Ransomware Threat: Anubis Ransomware Active Exploiting Citrix Bleed 2 CVE-2025-5777

Executive Summary: A critical vulnerability in Citrix gateway appliances is facing active exploitation by sophisticated ransomware syndicates. Security researchers at Arctic Wolf have reported that threat actors associated with the Anubis ransomware group are aggressively exploiting CVE-2025-5777, popularly known as "Citrix Bleed 2." This high-severity flaw affects Citrix NetScaler ADC and NetScaler Gateway, allowing unauthenticated attackers to bypass authentication and obtain initial access. Once inside, the threat actors deploy legitimate remote management tools to move laterally, culminating in widespread corporate network encryption and data extortion.

Deep-Dive Technical Analysis of CVE-2025-5777

CVE-2025-5777 is a critical buffer over-read vulnerability residing in the web-portal interface of Citrix NetScaler ADC and Gateway. It allows remote attackers to compromise the perimeter without requiring specialized authentication credentials. The active attack campaigns follow a highly coordinated tradecraft with severe implications for enterprise security.

Initial Access via Citrix Bleed 2

Unauthenticated attackers send a series of crafted HTTP requests to vulnerable Citrix gateway endpoints. This bypasses access controls and forces the appliance to leak active session tokens from its memory buffer. The attacker then hijacks these valid administrative session tokens, gaining direct access to the corporate network without requiring valid login credentials or triggering multi-factor authentication (MFA).

Abusing Legitimate RMM Tools

Rather than deploying custom backdoors immediately, the Anubis ransomware group employs a "Living off the Land" strategy. They download and install legitimate, commercial Remote Monitoring and Management (RMM) utilities (such as AnyDesk, ScreenConnect, or Splashtop) to establish persistent administrative access. This technique bypasses traditional endpoint security rules, as the installed software is widely recognized as legitimate administrative tooling.

Lateral Movement and Credential Access

The threat actors conduct active, hands-on-keyboard procedures to scrape memory buffers for local credentials, dump Active Directory databases, and pivot laterally to high-value domain controllers and storage servers. They expand their footprint silently, evading network detection systems.

Data Exfiltration and Encryption

Once the target infrastructure is fully mapped and sensitive corporate files are copied to external cloud servers, the attackers execute the Anubis ransomware payload, encrypting local files and demanding a payment to recover the data. They operate with dual-extortion tactics, threatening to release exfiltrated proprietary data if the ransom is unpaid.

Industry Impact and Defensive Recommendations

Citrix NetScaler appliances sit at the edge of the corporate perimeter, making them high-priority targets for initial access brokers. A compromise of a Citrix gateway grants threat actors immediate, highly privileged access behind the firewall, bypassing all external security controls.

Immediate Remediation Steps

To defend your perimeter against Citrix Bleed 2 and associated ransomware attacks, we recommend enforcing the following immediate security measures:

Apply Citrix Security Updates Immediately: Ensure all Citrix NetScaler ADC and Gateway virtual and physical appliances are updated with the official, vendor-released security patches addressing CVE-2025-5777.
Terminate and Revoke Active Session Tokens: Following patching, force a termination of all active user and administrator sessions on the NetScaler appliance and rotate all administrative passwords to invalidate any potentially hijacked session tokens.
Audit and Restrict RMM Software: Implement strict endpoint application whitelisting. Monitor and block the execution of unapproved RMM tools (like AnyDesk or ScreenConnect) on enterprise endpoints and servers.
Monitor Gateway Access Logs: Regularly audit NetScaler access logs for anomalous, high-volume HTTP requests directed at authentication endpoints or sign-ins originating from unusual geographic locations.

Frequently Asked Questions (FAQ)

What is Citrix Bleed 2?

Citrix Bleed 2 (CVE-2025-5777) is a critical buffer over-read vulnerability in the web-portal interface of Citrix NetScaler ADC and Gateway appliances, allowing for unauthenticated session token leakage.

How does Anubis ransomware exploit Citrix Bleed 2?

Anubis threat actors send crafted HTTP requests to bypass access controls and leak active session tokens, gaining direct initial access to corporate networks to deploy RMM tools and pivot laterally.

How can organizations protect against CVE-2025-5777?

Organizations must apply official Citrix security patches immediately, terminate active sessions, rotate administrative passwords, and closely audit RMM software usage across their enterprise endpoints.

Conclusion and Next Steps

The exploitation of CVE-2025-5777 underscores the critical nature of maintaining robust perimeter defenses. Organizations must prioritize patching Citrix appliances to mitigate the threat of Anubis ransomware and similar adversaries. Delaying updates exposes networks to severe risks of data extortion and operational disruption.

References:
* The Hacker News
* Cyber Recaps