Loading story…
Attackers exploited CitrixBleed 2 (CVE-2025-5777) in Citrix NetScaler ADC and Gateway appliances to steal session data from memory and hijack valid user sessions, enabling repeated compromises across multiple organizations. Huntress reported that the flaw, a pre-authentication memory over-read, was used as the likely initial access vector in a series of intrusions, allowing attackers to bypass the practical protections of MFA once a legitimate session token had been captured.
After gaining access, the intruders followed a consistent post-compromise playbook on Windows systems: escalating privileges with a portable local privilege escalation tool abusing REG_LINK and AppMgmt, creating fake administrator accounts, and deploying remote access software including ScreenConnect and Zoho Assist. In at least one case, the activity culminated in DragonForce ransomware, and Huntress assessed the campaign was more likely tied to a successful initial access broker than a single ransomware operator, while urging defenders to patch vulnerable NetScaler systems, terminate active sessions, preserve logs, and hunt for suspicious accounts, hostnames, and tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-09, Huntress published a report detailing a consistent post-compromise playbook across unrelated victims, including session hijacking, Windows privilege escalation, fake administrator account creation, and installation of remote access tools such as ScreenConnect or Zoho Assist. The report urged organizations to patch NetScaler, retain logs, terminate outstanding sessions, and hunt for specific accounts, hostnames, and tooling.
In at least one of the intrusions Huntress investigated, the attackers progressed from NetScaler compromise to deploying DragonForce ransomware. Huntress assessed the activity was more likely tied to a common initial access broker used by multiple ransomware actors than to a single DragonForce affiliate.
Huntress described a cluster of intrusions in the first half of 2026 in which attackers repeatedly compromised Citrix NetScaler ADC and Gateway environments. The company assessed with high confidence that the initial access vector was CVE-2025-5777, also known as CitrixBleed 2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how ransomware operators linked to **LockBit** exploited Citrix NetScaler ADC and Gateway appliances through the original **CitrixBleed** flaw, `CVE-2023-4966`, using stolen session data to support follow-on access and affiliate infrastructure operations. An OSINT analysis built from joint government and Boeing-published indicators identified additional suspected LockBit infrastructure spanning command-and-control, remote management, FTP, RDP, and OpenVPN services, with recurring hosting patterns and overlaps with tooling and infrastructure previously associated with **Akira**, **Avaddon**, **Cerber**, **BumbleBee**, **Raccoon Stealer**, **RecordBreaker**, **SolarMarker**, **8Base**, and **ShadowSyndicate**. A later root-cause analysis of **CitrixBleed 2**, `CVE-2025-5777`, showed that a malformed POST request to `/p/u/doAuthentication.do` can trigger an out-of-bounds memory disclosure on vulnerable NetScaler devices, leaking up to `0x7F` bytes per request in an authentication failure response. Researchers warned that exposed memory may include credentials, session cookies, and private keys, making the bug a low-noise path to unauthenticated access similar in impact to the earlier CitrixBleed incidents; Citrix issued fixes and defenders were urged to patch immediately, invalidate sessions, reset credentials, rotate certificates and secrets where needed, and review telemetry for LockBit-related indicators, while broad community IOC feeds for suspected **LockBit 5.0** activity have also circulated with explicit false-positive caveats.
Jun 29, 2026
DragonForce affiliates sustained a broad ransomware and extortion campaign against UK organizations in May 2026, publicly naming seven UK victims on the group’s Tor leak site and posting 22 victims globally in a single day, including four UK firms. Reported victims spanned professional services, finance, logistics, construction, technology, and luxury retail, underscoring the group’s opportunistic targeting rather than a focus on one vertical. Helix International drew particular concern because of its role as a managed service provider with medium, large, and Fortune 500 clients, raising the risk of downstream compromise across customer environments. Public reporting and curated intrusion data tie DragonForce activity to exploitation of exposed remote access and internet-facing systems, including Ivanti Connect Secure, FortiOS, FortiProxy, SonicOS SSL-VPN, Apache Log4j, Microsoft SmartScreen, and SimpleHelp RMM vulnerabilities. Tooling observed in DragonForce-linked intrusions includes utilities for discovery, remote management, credential theft, defense evasion, LOLBAS abuse, and exfiltration, while affiliates have also been linked to **BYOVD** techniques to disable or bypass EDR and antivirus protections. Prior reporting further connected DragonForce affiliates attributed to **Scattered Spider** to attacks on major UK retailers including **M&S, Co-op, and Harrods**.
Jun 29, 2026
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 3, 2026