Arctic Wolf details Anubis affiliates’ use of CitrixBleed 2 and legitimate RMM tools
Summary
Arctic Wolf’s review of multiple Anubis intrusions found initial access via valid VPN credentials or CitrixBleed 2 (CVE-2025-5777), followed by RMM abuse, credential access and pre-encryption exfiltration activity. Logs did not confirm a usable Cloudflare Tunnel.
Key points
- Arctic Wolf observed Anubis intrusions beginning with valid VPN credentials or exploitation of CitrixBleed 2 (CVE-2025-5777); the source of the VPN credentials was not established.
- Threat actors used RDP, SMB and PsExec for lateral movement, including access to domain controllers, hypervisors, backup systems and file infrastructure.
- Affiliates deployed legitimate RMM tools, including ScreenConnect, Zoho Assist and MeshAgent, for interactive access and persistence while blending in with normal administration.
- Investigators observed credential-access activity involving Mimikatz, browser password-export artifacts and access to the Active Directory ntds.dit database.
- rclone, s5cmd and other transfer tools appeared in pre-encryption activity. In one NAS intrusion, cloudflared and SSH tunneling attempts were observed, but logs did not confirm a usable Cloudflare Tunnel.
- Defense evasion included endpoint protection tampering and clearing or manipulating Windows event logs; Anubis encryptors were observed on Windows and Linux systems.
- Arctic Wolf recommends patching CVE-2025-5777, restricting unauthorized RMM installations, monitoring for security-tool tampering, and isolating and testing backups.
Article Details
- Attack Vectors
- Initial access included valid VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777); the source of the observed VPN credentials could not be established.
- RDP and SMB activity, including PsExec service creation, supported lateral movement between victim systems.
- Affiliates deployed legitimate RMM tools, including ScreenConnect, Zoho Assist, and MeshAgent, for persistent interactive access, file transfer, and remote execution.
- Some intrusions used cloudflared tunnels, an authenticated HTTP proxy, or SSH-based SOCKS forwarding to establish outbound access paths; the report does not confirm that a usable Cloudflare Tunnel was established.
- Credential access included Mimikatz, browser password exports, and access to the Active Directory ntds.dit database.
- Exfiltration-related activity included cloud-transfer utilities such as rclone and s5cmd, alongside other pre-encryption activity.
- Intrusions included security-tool tampering and log clearing before Anubis ransomware encryption.
- Defensive Notes
- Patch CVE-2025-5777 on Citrix NetScaler ADC/Gateway and follow vendor instructions to terminate active sessions after patching.
- Audit and restrict RMM installations; alert on unauthorized tools and clusters of new RMM deployments.
- Block the reported malicious infrastructure, including azuremicrosoft[.]us and promotds[.]us.
- Enable tamper protection and monitor for endpoint-protection disablement or removal, PCHunter artifacts, and Windows event-log clearing.
- Alert on suspicious execution from staging locations such as C:\Apps, C:\PerfLogs, user profile directories, and C:\Users\Public.
- Maintain isolated offline backups with tested restoration procedures, and segment Hyper-V, NAS, and backup infrastructure from general-purpose endpoints.
- Correlate suspicious remote access with unusual RDP or SMB movement, RMM deployment, credential access, security-control tampering, and exfiltration tooling to detect activity before encryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | azuremicrosoft[.]us | Typosquatted domain used to deliver a ScreenConnect installer and identified as malicious infrastructure to block. |
| DOMAIN | relay[.]promotds[.]us | ScreenConnect relay infrastructure that communicated with an abused RMM deployment; promotds[.]us is also identified among domains to block. |
| IPV4 | 45[.]227[.]254[.]25 | Observed as the source IP in a Citrix VPN log associated with the reported activity; Arctic Wolf describes the activity as suspicious but cautions that the IP discrepancy alone does not establish maliciousness. |
| IPV4 | 45[.]76[.]79[.]92 | C2 communications associated with a Remotely Desktop installation on compromised Windows Server hosts. |
| URL | hxxps[:]//azuremicrosoft[.]us/Bin/ScreenConnect[.]ClientSetup.msi | Specific ScreenConnect installer download URL on the typosquatted domain, reported in an intrusion and identified as malicious. |
MITRE ATT&CK
T1003.003 · NTDSAn actor accessed and copied the Active Directory ntds.dit database, then saved an archive named Active Directory.zip.T1021.001 · Remote Desktop ProtocolRDP was used for hands-on-keyboard lateral movement, including connections from VPN client ranges and jump hosts to servers.T1021.002 · SMB/Windows Admin SharesThe intrusions included SMB movement and logon activity alongside PsExec service creation.T1053.005 · Scheduled TaskMeshAgent persistence on one system was reinforced with a scheduled task named MeshUserTask.T1070.001 · Clear Windows Event LogsActors cleared or manipulated Windows event logs, including System, PowerShell, Task Scheduler, AppLocker, and Defender logs.T1078 · Valid AccountsAffiliates used valid VPN credentials to access victim environments.T1090 · ProxyThe actor tested an authenticated HTTP proxy and configured SSH dynamic forwarding to route outbound traffic from a NAS through external infrastructure.T1136.001 · Local AccountOn a Synology NAS, the actor created a dedicated local administrator account and granted it broad service and file-access privileges.T1190 · Exploit Public-Facing ApplicationInitial access included exploitation of the pre-authentication CitrixBleed 2 vulnerability, CVE-2025-5777, on NetScaler appliances.T1219 · Remote Access ToolsAffiliates deployed legitimate RMM software, including ScreenConnect, Zoho Assist, and MeshAgent, for interactive access and persistence.T1486 · Data Encrypted for ImpactAnubis encryptors ran against Windows and Linux assets, producing encrypted files with the .anubis extension.T1555.003 · Credentials from Web BrowsersChrome Passwords.csv and Microsoft Edge Passwords.csv artifacts were consistent with manual exports of saved browser passwords.T1562.001 · Disable or Modify ToolsIntrusions included disabling Windows Defender real-time protection and attempting to uninstall or tamper with security tooling.T1567.002 · Exfiltration to Cloud StorageThe report describes cloud-transfer tooling, including rclone and s5cmd, in pre-encryption exfiltration activity.T1569.002 · Service ExecutionPsExec activity created the PSEXESVC.exe service during lateral movement in multiple intrusions.T1572 · Protocol TunnelingActors attempted to establish Cloudflare Tunnel access with cloudflared and used SSH-based forwarding; the report does not confirm a usable Cloudflare Tunnel.
CVE
Threat Actors
Malware
Vendors
Arctic WolfArctic Wolf found that Anubis ransomware affiliates used valid VPN credentials and exploited CitrixBleed 2 (CVE-2025-5777) to gain initial access, then relied on legitimate RMM tools, RDP, PsExec, and tunnelingCiscoIn addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania.Citrixthreat actors often used RDP between VPN client subnets and servers hosting Remote Desktop Services, Citrix-related services, file servers, domain controllers, hypervisors, and backup infrastructure.Cloudflarecloudflared is the Cloudflare Tunnel client and can be used to create outbound tunnels from an internal host to Cloudflare-managed infrastructure.MicrosoftMultiple intrusions showed threat actors targeting high-value infrastructure such as Microsoft Remote Desktop Services servers, domain controllers, hypervisors, backup-adjacent systems, and Network-Attached StorageSynologyWindows cloudflared.exe binary artifacts were found in the C:Windows directory, while the /usr/local/etc/cloudflared directory was used on Synology NAS devices.ZohoLegitimate RMM tools like ScreenConnect, Zoho Assist, and MeshAgent were abused for persistence.
Products
Cisco AnyConnectIn addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania.Citrix NetScaler ADC/GatewayOrganizations running Citrix NetScaler ADC/Gateway should confirm patching status against CVE-2025-5777 (CVSS 4.0: 9.3, CISA KEV).Cloudflare Tunnelcloudflared is the Cloudflare Tunnel client and can be used to create outbound tunnels from an internal host to Cloudflare-managed infrastructure.MeshAgent#AnubisMicrosoft Defender Antimalware PlatformMicrosoft Defender detections included Ransom:Win64/Anubis.A.Microsoft Hyper-VIn some instances, Hyper-V servers served as a jump point for threat actors over the course of several days.mRemoteNGThese solutions included ScreenConnect, Zoho Assist, MeshAgent, Remotely, Total Software Deployment, UltraVNC, and mRemoteNG.Remotely DesktopRemotely Desktop was installed on multiple Windows Server hosts and appeared as Remotely_Desktop.dll, with associated C2 communications to 45.76.79[.]92.ScreenConnect#AnubisTotal Software Deploymentadministration tools, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, to blend in with normal IT activity while maintaining control of victim systems.UltraVNCremote access and administration tools, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, to blend in with normal IT activity while maintaining control of victimZoho AssistLegitimate RMM tools like ScreenConnect, Zoho Assist, and MeshAgent were abused for persistence.
Tools
Cloudflared#AnubisMimikatzMimikatz use on Windows servers was commonly observed between multiple intrusions, and was typically staged in locations such as C:UsersPublicVideosmimikatz.exe, C:UsersPublicmimikatz.exe, and C:x64mimikatz.exe.PCHunterThese techniques included Windows Defender real-time protection disablement, SophosUninstall activity, PCHunter-related artifacts, and log clearing or manipulation across multiple systems.PsExecexploited CitrixBleed 2 (CVE-2025-5777) to gain initial access, then relied on legitimate RMM tools, RDP, PsExec, and tunneling utilities to move through victim networks and maintain persistence.PuTTYSeveral intrusions included deployment of tooling commonly used for data transfer or exfiltration, including S3 Browser, rclone, s5cmd, WinSCP, and PuTTY.RCloneExfiltration and tunneling tools such as cloudflared, rclone, and s5cmd supported pre-encryption activity.S3 BrowserScreenConnect artifacts appeared alongside PsExec service creation, Anubis encryptor staging under C:UsersDefaultAppData, and S3 Browser components under the same user profile.s5cmdExfiltration and tunneling tools such as cloudflared, rclone, and s5cmd supported pre-encryption activity.WinSCPSeveral intrusions included deployment of tooling commonly used for data transfer or exfiltration, including S3 Browser, rclone, s5cmd, WinSCP, and PuTTY.