Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral

The article reports that Anubis ransomware actors are exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC/Gateway for initial access, using memory disclosure to obtain sensitive data such as credentials and tokens, followed by legitimate RMM tooling and hands-on-keyboard lateral movement.[1][2][3][5][10] This is a factual description of threat actor behavior against widely used infrastructure components that often underpin remote access to SaaS, internal apps, and AI-enabled services. From a CyberSE.AI perspective, this represents an AI supply chain risk because compromise of Citrix NetScaler or similar remote access infrastructure can expose credentials, sessions, and management access used to operate or administer AI agents and SaaS AI platforms, enabling downstream compromise without directly attacking the AI system itself. Organizations should treat remote access gateways as critical elements of their AI supply chain, ensure rapid patching of CVE-2025-5777, aggressively invalidate sessions, and integrate such infrastructure into AI-specific red teaming, SBOM-based dependency review, and readiness assessments to prevent ransomware actors from pivo