, leveraging it to establish a foothold before deploying more sophisticated intrusion tactics.


    ## Attack Chain: From Gateway to Lateral Movement


    Security researchers tracking the Anubis campaign have documented a consistent operational pattern:


    ### Stage 1: Initial Access via Citrix Bleed 2

    Attackers scan for publicly exposed Citrix appliances and exploit CVE-2025-5777 to gain authentication-free access. Once inside the gateway, they extract administrator credentials and session tokens—often cached in application memory.


    ### Stage 2: Credential Harvesting and Supply Chain Exploitation

    Rather than immediately pivoting laterally, Anubis affiliates employ a patience-based approach:


  • Third-party account compromise: Attackers identify software vendors, managed service providers (MSPs), and SaaS platforms with privileged access to target organizations
  • Supply chain credential theft: Credentials for widely-deployed tools (backup software, patch management platforms, remote monitoring solutions) are harvested from breached third-party environments
  • Legitimate tool deployment: Using these stolen credentials, attackers push remote access agents—including TeamViewer, AnyDesk, ConnectWise, and custom RMM platforms—directly into victim networks using trusted update channels

    • ### Stage 3: BYOVD Privilege Escalation

    Once legitimate access tools are installed, the group deploys vulnerable but signed drivers to escalate privileges and disable security controls:


  • Kernel-level persistence via unsigned driver injection
  • Endpoint detection and response (EDR) circumvention by exploiting known driver vulnerabilities
  • System-level access enabling hands-on-keyboard operations

    • ### Stage 4: Lateral Movement and Encryption

    With privileged access established, Anubis performs reconnaissance, exfiltrates high-value data, and deploys ransomware across the target environment.


    ## Technical Deep Dive: Why This Works


    ### The Citrix Bleed 2 Vulnerability

    Citrix NetScaler appliances authenticate users through a session token mechanism. CVE-2025-5777 allows attackers to:


    1. Send crafted requests to the gateway without prior authentication

    2. Trigger a memory disclosure vulnerability that leaks session data

    3. Retrieve plaintext or weakly-encrypted credentials stored in application memory


    Affected Versions:

  • NetScaler ADC 13.1 before 13.1-51.15
  • NetScaler ADC 14.1 before 14.1-20.373
  • NetScaler Gateway 13.1 and 14.1 (same version constraints)

    • ### Legitimacy as a Weapon

    The use of standard remote management tools (RMM) is intentional and dangerous:


  • Security tools trust RMM traffic because these utilities are often whitelisted in firewalls and EDR policies
  • Legitimate credentials eliminate anomalies that might otherwise trigger alerts
  • Supply chain compromise amplifies reach—one compromised vendor account can unlock dozens of customer networks simultaneously

    • ### BYOVD: Signing Vulnerabilities into the Kernel

    Bring-Your-Own-Vulnerable-Driver tactics leverage publicly disclosed driver vulnerabilities (CVE-2024-21894 targeting MSI Afterburner, CVE-2024-1086 in the Linux kernel, and others) to:


  • Load arbitrary code at kernel privilege level
  • Disable kernel-level security protections (HVCI, DMA protection)
  • Achieve persistence even after EDR remediation
  • Operate with near-absolute system control

    • ## Implications for Organizations


    ### Who Is at Risk?


    Immediate Risk:

  • Organizations running Citrix NetScaler ADC or Gateway instances
  • Companies using third-party RMM platforms (particularly those managed by compromised MSPs)
  • Firms with software supply chains connected to attacked vendors

    • Secondary Risk:

  • Any customer of an MSP or software vendor whose credentials were compromised
  • Organizations relying on outdated EDR tools that don't detect BYOVD techniques

    • ### Data Exposure and Ransomware Payoff

    Anubis has historically demanded ransom payments between $50,000 and $2,000,000+, depending on organization size and data sensitivity. Victims face:


  • Encryption of critical systems (production databases, file servers, backup repositories)
  • Data exfiltration for extortion leverage
  • Operational downtime lasting weeks or months
  • Regulatory fines for data breaches (HIPAA, GDPR, state breach notification laws)

    • ## Defensive Recommendations


    ### Immediate Actions (This Week)


    | Action | Timeline | Owner |

    |--------|----------|-------|

    | Patch Citrix appliances to latest NetScaler versions | ASAP | Infrastructure |

    | Audit Citrix access logs for suspicious authentication attempts or API calls | 48 hours | Security Operations |

    | Review RMM tool deployments for unauthorized or unfamiliar agents | 48 hours | Endpoint Security |

    | Revoke and rotate credentials for MSP and vendor accounts | 72 hours | Identity & Access Mgmt |


    ### Medium-Term Mitigation (Next 30 Days)


  • Implement network segmentation to isolate Citrix gateways from sensitive systems
  • Deploy EDR with BYOVD detection capabilities—confirm your solution detects kernel-level driver injection
  • Enable MFA on all Citrix, RMM, and vendor administrative accounts
  • Establish rate limiting on authentication endpoints to slow brute-force and credential stuffing attempts
  • Conduct a supply chain security audit: map all vendors, MSPs, and third-party tool integrations with network access

    • ### Long-Term Resilience


  • Zero-trust architecture: Assume Citrix and other perimeter tools will be compromised; design internal networks to deny lateral movement by default
  • Immutable backups: Store offline, encrypted backups isolated from production networks
  • Threat hunting: Engage external incident responders to search for BYOVD artifacts, legitimate tool misuse, and hidden persistence mechanisms
  • Vendor risk management: Require security questionnaires, incident notification timelines, and proof of SOC 2 compliance from all third-party service providers

    • ---


    ## HackWire Analysis


    The Anubis campaign exemplifies a troubling maturation in ransomware operations: instead of relying purely on exploit chains, modern threat actors are weaponizing *trust itself*. Citrix Bleed 2 is dangerous not because it's technically sophisticated, but because it opens the door to a supply-chain attack multiplier.


    The genius lies in the sequencing. Rather than burning zero-days in a frontal assault, attackers compromise one MSP or software vendor, steal enterprise credentials, and then use those trusted channels to push malware into dozens of customer networks simultaneously. One compromised third-party becomes a skeleton key to an entire ecosystem.


    What's particularly concerning is the BYOVD pivot. Kernel-level driver exploitation isn't new, but its integration into a ransomware playbook represents a dangerous escalation. EDR tools are increasingly effective at detecting post-exploitation behavior—data theft, lateral movement, privilege escalation—but a compromised driver running at kernel level can subvert the very EDR designed to catch it. Organizations that believe their endpoint protection is sufficient are nearly certainly wrong.


    The timeline matters here too. Citrix Bleed 2 patches were available in January 2025, yet the Anubis group is still finding unpatched instances in March and beyond. This tells us that many organizations either don't have visibility into their Citrix deployments, don't treat gateway appliances as critical infrastructure, or are operating legacy equipment they believe is already deprecated. That dangerous gap between known vulnerability and patch deployment remains the ransomware attacker's most reliable vector.


    Defenders should treat this campaign as a clear signal: perimeter defenses are no longer sufficient. Network segmentation, credential hygiene, and immutable backups are no longer nice-to-have—they're prerequisites for survival.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)