Huntress Details CitrixBleed 2 Intrusions Leading to DragonForce Ransomware
Summary
Huntress describes six similar 2026 intrusions in which attackers exploited CitrixBleed 2 to hijack sessions, escalate privileges, and establish persistence; one intrusion ended with DragonForce ransomware encryption.
Key points
- Huntress investigated six similar intrusions at unrelated organizations between January and June 2026, attributing the activity with high confidence to an initial access broker or affiliate.
- Attackers sent malformed pre-authentication NetScaler login requests to exploit CVE-2025-5777, leaking appliance memory and enabling theft and replay of valid session tokens.
- In one case, logs showed a legitimate user’s authenticated session being used from an attacker IP without a successful attacker login, indicating session hijacking that bypassed the need to complete MFA.
- Attackers used a registry symlink and the AppMgmt service to run a privilege-escalation tool as SYSTEM, then created rogue local administrator accounts.
- Persistence commonly involved ScreenConnect or Zoho Assist; later activity included RDP, PsExec, Impacket, and Mimikatz.
- One intrusion reached DragonForce ransomware deployment, but rapid response limited encryption to a single host.
- Huntress recommends patching NetScaler, retaining and reviewing logs, terminating outstanding sessions, and checking for unauthorized accounts and remote-management tools.
Article Details
- Attack Vectors
- Exploitation of CVE-2025-5777 against exposed Citrix NetScaler Gateway or AAA virtual servers: malformed pre-authentication login POST requests with an empty login parameter caused memory disclosure, enabling theft and replay of valid session tokens.
- A portable local privilege-escalation tool abused a registry symbolic link and the Group Policy refresh/AppMgmt service chain to relaunch itself as SYSTEM.
- The operator created rogue local administrator accounts, then used remote-management software and RDP for persistence and follow-on access.
- The operator used PsExec and Impacket for remote execution and lateral movement, and Mimikatz to dump credentials.
- DragonForce ransomware was executed in the most progressed intrusion, encrypting one victim environment.
- Defensive Notes
- Patch Citrix NetScaler appliances to the latest software version and regularly review them for updates.
- Forward and retain NetScaler logs because appliance logs rotate quickly; investigate malformed login POST bursts, binary data in AAA LOGIN_FAILED User fields, and sessions without corresponding logins.
- Terminate outstanding sessions on appliances vulnerable to CVE-2025-5777, since harvested session tokens may remain usable after patching.
- Audit vulnerable Citrix environments for unexpected CtxAppVCOMService, ctxsvc, and test accounts, while recognizing that test may be legitimate in some environments.
- Audit for unexpected ScreenConnect and Zoho Assist installations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | opa[.]tlsd[.]shop | Netbird relay domain used by the operator. |
| DOMAIN | relay[.]dltsolutions[.]top | Attacker-controlled ScreenConnect relay infrastructure. |
| DOMAIN | relay[.]eurofin[.]digital | Attacker-controlled ScreenConnect relay infrastructure. |
| DOMAIN | vtps[.]us | Listed as a ScreenConnect relay used in the intrusions. |
| SHA256 | c4fcae3847946173bf0b3cedf5d97a9e3d18090023842f942ba544fa7fda180d | SHA-256 hash identified as DragonForce ransomware. |
| SHA256 | c84739655ce1af0a0269138263d47567418f69e0f75e249f8e23bc21802209e2 | SHA-256 hash identified as an LPE tool. |
| SHA256 | eb083365dc70d0294e8c4f55a2e78be0edb0f3497f2a06a70c9f474dafab48d8 | SHA-256 hash identified as an LPE tool. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe operator ran Mimikatz to dump credentials.T1021.001 · Remote Desktop ProtocolThe operator used the newly created administrator accounts to log in interactively over RDP.T1059.003 · Windows Command ShellThe operator used Windows command-shell commands, including commands to start AppMgmt and run gpupdate.T1068 · Exploitation for Privilege EscalationThe LPE tool used a registry symbolic link and AppMgmt/Group Policy execution chain to obtain SYSTEM privileges.T1105 · Ingress Tool TransferThe operator downloaded Atera and pulled the DragonForce ransomware binary into the victim environment.T1112 · Modify RegistryThe LPE tool planted a REG_LINK and modified protected registry configuration, then restored the original registry state.T1136.001 · Local AccountAfter elevating to SYSTEM, the operator created rogue local accounts and added them to the local Administrators group.T1190 · Exploit Public-Facing ApplicationThe operator exploited the pre-authentication CVE-2025-5777 flaw on exposed NetScaler appliances.T1219 · Remote Access ToolsThe operator installed ScreenConnect, Zoho Assist, or Netbird/Atera remote-management tooling for persistence and access.T1486 · Data Encrypted for ImpactDragonForce ransomware encrypted a victim environment in the most progressed incident.T1539 · Steal Web Session CookieMemory disclosure enabled theft and replay of an authenticated user's live session token.T1569.002 · Service ExecutionThe operator used PsExec against local hosts for remote execution and a SYSTEM shell.
CVE
CVE-2023-4966CVE-2025-5777, nicknamed "CitrixBleed 2" in the spirit of the original 2023 CitrixBleed (CVE-2023-4966) is a memory-overread in NetScaler ADC and Gateway when configured as a Gateway or AAA virtual server. The flaw isCVE-2025-5777The intrusions began with exploitation of CitrixBleed 2 (CVE-2025-5777), where malformed pre-auth login requests leaked NetScaler memory and enabled attackers to steal and replay valid session tokens, making MFACVE-2026-4368is a vulnerability in NetScaler session management whereby a time-of-check/time-of-use session mixup (CVE-2026-4368) can also produce a user accessing another user's sessions. It's a tempting fit, but it didn't hold
People
Threat Actors
Malware
Vendors
Products
AteraNetbird/AteraMicrosoft Defender Antimalware PlatformIn one case, Microsoft Defender successfully quarantined Impacket's remote execution payload and the registry dumping activity, buying Defenders valuable time.NetBirdNetbird/AteraNetScalerwith exploitation of CitrixBleed 2 (CVE-2025-5777), where malformed pre-auth login requests leaked NetScaler memory and enabled attackers to steal and replay valid session tokens, making MFA effectively irrelevantScreenConnectcreate rogue local admin accounts, and establish persistence with legitimate remote access tools like ScreenConnect and Zoho Assist.Zoho Assistadmin accounts, and establish persistence with legitimate remote access tools like ScreenConnect and Zoho Assist.