15 mincritical
Seven Steps to Ransomware: CitrixBleed 2 Weaponized by Initial Access Brokers
An Initial Access Broker is exploiting CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory overread in Citrix NetScaler ADC/Gateway, to steal session tokens and bypass MFA. The stolen sessions are used to access Citrix published desktops, followed by a consistent privilege escalation via a registry symbolic-link LPE tool that abuses the Windows AppMgmt service and Group Policy refresh to gain SYSTEM. The operator then creates backdoor admin accounts, installs rogue ScreenConnect/Zoho Assist RMM clients, moves laterally with PsExec and Impacket, and ultimately deploys DragonForce ransomware. The full kill chain from initial access to encryption was observed completing in under one hour in at least one case.
Sens:■ Immediate
Showing defanged values
- domainopa[.]tlsd[.]shopNetbird relay endpoint configured in rogue Netbird client for persistent VPN tunnel back to attacker infrastructure.
- domainrelay[.]dltsolutions[.]topScreenConnect relay host used by attacker for rogue RMM client callback; instance ID 9963f404a99f0fc4 baked into client configuration.
- domainrelay[.]eurofin[.]digitalScreenConnect relay host used by attacker for rogue RMM client callback on port 8041; instance ID aee74a66ea5bb239.
- domainvpts[.]usScreenConnect relay host identified in attacker RMM configuration; also observed as vtps.us in image artifacts.
- domainvtps[.]usVariant spelling of ScreenConnect relay host observed in image artifacts; likely same as vpts.us.
- ip178[.]16[.]55[.]7Attacker source IP observed in Citrix ns.log generating AAA LOGIN_FAILED events with leaked heap memory in the User field, consistent with CitrixBleed 2 exploitation.
- md58903a3381fbb033a45f5c2c50c175c54MD5 hash of eng.exe LPE dropper from incident image artifacts.
- registry_keyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GroupPolicy\State\Machine\GPO-List\test\testRegistry path targeted by the LPE tool's symbolic-link redirect; the exploit plants a REG_LINK under the RdpBus device class GUID pointing here to hijack SYSTEM-context Group Policy writes.
- sha1bc2820b5ee7b43c172005b66546f12316de8c081SHA1 hash of eng.exe LPE dropper from incident image artifacts.
- sha256c4fcae3847946173bf0b3cedf5d97a9e3d18090023842f942ba544fa7fda180dSHA256 hash of the DragonForce ransomware binary (1.exe) deployed in the final impact stage.
- sha256c84739655ce1af0a0269138263d47567418f69e0f75e249f8e23bc21802209e2SHA256 hash of the portable LPE tool dropped by the adversary to escalate from unprivileged Citrix session user to SYSTEM via registry symbolic-link abuse.
- sha256eb083365dc70d0294e8c4f55a2e78be0edb0f3497f2a06a70c9f474dafab48d8SHA256 hash of a second variant of the LPE tool used in the privilege escalation stage.
- sha256f7c237a49b96fd77c047910e13f24aac4678a0f94babdb06643dba63f38d48e5SHA256 hash of eng.exe, a specific instance of the LPE dropper recovered from an incident; MD5: 8903a3381fbb033a45f5c2c50c175c54, SHA1: bc2820b5ee7b43c172005b66546f12316de8c081.
Detection / Hunteropenrouter
What Happened
A group of hackers is breaking into organizations through a security flaw in Citrix NetScaler, a popular remote-access gateway. The flaw, called CitrixBleed 2, lets attackers steal active login sessions from the gateway's memory without needing a password or second-factor code. Once inside, the hackers use a custom tool to gain full administrator control of the system, create hidden backdoor accounts, and install remote-management software so they can return at will. In the most severe cases observed, they deployed DragonForce ransomware to encrypt files across the organization. Any organization using Citrix NetScaler should patch immediately, terminate all active sessions, and check for unauthorized accounts or remote-access software. The full attack can happen in under an hour.
Key Takeaways
- An Initial Access Broker (IAB) is weaponizing CVE-2025-5777 (CitrixBleed 2), a pre-auth memory overread in Citrix NetScaler ADC/Gateway, to steal session tokens and bypass MFA.
- The IAB uses a consistent 7-step playbook: exploit CitrixBleed 2, hijack session, escalate privileges via a registry symbolic-link LPE abusing the AppMgmt service, create backdoor admin accounts, install rogue RMM tools, move laterally, and deploy DragonForce ransomware.
- A portable LPE tool is dropped as a renamed executable (eng.exe, legal.exe, etc.) and exploits REG_LINK SymbolicLinkValue under the RdpBus device class GUID to redirect SYSTEM-context Group Policy writes into protected registry keys.
- Rogue ScreenConnect and Zoho Assist installations are used for persistent remote access, with relay infrastructure and instance IDs reused across multiple unrelated victims.
- Citrix auto-created printer mappings leak the adversary's workstation hostname (WIN-4EOAP4JTJR9, WIN-VI960VQI4I6) in Windows Application event logs, providing a reliable clustering and detection pivot.
Affected Systems
- Citrix NetScaler ADC (configured as Gateway or AAA virtual server)
- Citrix NetScaler Gateway
- Windows endpoints hosting Citrix published desktops
- Windows domain controllers (lateral movement targets)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-5777 | Citrix NetScaler ADC and Gateway (Gateway or AAA virtual server) | Critical | Pre-authentication memory overread triggered by empty login variable in POST to /p/u/doAuthentication.do, leaking ~127 bytes of heap memory per request including valid session tokens. |
| CVE-2026-4368 | Citrix NetScaler (session management) | Time-of-check/time-of-use session mixup that can allow one user to access another's session; investigated but ruled out for this cluster based on appliance build range and lack of authenticated attacker sessions. |
Attack Chain
- Initial Access: CVE-2025-5777 (CitrixBleed 2) exploited by sending empty login variable POSTs to /p/u/doAuthentication.do, leaking ~127 bytes of heap memory per request including valid session tokens
- Session Hijack: Stolen session token replayed from attacker IP to access Citrix published desktop; MFA already satisfied by legitimate user's prior authentication
- Privilege Escalation: Portable LPE tool dropped to C:\temp or similar, creates REG_LINK SymbolicLinkValue under RdpBus device class GUID targeting GPO-List\test, triggers gpupdate /force then sc start AppMgmt to relaunch dropper as SYSTEM
- Persistence: Backdoor admin accounts created (ctxsvc, CtxAppVCOMService, test) via net user /add and net localgroup Administrators /add; rogue ScreenConnect and/or Zoho Assist MSI installers deployed
- Lateral Movement: Operator uses RDP, PsExec -s, and Impacket tooling against domain controllers; Mimikatz run from anomalous directories for credential dumping
- Impact: DragonForce ransomware binary (1.exe) pulled and executed, resulting in environment encryption
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Citrix NetScaler hunting guidance (external article referenced)
The article does not include reproducible detection rules but references a Citrix-published article on hunting for CitrixBleed 2 compromise signs in ns.log. Detection guidance is described narratively: look for AAA LOGIN_FAILED events with binary data in the User field, sessions active from IPs with no corresponding authentication, and Citrix printer auto-creation events leaking adversary hostnames.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR will capture process creation (sc.exe start AppMgmt, gpupdate, net.exe user creation, Mimikatz execution from anomalous paths) and MSI installations. However, the initial CitrixBleed 2 exploitation occurs on the NetScaler appliance itself, which typically lacks EDR coverage. The LPE tool's registry cleanup also reduces forensic artifacts on the endpoint. |
| Network Visibility | Low | The initial exploitation and session hijack occur on the NetScaler gateway, which may not forward detailed logs to network monitoring. ScreenConnect and Zoho Assist traffic uses legitimate protocols (HTTPS) to attacker-controlled relay domains, blending with normal RMM traffic. Netbird VPN traffic to opa.tlsd.shop would require DNS logging or TLS metadata analysis to detect. |
| Detection Difficulty | Hard | The initial access vector exploits a memory disclosure on the NetScaler appliance, which many organizations do not log centrally. Session hijack appears as a legitimate authenticated session. The LPE tool cleans up its registry modifications post-exploitation. Rogue RMM tools (ScreenConnect, Zoho Assist) are legitimate software, making allow-listing and detection difficult. Multiple stages use living-off-the-land binaries (sc.exe, gpupdate, net.exe, PsExec). |
Required Log Sources
- Citrix NetScaler ns.log (AAA authentication events)
- Windows Security Event Log (Event ID 4624, 4720, 4732)
- Windows Application Event Log (MetaFrameEvents provider for printer auto-creation)
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Windows Sysmon Event ID 1 (Process Creation), Event ID 3 (Network Connection), Event ID 13 (Registry Value Set), Event ID 7 (Image Loaded)
- Windows Service Control Manager events (Event ID 7045 for new services, 7036 for service state changes)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for sessions on Citrix gateways where the source IP changes mid-session without a corresponding new authentication event, which would indicate session token theft and replay. | Citrix NetScaler ns.log AAA events, TerminalServices-LocalSessionManager/Operational log, VPN/gateway session logs | Initial Access | Medium — legitimate users on roaming connections or VPN handoffs may change IPs mid-session. Correlate with known-good IP ranges and MFA challenge logs. |
| Consider hunting for AAA LOGIN_FAILED events in Citrix ns.log containing non-printable or binary data in the User field, which indicates heap memory leakage from CVE-2025-5777 exploitation. | Citrix NetScaler ns.log forwarded to SIEM or log retention platform | Initial Access | Low — binary data in the User field of authentication logs is highly anomalous and unlikely to occur in normal operations. |
| Consider hunting for the AppMgmt service being started manually via sc.exe or cmd.exe, especially from non-standard working directories, as this is the LPE detonation trigger. | Sysmon Event ID 1 (Process Creation), Windows Service Control Manager events, EDR process telemetry | Privilege Escalation | Low — AppMgmt is normally dormant and rarely started manually. Administrative GPO troubleshooting could trigger this, so correlate with admin activity windows. |
| Consider hunting for the sequence of gpupdate /force followed shortly by sc start AppMgmt followed by net user /add and net localgroup Administrators /add within a short time window, which maps to the LPE detonation and backdoor account creation. | Sysmon Event ID 1 (Process Creation) with command-line logging, EDR process telemetry | Privilege Escalation and Persistence | Low — this specific command sequence is highly indicative of the described LPE tool's behavior and is unlikely in normal administrative workflows. |
| Consider hunting for Citrix printer auto-creation events in Windows Application logs (MetaFrameEvents provider) that reveal client workstation names matching known adversary hostnames or default-format names (WIN-XXXXX patterns) inconsistent with organizational naming conventions. | Windows Application Event Log (MetaFrameEvents provider), TerminalServices-LocalSessionManager/Operational | Initial Access / Session Hijack | Medium — legitimate remote users may have default-format workstation names. Pivot on the session ID to correlate with source IP and authentication logs to identify anomalies. |
Control Gaps
- Network-based detection will not catch CitrixBleed 2 exploitation if NetScaler logs are not forwarded to a SIEM or retained beyond local rotation.
- EDR on Citrix published desktops may not correlate the initial session hijack since the session appears legitimately authenticated.
- Application allow-listing may not block rogue ScreenConnect or Zoho Assist installations if these tools are already approved for legitimate IT use in the environment.
- The LPE tool's registry cleanup removes post-exploitation artifacts, defeating registry-based forensic detection if the tool completes successfully.
- MFA on the Citrix gateway is bypassed entirely since the attacker replays an already-authenticated session token, rendering MFA controls ineffective against this specific vector.
Key Behavioral Indicators
- Process ancestry: eng.exe (or renamed LPE variant) spawning cmd.exe which runs 'sc start AppMgmt' followed by net.exe account creation commands
- AppMgmt service transitioning from stopped to running state outside of normal Group Policy refresh cycles
- REG_LINK SymbolicLinkValue being created under the RdpBus device class GUID key in the registry
- Citrix printer auto-creation events revealing client workstation names WIN-4EOAP4JTJR9 or WIN-VI960VQI4I6
- MSI installations (us.msi, SC.msi, 1111.msi, za.msi) from non-standard directories by non-admin users or outside of IT management workflows
- Mimikatz execution from anomalous paths such as C:\Binaries
- PsExec execution with -s flag from Citrix published desktop sessions
- NetScaler ns.log AAA LOGIN_FAILED events with binary/unprintable characters in the User field
False Positive Assessment
Low — the combination of CitrixBleed 2 exploitation artifacts (binary data in AAA LOGIN_FAILED User fields), the specific LPE command sequence (gpupdate /force → sc start AppMgmt → net user /add), and the reuse of specific adversary hostnames and account names across unrelated victims provides high-fidelity detection signals. Individual indicators such as AppMgmt service starts or printer auto-creation events may generate false positives, but the chained sequence is highly distinctive.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider patching all Citrix NetScaler ADC and Gateway appliances to the latest software version immediately to remediate CVE-2025-5777.
- Consider terminating all outstanding user sessions on Citrix appliances vulnerable to CVE-2025-5777, as harvested session tokens may remain valid even after patching.
- If applicable to your environment, consider auditing Citrix published desktop environments for the adversary accounts ctxsvc, CtxAppVCOMService, and test, removing any that do not correspond to legitimate administrative accounts.
- Consider scanning endpoints for unexpected ScreenConnect or Zoho Assist installations, particularly MSIs named us.msi, SC.msi, 1111.msi, or za.msi in non-standard locations.
- If your EDR supports host isolation, consider isolating any endpoints where the LPE tool or rogue RMM software is identified, then verify against your IR procedures before taking containment action.
Infrastructure Hardening
- Consider forwarding Citrix NetScaler ns.log to your SIEM or centralized log retention platform, as local logs rotate quickly and may only ephemerally contain evidence of compromise.
- Evaluate whether your Citrix gateway can be configured to restrict session token durability or enforce IP-binding on active sessions, if supported by your firmware version.
- Consider implementing network segmentation to restrict Citrix published desktops from directly accessing domain controllers, limiting lateral movement opportunities via PsExec or Impacket.
- If supported by your EDR or application control solution, consider blocking execution of unsigned binaries from user-writable directories such as C:\temp and C:\logs.
User Protection
- Consider deploying EDR coverage to all Citrix published desktop endpoints with process creation and command-line logging enabled.
- Evaluate whether your organization can monitor and alert on the AppMgmt service being started manually, as this is a key indicator of the LPE detonation.
- Consider implementing registry monitoring for REG_LINK SymbolicLinkValue creation under device class GUIDs, if supported by your EDR or Sysmon configuration.
- If applicable, consider reviewing Citrix printer auto-creation policies to determine whether disabling client printer mapping is feasible for your environment, reducing hostname leakage.
Security Awareness
- Consider incorporating guidance into existing security awareness programs about the limitations of MFA against session token theft, emphasizing that MFA protects authentication but not session replay.
- If your organization uses ScreenConnect or Zoho Assist legitimately, consider training IT staff to verify the source and configuration of RMM installations, including relay hostnames and instance IDs.
- Consider briefing help desk and Tier-1 support staff to flag reports of unexpected new local administrator accounts or unfamiliar remote-access software as potential security incidents.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Impact
Additional IOCs
- Domains:
vtps[.]us- Variant spelling of ScreenConnect relay host observed in image artifacts; likely same as vpts.us.
- File Hashes:
8903a3381fbb033a45f5c2c50c175c54(MD5) - MD5 hash of eng.exe LPE dropper from incident image artifacts.bc2820b5ee7b43c172005b66546f12316de8c081(SHA1) - SHA1 hash of eng.exe LPE dropper from incident image artifacts.
- Registry Keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ROOT\SYSTEM\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}- RdpBus device class GUID key under which the LPE tool plants a REG_LINK SymbolicLinkValue to redirect Group Policy engine writes.
- File Paths:
C:\temp- Working directory where the LPE dropper is placed and renamed per victim.C:\logs- Alternate working directory observed for LPE dropper placement.C:\Binaries- Anomalous directory from which Mimikatz was executed for credential dumping.
- Command Lines:
- Purpose: Trigger Group Policy refresh to force SYSTEM-context registry write through planted symbolic link | Tools:
cmd.exe,gpupdate| Stage: Privilege Escalation |cmd.exe /c gpupdate /force >nul 2>nul - Purpose: Start the Application Management service to detonate hijacked GPO configuration and relaunch the LPE dropper as SYSTEM | Tools:
cmd.exe,sc.exe| Stage: Privilege Escalation |cmd.exe /c sc start AppMgmt >nul 2>nul - Purpose: Create backdoor local administrator account after gaining SYSTEM privileges | Tools:
net.exe| Stage: Persistence |net user <ctx-account> <password> /add /y - Purpose: Add newly created backdoor account to local Administrators group | Tools:
net.exe| Stage: Persistence |net localgroup Administrators <ctx-account> /add
- Purpose: Trigger Group Policy refresh to force SYSTEM-context registry write through planted symbolic link | Tools:
- Other:
ctxsvc- Adversary-created backdoor local administrator account name observed across multiple incidents in the cluster.CtxAppVCOMService- Adversary-created backdoor local administrator account name designed to mimic a legitimate Citrix service account.test- Adversary-created backdoor account name; note that 'test' may also be a legitimate account in some environments, requiring contextual validation.WIN-4EOAP4JTJR9- Adversary workstation hostname leaked via Citrix auto-created printer mappings in Windows Application event logs; appeared across multiple unrelated victim environments.WIN-VI960VQI4I6- Second adversary workstation hostname leaked via Citrix printer auto-creation events; sibling to WIN-4EOAP4JTJR9.9963f404a99f0fc4- ScreenConnect instance ID baked into rogue client configuration paired with relay.dltsolutions.top.aee74a66ea5bb239- ScreenConnect instance ID baked into rogue client configuration paired with relay.eurofin.digital:8041.eng.exe- LPE tool filename variant dropped to working directories; frequently renamed per victim.legal.exe- LPE tool filename variant dropped to working directories.exsym.exe- LPE tool filename variant dropped to working directories.as.exe- LPE tool filename variant dropped to working directories.exp6.exe- LPE tool filename variant dropped to working directories.us.msi- Rogue ScreenConnect installer MSI deployed for persistent remote access.SC.msi- Rogue ScreenConnect installer MSI deployed for persistent remote access.1111.msi- Rogue ScreenConnect installer MSI deployed for persistent remote access.za.msi- Rogue Zoho Assist installer MSI deployed for persistent remote access.1.exe- DragonForce ransomware binary filename executed in the final impact stage.
