In July 2026 Huntress released a detailed threat report titled CitrixBleed 2 (CVE‑2025‑5777) 7 Steps to Dragonforce Ransomware. The study documents a highly repeatable attack chain that has been seen in at least six unrelated organizations across the United States. By dissecting the lifecycle from initial access through final ransomware deployment, Huntress provides security analysts with a clear playbook for detection and response.

The core of the operation begins with CVE‑2025‑5777 – a memory‐overread flaw in Citrix NetScaler gateways that allows an attacker to send malformed login requests. The vulnerability leaks small chunks of process memory, including active session tokens. Once a token is harvested, the adversary can replay it from any IP address, effectively bypassing MFA and hijacking a live user session.

After hijacking a legitimate session, the attackers follow a consistent seven‑step progression:

• 1️⃣ Initial Access: Exploit CitrixBleed 2 to steal a session token.
• 2️⃣ Privilege Escalation: Deploy a lightweight Windows LPE tool that uses REG_LINK symlinks under the RdpBus key, triggers gpupdate to run as SYSTEM, and re‑launches AppMgmt in privileged mode.
• 3️⃣ Backdoor Account Creation: The LPE powers a script that creates a local administrator account (e.g., ctxsvc) with a known password.
• 4️⃣ Persistence Establishment: Install legitimate remote‑access utilities such as ScreenConnect or Zoho Assist, configured to connect back to attacker‑controlled servers.
• 5️⃣ Lateral Movement & Reconnaissance: Use the new admin account to run PsExec, gather domain credentials with Mimikatz, and map network shares.
• 6️⃣ Ransomware Deployment: Drop and execute Dragonforce (1.exe) on a target host, encrypting files and demanding payment.
• 7️⃣ Cleanup & Exfiltration: Remove or hide artifacts, terminate active sessions, and exfiltrate any stolen data.

The investigators confirmed each step through log correlation. For example, they matched NetScaler ns.log entries that contained unprintable binary payloads with legitimate user login events in Windows Security logs, proving that the session token was indeed hijacked. They also reconstructed the LPE’s registry manipulation by capturing the temporary REG_LINK values and verifying the subsequent gpupdate triggers.

Key indicators of compromise (IoCs) are numerous and actionable:

• Unusual NetScaler login bursts from a single IP with empty login parameters.
• Log entries containing binary data in the User field of AAA LOGIN_FAILED events.
• Registry keys under {28d78fad-5a12-11d1-ae5b-0000f803a8c2} pointing to \Group Policy State\Machine\GPO‑List\test.
• Presence of ScreenConnect installers (us.msi, SC.msi) or Zoho Assist (za.msi).
• Backdoor admin accounts named ctxsvc, CtxAppVCOMService, or test.

Recommendations for defenders:

• Patch all Citrix NetScaler appliances to the latest firmware before the end of July 2026. The CVE‑2025‑5777 patch removes the memory‑overread vector entirely.
• Enable and centralize NetScaler log forwarding to a SIEM or SOAR platform with a retention period that exceeds one month; logs rotate frequently and can be lost quickly.
• Immediately terminate any active sessions on vulnerable devices, as session tokens may persist after patching.
• Audit for anomalous local administrator accounts (ctxsvc, CtxAppVCOMService, test) and remove them if not legitimate.
• Scan all endpoints for installed ScreenConnect or Zoho Assist clients. Verify that their configuration files (relay host/port, instance ID) match known good patterns; otherwise uninstall.
• Implement endpoint detection that watches for the LPE tool’s execution path and the specific gpupdate /force command chain.
• Deploy network segmentation so that remote‑access tools do not have unrestricted access to critical servers.

The report underscores the need for a layered defensive strategy: patching, vigilant log monitoring, rapid session invalidation, and strict control over legitimate remote‑access utilities. By understanding the seven‑step playbook, security teams can intercept intrusions early, prevent ransomware deployment, and reduce overall impact.

“,”excerpt”:”A detailed Huntress threat report reveals a repeatable 7‑step attack chain exploiting Citrix NetScaler’s CVE‑2025‑5777 to deliver Dragonforce ransomware. The article outlines the lifecycle, indicators, and actionable mitigation steps for security analysts.”,”status”:”publish