The Anubis Ransomware group has significantly shifted its TTP to include the exploitation of a critical vulnerability in Citrix infrastructure. According to The Hacker News, these threat actors are prioritizing CVE-2025-5777, commonly referred to as “Citrix Bleed 2,” to bypass standard authentication mechanisms. By hijacking active sessions, attackers gain a foothold within the corporate perimeter without the need for traditional Phishing or brute-force methods.
The technical execution involves sending specially crafted requests to the Citrix NetScaler ADC or Gateway devices. This leads to the disclosure of sensitive session tokens stored in memory. Once these tokens are exfiltrated, the Anubis affiliates can impersonate legitimate users, effectively achieving Privilege Escalation if the hijacked session belongs to an administrative account. This specific CVE has become a primary target because many organizations have been slow to apply the latest Citrix NetScaler ADC security patches.
Analyzing the CVE-2025-5777 Attack Vector
The CVSS score for this vulnerability reflects its high impact on confidentiality and availability. Unlike standard RCE vulnerabilities that provide direct shell access, Citrix Bleed 2 focuses on session persistence. Once the initial access is established, the Anubis group employs a “hands-on-keyboard” approach to navigate the environment. A significant portion of their tradecraft involves the use of legitimate Remote Management and Monitoring (RMM) tools. By leveraging these tools, they often evade detection by traditional EDR solutions, as the software itself is signed and trusted by the operating system.
Furthermore, the campaign utilizes a technique known as “Bring Your Own Vulnerable Driver” (BYOVD). This allows the attackers to disable security agents by loading a legitimate but vulnerable kernel-mode driver, which is then exploited to terminate protection processes. This level of sophistication demonstrates a matured MITRE ATT&CK framework alignment, specifically focusing on Defense Evasion and Lateral Movement.
How to Detect CVE-2025-5777 Exploit
Detecting the exploitation of Citrix Bleed 2 requires a combination of network-level inspection and log analysis. SOC teams should monitor for unusual spikes in outbound traffic from Citrix appliances, specifically looking for large HTTP responses that might indicate memory dumping. Additionally, correlating login events is essential; if a session token is used from a geographically disparate IP address within a short timeframe, it is a high-fidelity IoC.
Defenders should also implement advanced monitoring within their SIEM to flag the installation of unauthorized RMM tools such as AnyDesk, ScreenConnect, or Atera. The presence of these tools, combined with the loading of non-standard drivers (potential BYOVD indicators), should trigger an immediate incident response workflow.
Remediation and Defensive Recommendations
To defend against this evolving threat, organizations must adopt a Zero Trust architecture that minimizes the impact of a compromised session. The primary recommendation is the immediate application of firmware updates to all Citrix NetScaler ADC and Gateway instances. Beyond patching, it is essential to terminate all active sessions post-patching to invalidate any potentially stolen tokens.
Anubis Ransomware Mitigation Steps
In addition to infrastructure updates, security teams should implement the following controls:
- Implement hardware-bound multi-factor authentication (MFA) where possible, which reduces the utility of stolen session cookies.
- Audit all service accounts and supply chain credentials for unusual activity or unauthorized Lateral Movement.
- Restrict the execution of known vulnerable drivers using Windows Defender Application Control (WDAC) or similar EDR policies to prevent BYOVD attacks.
- Monitor for a Supply Chain Attack profile by auditing third-party access and RMM tool usage patterns.
By focusing on these proactive measures, organizations can significantly harden their infrastructure against the credential theft techniques currently favored by the Anubis operation.
Related: VENOMOUS#HELPER Phishing Campaign Exploits SimpleHelp and ScreenConnect, Bypassing Hardware Gates: Exploitability of Vulnerable Drivers