Loading story…
Arctic Wolf reported multiple 2026 intrusions tied to the Anubis ransomware-as-a-service operation in which affiliates gained initial access through abused VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777) on NetScaler ADC and Gateway systems. The intrusions then progressed through lateral movement over RDP and SMB, credential harvesting, use of PsExec, and efforts to reduce security visibility before ransomware was deployed and files were encrypted with the .anubis extension.
Investigators said the attackers relied heavily on legitimate remote management, tunneling, and data-transfer tools during the pre-encryption phase, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, cloudflared, SSH tunnels, rclone, s5cmd, and S3 Browser. The activity shows Anubis affiliates blending living-off-the-land techniques with benign-looking administration software to stage data and maintain access, giving defenders an opportunity to detect attacks earlier by treating unusual clusters of remote-access, credential, tunneling, and cloud-transfer behavior as signs of compromise rather than routine IT activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Across multiple intrusions observed in 2026, affiliates of the Anubis ransomware-as-a-service operation gained initial access using valid VPN credentials and by exploiting CitrixBleed 2 (CVE-2025-5777) against NetScaler ADC and Gateway systems. Post-compromise activity included lateral movement via RDP and SMB, credential harvesting, use of legitimate RMM and tunneling tools, data staging, and eventual ransomware deployment.
On July 1, 2026, Arctic Wolf published a research blog describing the Anubis intrusions and highlighting recurring abuse of VPN infrastructure, exploitation of CitrixBleed 2, and use of legitimate RMM tools during pre-encryption phases. The report presented these behaviors as detection and containment opportunities for defenders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Attackers exploited **CitrixBleed 2** (`CVE-2025-5777`) in Citrix NetScaler ADC and Gateway appliances to steal session data from memory and hijack valid user sessions, enabling repeated compromises across multiple organizations. Huntress reported that the flaw, a pre-authentication memory over-read, was used as the likely initial access vector in a series of intrusions, allowing attackers to bypass the practical protections of MFA once a legitimate session token had been captured. After gaining access, the intruders followed a consistent post-compromise playbook on Windows systems: escalating privileges with a portable local privilege escalation tool abusing `REG_LINK` and `AppMgmt`, creating fake administrator accounts, and deploying remote access software including **ScreenConnect** and **Zoho Assist**. In at least one case, the activity culminated in **DragonForce ransomware**, and Huntress assessed the campaign was more likely tied to a successful initial access broker than a single ransomware operator, while urging defenders to patch vulnerable NetScaler systems, terminate active sessions, preserve logs, and hunt for suspicious accounts, hostnames, and tooling.
Jul 10, 2026