HIGHRansomware
Global

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

·Source: The Hacker News

Updated:

Executive Summary

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral

Analysis

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral

Indicators of Compromise (1)

CVE (1)
CVE-2025-5777
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 2, 2026.

Related Threats

HIGHRansomwareNEW

Qilin Dominates Ransomware Market Amid Growing Cybercrime Consolidation

The ransomware landscape is reconsolidating around major players, with Qilin emerging as the leading RaaS operation, researchers say

Infosecurity Magazine
HIGHRansomware

Warning Over “Industrialized” Cyber-Attacks After Ransomware Gang Partners With TeamPCP

Researchers warn that collaboration could lead to “unprecedented” ransomware attacks, as FBI also issues warning

Infosecurity Magazine
HIGHRansomware

Agentic AI Used to Conduct Ransomware Attack via Langflow

Attack demonstrates how LLM agents can combine known exploitation techniques with real-time reasoning to automate complex, multi-stage intrusions. The post Agentic AI Used to Conduct Ransomware Attack via Langflow appeared first on SecurityWeek .

SecurityWeek