Ransomware Groups Chain Unpatched Citrix Flaw with Stolen Supply Chain Credentials

The Anubis ransomware operation demonstrates how attackers layer multiple weaknesses — an unpatched critical vulnerability (CVE-2025-5777 in Citrix) combined with stolen VPN credentials sourced from supply chain compromises or initial access brokers — to achieve rapid, deep network penetration. The failure to promptly patch internet-facing Citrix infrastructure provided the initial foothold, while unvetted third-party credential exposure amplified the blast radius. Once inside, the use of legitimate RMM tools allowed attackers to blend in with normal traffic, delaying detection. This combination of exploitation vectors underscores that a single unpatched system can cascade into a full ransomware-plus-wiper incident, making recovery extremely difficult or impossible.

Tactical Insight

Immediate actions

Apply the vendor-released patch for CVE-2025-5777 on all Citrix Bleed 2 affected appliances immediately and verify patch integrity.
Rotate all VPN and remote access credentials, especially those shared with or accessible by third-party vendors, to eliminate stolen credential reuse.
Block or tightly restrict unauthorized RMM tools (e.g., AnyDesk, TeamViewer) unless explicitly approved and monitored.

Long-term improvements

Implement a formal third-party/supply chain risk management program that audits vendor credential access and enforces least-privilege principles.
Establish a vulnerability management program with SLA-driven patching timelines (e.g., critical CVEs patched within 24–72 hours for internet-facing assets).
Deploy network segmentation to isolate remote access infrastructure from internal systems, limiting lateral movement after initial compromise.

Detection measures

Enable detailed logging and behavioral monitoring on all RMM tool activity to detect anomalous lateral movement patterns.
Integrate threat intelligence feeds to receive early warnings on newly exploited CVEs targeting your vendor stack.
Deploy decoy credentials (honeytokens) in VPN and directory systems to rapidly detect credential misuse from supply chain sources.

Framework References

CIS Control 7 – Continuous Vulnerability ManagementCIS Control 12 – Network Infrastructure ManagementCIS Control 15 – Service Provider ManagementNIST CSF ID.RA-1 – Asset Vulnerabilities IdentifiedNIST SP 800-53 SI-2 – Flaw RemediationNIST SP 800-53 AC-17 – Remote AccessNIST SP 800-53 SA-9 – External System Services (Supply Chain)NIST SP 800-161 – Supply Chain Risk Management PracticesMITRE ATT&CK T1190 – Exploit Public-Facing ApplicationMITRE ATT&CK T1078 – Valid AccountsMITRE ATT&CK T1219 – Remote Access SoftwareISO/IEC 27001 A.12.6.1 – Management of Technical VulnerabilitiesITIL Change Management – Emergency Change Procedures

Source

ThreatNoir coverageRansomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials Read originalRansomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

Heard on the podcastThreatNoir Morning Brief — July 3

PublishedJul 02, 2026