Arctic Wolf says Anubis ransomware affiliates used CitrixBleed 2 and remote admin tools to break into victim networks

Updated: 2026.07.01 26D ago 1 sources

Ransomware Threat Actors & APTs Zero-Days & CVEs

Arctic Wolf says multiple 2026 Anubis ransomware attacks began with either stolen VPN credentials or exploitation of CitrixBleed 2, putting organizations with exposed Citrix access at risk. The report ties Anubis intrusions to CVE-2025-5777 in Citrix NetScaler, then details follow-on use of legitimate remote management tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, plus cloudflared, authenticated proxies, and SSH SOCKS tunnels for persistence and lateral movement.

Why it matters: This matters because attackers are mixing a known edge-device flaw with normal-looking IT tools, making ransomware intrusions harder to spot until systems are already at risk. Organizations using Citrix remote access should patch and review VPN exposure, hunt for these remote admin tools, and closely monitor domain controllers, remote desktop servers, hypervisors, backup systems, and network storage.

Sources

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Arctic Wolf Labs 2026.07.01 100% relevant

This article establishes a distinct story by linking Anubis ransomware intrusions to exploitation of CitrixBleed 2 (CVE-2025-5777) and documenting a specific toolset and access pattern not reflected in the existing tracked stories.