Product
Cisco AnyConnect
- First Reported
- Jun 24, 2026
- Latest Reported
- Jul 2, 2026
Reported Context (4)
- “In addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania,” Arctic Wolf explained. Reports Detail Anubis Citrix Bleed 2 Exploitation, The Gentlemen BYOVD and VECT-TeamPCP Alliance
- In addition to CitrixBleed 2 exploitation, valid Cisco AnyConnect VPN logins were observed from several hosting ASNs, including AS20473 — The Constant Company and AS55286 — ServerMania. Arctic Wolf details Anubis affiliates’ use of CitrixBleed 2 and legitimate RMM tools
- executables masquerading as legitimate software installers or applications like Google Update and Cisco AnyConnect, and executing the malware loader once the installation process completes. StrikeShark Campaign Uses SharkLoader to Deploy Cobalt Strike Beacon
- benign (‘masquerading as legitimate software installers or applications such as Google Update and Cisco AnyConnect’ / ‘used security product vendor names as the directory names’). StrikeShark Campaign Uses SharkLoader to Deploy Cobalt Strike
CVE (5)
Malware (5)
People (2)
Threat Actors (5)
MITRE ATT&CK (36)
Vendors (11)
Products (20)
Tools (23)
Industries (9)
Countries (14)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.