CitrixBleed Flaws Exposed NetScaler Sessions to LockBit-Linked Intrusions
Researchers detailed how ransomware operators linked to LockBit exploited Citrix NetScaler ADC and Gateway appliances through the original CitrixBleed flaw, CVE-2023-4966, using stolen session data to support follow-on access and affiliate infrastructure operations. An OSINT analysis built from joint government and Boeing-published indicators identified additional suspected LockBit infrastructure spanning command-and-control, remote management, FTP, RDP, and OpenVPN services, with recurring hosting patterns and overlaps with tooling and infrastructure previously associated with Akira, Avaddon, Cerber, BumbleBee, Raccoon Stealer, RecordBreaker, SolarMarker, 8Base, and ShadowSyndicate.
A later root-cause analysis of CitrixBleed 2, CVE-2025-5777, showed that a malformed POST request to /p/u/doAuthentication.do can trigger an out-of-bounds memory disclosure on vulnerable NetScaler devices, leaking up to 0x7F bytes per request in an authentication failure response. Researchers warned that exposed memory may include credentials, session cookies, and private keys, making the bug a low-noise path to unauthenticated access similar in impact to the earlier CitrixBleed incidents; Citrix issued fixes and defenders were urged to patch immediately, invalidate sessions, reset credentials, rotate certificates and secrets where needed, and review telemetry for LockBit-related indicators, while broad community IOC feeds for suspected LockBit 5.0 activity have also circulated with explicit false-positive caveats.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
LockBit 5.0 Sigma IOC feed publication continues on Medium
The Medium post for the LockBit 5.0 detection content was published on December 9, 2025, reflecting the release window for the experimental Sigma IOC feed. It documented broad detection logic for domains, IPs, hashes, URL patterns, hostnames, and command-line behaviors tied to suspected LockBit 5.0 activity.
Experimental LockBit 5.0 Sigma IOC feed is published
Onur OKTAY published an experimental Sigma rule and IOC feed for suspected LockBit 5.0 activity, aggregating known and inferred indicators across network and endpoint telemetry. The feed explicitly warned that several indicators were inferential and carried high false-positive risk.
Knownsec publishes root cause analysis of CitrixBleed 2
Knownsec 404 Team published a technical root cause analysis of CVE-2025-5777, explaining the malformed POST parsing bug in /p/u/doAuthentication.do and how it can leak memory in authentication failure responses. The article also noted that public proof-of-concept code already supported exploitation and urged immediate defensive action.
Citrix releases fixes for CVE-2025-5777
Citrix released fixes for CVE-2025-5777, a high-severity memory disclosure vulnerability affecting NetScaler ADC and Gateway. The flaw, later dubbed CitrixBleed 2, could expose sensitive memory contents to unauthenticated attackers.
OSINT Team publishes LockBit 3.0 infrastructure analysis
OSINT Team published an infrastructure analysis linking LockBit 3.0 affiliates exploiting CVE-2023-4966 to additional command-and-control, remote management, FTP, RDP, and OpenVPN infrastructure. The research expanded on advisory and Boeing-linked indicators and identified overlaps with other ransomware and malware ecosystems.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
LockBit 5.0 Detect - Sigma Rule - iOC Feed | by Onur OKTAY | Medium
medium.com
Open sourceRoot Cause Analysis of the CitrixBleed 2 (CVE-2025-5777) Vulnerability | by Knownsec 404 team | Medium
medium.com
Open sourceInfrastructure Analysis: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability | by Joshuapenny | OSINT Team
osintteam.blog
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CitrixBleed 2 Flaw Exposes NetScaler ADC and Gateway Sessions
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 1, 2026
Citrix NetScaler Flaws Enable RCE and Session Token Theft
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026