CitrixBleed 2 Powers Anubis Ransomware Intrusions

Summary

Anubis ransomware affiliates are exploiting CVE-2025-5777, widely referred to as CitrixBleed 2, to gain access to enterprise environments through vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances. The flaw enables memory overread in Gateway or AAA virtual server configurations, potentially exposing session material that can be used for session hijacking and multi-factor authentication bypass. Once inside, Anubis affiliates have been observed using RDP, SMB, PsExec, legitimate remote management tools, credential dumping utilities, cloud transfer tools, tunneling software, and ransomware encryptors to move from edge access to full-scale extortion.

Background of Anubis Ransomware

Anubis is a ransomware-as-a-service operation associated with affiliate-driven intrusions, data theft, encryption, and optional destructive capabilities. The operation emerged after the Sphinx ransomware brand was rebranded, with the encrypted file extension shifting from .sphinx to .anubis.

Unlike ransomware operations that rely on a single uniform playbook, Anubis activity varies by affiliate. However, recent intrusions show repeated operational patterns: abuse of VPN infrastructure, use of legitimate remote monitoring and management tools, hands-on-keyboard lateral movement, credential access, data exfiltration, defense evasion, and deployment of Windows and Linux ransomware payloads.

What is CVE-2025-5777?

CVE-2025-5777 is a critical vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The issue is caused by insufficient input validation that can lead to an out-of-bounds memory read when the appliance is configured as a Gateway or AAA virtual server.

The vulnerability is significant because NetScaler Gateway systems are commonly exposed to the internet and often sit directly in front of sensitive authentication workflows. In a successful attack, an unauthenticated attacker may be able to read memory from the appliance and recover sensitive session material. If valid session tokens are exposed, attackers may hijack active sessions and bypass MFA without needing the user's password or second factor.

Affected Versions

The following supported versions of NetScaler ADC and NetScaler Gateway are affected if they are configured as a Gateway or AAA virtual server:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-58.32
• NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.235-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS before 12.1-55.328-FIPS

Why CVE-2025-5777 is Called CitrixBleed 2

CVE-2025-5777 has been widely referred to as CitrixBleed 2 because its operational impact resembles the earlier CitrixBleed vulnerability, CVE-2023-4966. Both issues involve memory disclosure in Citrix NetScaler appliances and can expose session-related data. This makes the vulnerability especially dangerous because the attacker may not need to steal credentials directly.

Instead of brute-forcing passwords or defeating MFA, attackers can attempt to steal active session material from memory and reuse it to impersonate authenticated users. For ransomware affiliates, this creates a highly valuable initial access path into internal enterprise networks.

Attack Methodology

• Phase 1: Internet-Facing Appliance Discovery
  Attackers identify exposed Citrix NetScaler ADC and Gateway appliances, especially systems configured as VPN virtual servers, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers.
• Phase 2: CVE-2025-5777 Exploitation
  A crafted request triggers memory overread behavior. The attacker attempts to recover session material or authentication artifacts from appliance memory.
• Phase 3: Session Reuse and MFA Bypass
  If valid session tokens are recovered, attackers reuse them to impersonate users and gain access without completing standard authentication.
• Phase 4: Internal Reconnaissance
  Once inside, affiliates enumerate systems, identify high-value infrastructure, and assess access to RDP, SMB, domain controllers, file servers, NAS devices, hypervisors, and backup systems.
• Phase 5: Lateral Movement
  RDP and PsExec are used to move across the network. Attackers often pivot from VPN client ranges into systems that do not normally receive interactive logons.
• Phase 6: RMM Tool Deployment
  Legitimate remote administration tools are installed to maintain access while blending into normal IT activity. This includes ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment.
• Phase 7: Credential Theft
  Mimikatz, browser password exports, and Active Directory database access are used to obtain credentials for broader compromise.
• Phase 8: Tunneling and Alternate Access
  Affiliates may configure tools such as cloudflared, authenticated proxies, or SSH SOCKS tunnels to create alternate outbound access paths.
• Phase 9: Exfiltration and Defense Evasion
  Data movement tools are used before encryption. At the same time, attackers attempt to disable security tools, clear logs, and reduce forensic visibility.
• Phase 10: Ransomware Deployment
  Windows and Linux Anubis encryptors are executed. Files are encrypted with the .anubis extension, and ransom notes are dropped as RESTORE FILES.html.

Visual Attack Flow

Indicators of Compromise (IOCs)

Network Indicators

• 45.227.254[.]25
• 45.76.79[.]92
• relay.promotds[.]us
• azuremicrosoft[.]us

Ransomware Artifacts

Observed Encryptor Filenames

Observed Staging Paths

• C:\Apps
• C:\PerfLogs
• C:\Users\Public
• C:\Users\Default\AppData\
• C:\Windows\Temp\netscan
• /usr/local/etc/cloudflared
• /volume1/
• /volume2/

Credential Access Artifacts

• C:\Users\Public\Videos\mimikatz.exe
• C:\Users\Public\mimikatz.exe
• C:\x64\mimikatz.exe
• Chrome Passwords.csv
• Microsoft Edge Passwords.csv
• C:\audit\Active Directory\ntds.dit
• Active Directory.zip

MITRE ATT&CK Mapping

Mitigation

1. Patch CVE-2025-5777 immediately.
   Upgrade NetScaler ADC and NetScaler Gateway appliances to fixed versions recommended by Citrix. Prioritize internet-facing Gateway and AAA virtual server deployments.
2. Terminate active sessions after patching.
   Patching alone may not invalidate already stolen session material. After updating, terminate active ICA, PCoIP, RDP Proxy, and AAA sessions as recommended by the vendor.
3. Review NetScaler and VPN logs.
   Hunt for unusual source IP changes, VPS-hosted source addresses, impossible travel, abnormal session reuse, and access from unexpected geographies.
4. Restrict remote administration tooling.
   Maintain an approved RMM allowlist and alert when unauthorized tools such as ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, or Total Software Deployment appear.
5. Harden endpoint security.
   Enable tamper protection, block unauthorized driver loading, restrict execution from user-writable paths, and monitor attempts to disable EDR or antivirus controls.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.