Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

The Anubis ransomware operation demonstrates how attackers layer multiple weaknesses — an unpatched critical vulnerability (CVE-2025-5777 in Citrix) combined with stolen VPN credentials sourced from supply chain compromises or initial access brokers — to achieve rapid, deep network penetration. The failure to promptly patch internet-facing Citrix infrastructure provided the initial foothold, while unvetted third-party credential exposure amplified the blast radius. Once inside, the use of legitimate RMM tools allowed attackers to blend in with normal traffic, delaying detection. This combination of exploitation vectors underscores that a single unpatched system can cascade into a full ransomware-plus-wiper incident, making recovery extremely difficult or impossible.