Between January and June 2026, multiple unrelated organizations suffered intrusions exploiting CitrixBleed 2 (CVE-2025-5777), a memory-overread vulnerability in NetScaler ADC and Gateway appliances. Attackers sent malformed pre-authentication login requests that leaked NetScaler memory containing valid session tokens, enabling bypass of multi-factor authentication by hijacking active sessions. After initial access, threat actors escalated privileges to SYSTEM via a registry-symlink exploitation technique targeting the AppMgmt service, created rogue administrator accounts (CtxAppVCOMService, ctxsvc, test), and established persistence through legitimate remote access tools such as ScreenConnect and Zoho Assist. The attack chain is highly standardized, with reused infrastructure and consistent indicators, suggesting a single initial access broker. The most advanced incidents resulted in DragonForce ransomware deployment.

Successful exploitation allows attackers to bypass multi-factor authentication by hijacking active sessions, gain SYSTEM-level privileges through privilege escalation, create unauthorized administrator accounts, and maintain persistent access via legitimate remote access tools. This can lead to full compromise of affected systems and deployment of ransomware, specifically DragonForce ransomware in observed cases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of confirmed patches, organizations should monitor for indicators of compromise related to this attack chain and restrict use of vulnerable NetScaler ADC and Gateway appliances where possible. Since this is not a cloud service, remediation depends on vendor patch availability and deployment by affected organizations.