Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Summary: Arctic Wolf reported that Anubis ransomware affiliates exploited Citrix Bleed 2 (CVE-2025-5777, CVSS 9.3) and valid Cisco AnyConnect VPN logins from hosting ASNs including AS20473 and AS55286 to gain initial access, then used RDP, SMB, and PsExec to deploy RMM tools such as ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment. Anubis, a RaaS rebrand of Sphinx announced on the RAMP forum in February 2025, has claimed 91 victims on its leak site with 11 in June 2026, over 50% in the U.S., and offers affiliates an 80% ransom split alongside a /WIPEMODE wiper that reduces files to 0 KB regardless of payment.
Key Takeaway: Anubis affiliates blend in by abusing the same legitimate remote management tools IT teams rely on, and its /WIPEMODE module can reduce files to 0 KB even after a ransom is paid, so payment buys no recovery. Separately, Expel reported that The Gentlemen's BYOVD use of the Kontron ktapi.sys driver grants kernel-level access to kill protected processes from Microsoft, ESET, Palo Alto Networks, and SentinelOne in seconds, even on fully patched Windows.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Mentions
- CVE-2025-5777
- Related
- CVE-2025-5777: Citrix Net Scaler ADC and Gateway Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Jul 10, 2025