Reports Detail Anubis Citrix Bleed 2 Exploitation, The Gentlemen BYOVD and VECT-TeamPCP Alliance
Summary
Reports describe Anubis affiliates exploiting Citrix CVE-2025-5777 and using VPN credentials, The Gentlemen’s Go backdoor and BYOVD activity, and VECT-TeamPCP’s supply-chain-to-ransomware partnership.
Key points
- Arctic Wolf observed Anubis-linked intrusions using Citrix Bleed 2 (CVE-2025-5777) and valid Cisco AnyConnect VPN logins; the source of the credentials is unknown.
- Reported Anubis activity included RDP, SMB and PsExec for lateral movement, legitimate RMM tools for access, and cloud-transfer tools for data exfiltration.
- The intrusions also involved disabling security protections and clearing or manipulating logs; in at least one case, the Anubis encryptor was deleted after execution.
- Kaspersky described The Gentlemen’s Go backdoor as collecting system information, sending it over TCP, and supporting remote command execution and SOCKS proxying.
- Expel reported The Gentlemen used the vulnerable Kontron driver ktapi.sys for BYOVD, seeking kernel-level access and the ability to terminate security processes; how the group obtained the driver or learned of its vulnerability remains unclear.
- Sophos reported that VECT and TeamPCP partnered to combine supply-chain credential theft associated with Trivy and LiteLLM compromises with ransomware deployment.
- Check Point and JUMPSEC found that VECT could destroy files larger than 128 KB; TeamPCP claimed it had not used VECT’s encryptor in attacks.
Article Details
- Attack Vectors
- Anubis affiliates were observed exploiting CVE-2025-5777 (Citrix Bleed 2) for initial access to Citrix NetScaler ADC and Gateway appliances.
- Intrusions used valid VPN credentials, including Cisco AnyConnect logins; the source of those credentials was unknown.
- RDP, SMB, and PsExec were used for lateral movement, followed by deployment of legitimate RMM tools.
- The Gentlemen used a Go backdoor for remote command execution and SOCKS proxying, and a vulnerable Kontron driver in BYOVD activity to obtain kernel-level access and disable security processes.
- Sophos reported that the VECT and TeamPCP partnership combined credentials stolen in Trivy and LiteLLM supply-chain attacks with ransomware deployment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 81[.]177[.]215[.]15 | External server used by The Gentlemen's Go backdoor for system-information exfiltration over a bidirectional TCP connection. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolRDP activity was observed during lateral movement in Anubis intrusions.T1021.002 · SMB/Windows Admin SharesSMB activity was observed after malicious VPN authentication in Anubis intrusions.T1041 · Exfiltration Over C2 ChannelThe Gentlemen's backdoor exfiltrated collected system information to an external server over a bidirectional TCP connection.T1059.003 · Windows Command ShellThe Gentlemen's backdoor executed operator responses on the host using cmd.exe.T1068 · Exploitation for Privilege EscalationThe Gentlemen used a vulnerable Kontron driver in BYOVD activity to obtain kernel-level access.T1070.001 · Clear Windows Event LogsThe intrusions included clearing or manipulating logs across multiple systems.T1070.004 · File DeletionIn at least one Anubis intrusion, the encryptor was deleted after execution.T1078 · Valid AccountsIntrusions used valid VPN credentials, including Cisco AnyConnect logins.T1082 · System Information DiscoveryThe Gentlemen's Go backdoor was designed to collect system information.T1090 · ProxyThe Gentlemen's backdoor could establish a SOCKS proxy connection.T1190 · Exploit Public-Facing ApplicationAnubis affiliates exploited CVE-2025-5777 on Citrix NetScaler ADC and Gateway appliances for initial access.T1219 · Remote Access ToolsAnubis affiliates abused ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment for remote access and control.T1562.001 · Disable or Modify ToolsThe reported activity included disabling Windows Defender real-time protection and using a vulnerable driver to kill protected security processes.T1569.002 · Service ExecutionPsExec was used for service creation and lateral movement.
CVE
People
Threat Actors
AnubisAnubis ransomware affiliates were observed exploiting Citrix Bleed 2, using valid VPN credentials and RMM tools, and deploying ransomware.TeamPCPSophos reported that TeamPCP partnered with VECT to combine supply-chain credential theft with ransomware deployment. TeamPCP claimed ownership of CipherForce, which it had previously operated as a ransomware brand.The GentlemenThe RaaS group was reported to use a Go backdoor and BYOVD activity in intrusions.VectSophos reported that VECT partnered with TeamPCP to deploy ransomware in organizations compromised in Trivy and LiteLLM supply-chain attacks.
Malware
Anubis ransomwareThreat actors linked to the Anubis ransomware operation are exploiting CVE-2025-5777 (Citrix Bleed 2) and stolen VPN credentials to gain access, then using legitimate RMM tools and living-off-the-land tactics to moveVECTThe report also details The Gentlemen’s use of a Go backdoor and BYOVD techniques, plus the VECT and TeamPCP partnership that combines supply-chain credential theft with ransomware attacks.
Vendors
Cisco“In addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania,” Arctic Wolf explained.CitrixThreat actors linked to the Anubis ransomware operation are exploiting CVE-2025-5777 (Citrix Bleed 2) and stolen VPN credentials to gain access, then using legitimate RMM tools and living-off-the-land tactics to moveESETbypass Windows security protections, and kill protected security processes associated with Microsoft, ESET, Palo Alto Networks, and SentinelOne.KontronThe driver in question is ktapi.sys, which is part of an API developed by Kontron.Microsoftaccess, bypass Windows security protections, and kill protected security processes associated with Microsoft, ESET, Palo Alto Networks, and SentinelOne.Palo Alto Networkssecurity protections, and kill protected security processes associated with Microsoft, ESET, Palo Alto Networks, and SentinelOne.SentinelOneand kill protected security processes associated with Microsoft, ESET, Palo Alto Networks, and SentinelOne.
Products
Cisco AnyConnect“In addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania,” Arctic Wolf explained.NetScaler ADCcredential use and the exploitation of CVE-2025-5777 (CVSS score: 9.3), a critical flaw impacting Citrix NetScaler ADC and Gateway that could be abused by an attacker to bypass authentication when the appliance isWindows Defender“These techniques included Windows Defender real-time protection disablement, SophosUninstall activity, PCHunter-related artifacts, and log clearing or manipulation across multiple systems,” the cybersecurity company
Tools
Cloudflared#AnubisMeshAgent#AnubisPsExecStolen VPN credentials, RDP, SMB, and PsExec are used for lateral movement and credential access.PuTTYaccess to the compromised environment, after which tools like S3 Browser, rclone, s5cmd, WinSCP, and PuTTY are installed for data transfer or exfiltration prior to ransomware deployment.RCloneto facilitate deeper access to the compromised environment, after which tools like S3 Browser, rclone, s5cmd, WinSCP, and PuTTY are installed for data transfer or exfiltration prior to ransomware deployment.Remotely#AnubisS3 Browsercredentials to facilitate deeper access to the compromised environment, after which tools like S3 Browser, rclone, s5cmd, WinSCP, and PuTTY are installed for data transfer or exfiltration prior to ransomwares5cmdto facilitate deeper access to the compromised environment, after which tools like S3 Browser, rclone, s5cmd, WinSCP, and PuTTY are installed for data transfer or exfiltration prior to ransomware deployment.ScreenConnect#AnubisTotal Software Deploymentadministration tools, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, to blend in with normal IT activity while maintaining control of victim systems.”UltraVNC#AnubisWinSCPdeeper access to the compromised environment, after which tools like S3 Browser, rclone, s5cmd, WinSCP, and PuTTY are installed for data transfer or exfiltration prior to ransomware deployment.Zoho Assistrepeatedly abused legitimate remote access and administration tools, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, to blend in with normal IT activity
Countries
AustraliaMore than 50% of the victims are located in the U.S., followed by the U.K., Australia, France, and Canada.CanadaMore than 50% of the victims are located in the U.S., followed by the U.K., Australia, France, and Canada.FranceMore than 50% of the victims are located in the U.S., followed by the U.K., Australia, France, and Canada.United KingdomMore than 50% of the victims are located in the U.S., followed by the U.K., Australia, France, and Canada.United StatesMore than 50% of the victims are located in the U.S., followed by the U.K., Australia, France, and Canada.
Industries
business servicesSome of the prominent sectors targeted include healthcare, business services, manufacturing, technology, and financial services.Financial ServicesSome of the prominent sectors targeted include healthcare, business services, manufacturing, technology, and financial services.HealthcareSome of the prominent sectors targeted include healthcare, business services, manufacturing, technology, and financial services.ManufacturingSome of the prominent sectors targeted include healthcare, business services, manufacturing, technology, and financial services.TechnologySome of the prominent sectors targeted include healthcare, business services, manufacturing, technology, and financial services.