Skip to content

Back to the catalog

CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
huntress.comwriteup

CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress

Huntress's Tactical Response team documents a repeatable intrusion cluster (tracked by Sophos as STAC3725) where an initial access broker exploits CVE-2025-5777 "CitrixBleed 2," a pre-auth memory overread in NetScaler ADC/Gateway login endpoints, to leak process heap and hijack valid Citrix session tokens even past MFA. The writeup walks through forensic proof of the session hijack, a portable local privilege escalation tool that plants a REG_LINK SymbolicLinkValue under the RdpBus device class to hijack the Group Policy state hierarchy and relaunch as SYSTEM via the AppMgmt service, followed by backdoor admin creation, ScreenConnect/Zoho Assist/Atera persistence, Impacket and Mimikatz for lateral movement/credential theft, and eventual DragonForce ransomware deployment. Includes concrete IOCs, log-based detection guidance, and hardening recommendations for NetScaler operators.

TL;DR Huntress DFIR breakdown of an IAB cluster exploiting CitrixBleed 2 (CVE-2025-5777) for session hijacking, a registry-symlink SYSTEM privilege escalation via AppMgmt, and eventual DragonForce ransomware deployment.
Open original ↗
Document

What it is

Huntress's writeup of the "Citrix NetScaler cluster" — a half-dozen intrusions (Jan–June 2026) chaining CVE-2025-5777 (CitrixBleed 2) on internet-facing NetScaler gateways to DragonForce ransomware, tracked by Sophos as STAC3725. The value the summary can't carry is the forensic detail distinguishing exploitation from a brute-force attack, plus attribution nuance.

How it works

On one appliance, ns.log held 5937 AAA LOGIN_FAILED events from the operator's IPs inside a single ~5-hour window, each with an unprintable User value. This reads as password-spraying but is not: stitching the username values together reveals leaked heap memory — HTTP headers, internal IP addresses, login flags — bled out of the vulnerable appliance. The page is explicit that this misreading "matters enormously for response," though it stops short (text is truncated) of stating the corrected response steps or the full seven-beat killchain.

What to do

No patch versions or commands are given in the available text. The actionable takeaway is a detection/triage correction: do not classify a torrent of LOGIN_FAILED events with binary-noise usernames as brute-force. Parse the User values — if they reconstruct into HTTP headers, internal IPs, or login flags, you are seeing CVE-2025-5777 memory disclosure, and the response is patch/session-invalidation rather than credential lockout.

Caveats

  • Attribution is unsettled. Huntress confirms DragonForce encryption in only one case; they cannot say the pattern is a DragonForce affiliate versus a generic IAB, and coordination with Sophos and vendor bulletins has introduced ambiguity about which ransomware actor the cluster maps to. Their leading assessment is a "common and highly successful IAB."
  • Not every victim saw all seven beats — some were isolated at beat four or five.
  • Unlike other reporting, Huntress did not observe QEMU tooling for exploitation, attributed to rapid detection or an accelerated adversary playbook.
  • The fetched page is truncated mid-sentence at the CVE explanation; the killchain steps live in figures not captured here.

Organisations named here

  • CitrixBleed 2

CVEs named here

  • CVE-2025-5777
  • CVE-2023-4966
  • CVE-2026-4368

Technologies named here

  • ScreenConnect
  • Citrix NetScaler ADC and Gateway
  • Zoho Assist
  • Netbird
  • Atera
  • PsExec
  • Impacket
  • RemCom
  • Mimikatz
  • Unnamed LPE tool
  • Huntress Tactical Response / SOC
  • Citrix NetScaler
  • Sophos

Techniques named here

  • Pre-auth memory disclosure / session hijacking
  • Registry symbolic link privilege escalation
  • Service abuse for privilege escalation
  • Anti-forensic registry cleanup
  • Backdoor account creation
  • Host/client fingerprinting via Citrix printer auto-mapping
  • Living-off-the-land remote access tooling
  • Lateral movement via PsExec/Impacket
  • Credential Dumping
  • Host and session reconnaissance
  • Ransomware deployment

Threat actors named here

  • DragonForce
  • STAC3725
  • Unnamed Initial Access Broker / ransomware affiliate

Related in Threat Intel