[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuqUdq6QBIsHUTl2YbTAy5bxsDY57pyUcZFGv_PvUePI":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3c661107-3e27-471b-9847-9d45fe9e97a6","Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials","ransomware-groups-turn-to-citrix-bleed-2-byovd-and-supply-chain-credentials-05b1c5","Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. \"Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral","The Anubis ransomware operation is exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) for initial access, alongside the use of legitimate RMM tools for lateral movement. Affiliates are also leveraging stolen VPN credentials, potentially from supply chain compromises or initial access brokers, to gain deeper access before deploying ransomware and wiper modules.","Anubis ransomware uses Citrix Bleed 2, BYOVD, and stolen supply chain credentials for access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fransomware-groups-turn-to-citrix-bleed.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh5gkjf1FwB4__nC6-pLZYnDv2rJA29UAL9mxfCv4BNSl1FxNpat9jD-OiMRLewjXJXyiSGvqiLYcewN_b1lLFHh0FhzKkrHFzu82jziSuOodYX87FkwjuCcXaqwzWRsiFdsBcd9mzDnak1rJpDu46F8TV206IEcD1pE7njojB8TcQEZ4Wa70KnK2vyeVKI\u002Fs1600\u002Fransomwares.jpg","2026-07-02T18:30:33+00:00","2026-07-02T20:00:20.974161+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Citrix NetScaler ADC","product",{"name":21,"type":19},"Citrix NetScaler Gateway",{"name":23,"type":19},"ScreenConnect",{"name":25,"type":19},"Zoho Assist",{"name":27,"type":19},"MeshAgent",{"name":29,"type":19},"Remotely","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":30,"icon":32,"name":33,"slug":34},null,"Ransomware","ransomware",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2025-5777","Citrix Bleed 2 vulnerability exploited for initial access",[18,21,23],{"controls":60,"vendors":143},[61,89,117],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,73,81],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":62,"product_name":70,"url":71,"description":72},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,101,109],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":90,"product_name":98,"url":99,"description":100},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,127,135],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":123,"product_name":124,"url":125,"description":126},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[144,150,156],{"slug":145,"name":146,"logo_path":147,"roles":148},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[149],"reported_by",{"slug":151,"name":152,"logo_path":153,"roles":154},"citrix","Citrix","\u002Fvendor-logos\u002Fcitrix.png",[155],"affected",{"slug":157,"name":158,"logo_path":159,"roles":160},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png",[149],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":179},"ransomware-groups-chain-unpatched-citrix-flaw-with-stolen-supply-chain-credentials","Ransomware Groups Chain Unpatched Citrix Flaw with Stolen Supply Chain Credentials","The Anubis ransomware operation demonstrates how attackers layer multiple weaknesses — an unpatched critical vulnerability (CVE-2025-5777 in Citrix) combined with stolen VPN credentials sourced from supply chain compromises or initial access brokers — to achieve rapid, deep network penetration. The failure to promptly patch internet-facing Citrix infrastructure provided the initial foothold, while unvetted third-party credential exposure amplified the blast radius. Once inside, the use of legitimate RMM tools allowed attackers to blend in with normal traffic, delaying detection. This combination of exploitation vectors underscores that a single unpatched system can cascade into a full ransomware-plus-wiper incident, making recovery extremely difficult or impossible.",[166,167,168,169,170,171,172,173,174,175,176,177,178],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 15 – Service Provider Management","NIST CSF ID.RA-1 – Asset Vulnerabilities Identified","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 SA-9 – External System Services (Supply Chain)","NIST SP 800-161 – Supply Chain Risk Management Practices","MITRE ATT&CK T1190 – Exploit Public-Facing Application","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1219 – Remote Access Software","ISO\u002FIEC 27001 A.12.6.1 – Management of Technical Vulnerabilities","ITIL Change Management – Emergency Change Procedures",{}]