Full Report
Huntress has observed a series of strikingly similar intrusions beginning with CitrixBleed 2 exploitation, employing novel local privilege escalation techniques, and ending in Dragonforce ransomware.
Analysis Summary
# Incident Report: CitrixBleed 2 Weaponized for Dragonforce Ransomware
## Executive Summary
In the first half of 2026, Huntress identified a highly standardized attack chain targeting Citrix NetScaler appliances via the "CitrixBleed 2" vulnerability (CVE-2025-5777). The intrusions, orchestrated by an Initial Access Broker (IAB), utilized novel privilege escalation and legitimate remote access tools to facilitate the deployment of Dragonforce ransomware. The repeatable nature of these attacks across multiple sectors suggests a refined operator playbook designed to bypass Multi-Factor Authentication (MFA) and establish long-term persistence.
## Incident Details
- **Discovery Date:** January – June 2026
- **Incident Date:** Continuous throughout H1 2026
- **Affected Organization:** Multiple unrelated organizations (unnamed)
- **Sector:** Various (Cross-industry)
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** H1 2026
- **Vector:** Exploitation of Citrix NetScaler (CVE-2025-5777)
- **Details:** Attackers sent malformed pre-auth login requests to leak NetScaler memory. This allowed the theft and replay of valid session tokens, effectively hijacking live sessions and bypassing MFA.
### Lateral Movement
- Following initial access, the threat actor moved from the NetScaler gateway into the internal network, utilizing stolen session data and established local administrator accounts to navigate the environment.
### Data Exfiltration/Impact
- **Impact:** Deployment of Dragonforce ransomware.
- **Details:** The ultimate goal was data encryption and potential exfiltration, leading to significant operational downtime for affected victims.
### Detection & Response
- **Detection:** Identified by Huntress SOC through anomalous access logs and the creation of suspicious local accounts.
- **Response actions taken:** Termination of active sessions, patching of NetScaler appliances, and removal of unauthorized remote management tools.
## Attack Methodology
- **Initial Access:** Exploitation of CitrixBleed 2 (CVE-2025-5777) via session token theft.
- **Persistence:** Installation of legitimate Remote Monitoring and Management (RMM) tools, including ScreenConnect and Zoho Assist.
- **Privilege Escalation:** Utilized a registry-symlink/AppMgmt trick to escalate from a standard user to SYSTEM.
- **Defense Evasion:** Use of legitimate "living off the land" tools and creating accounts with deceptive names (e.g., fake "Citrix" admin accounts).
- **Credential Access:** Replaying hijacked session tokens; creation of rogue local administrator accounts.
- **Discovery:** Internal reconnaissance using standard network commands and printer mapping leaks.
- **Lateral Movement:** Standardized workstation naming and printer mapping abuses.
- **Collection:** Gathering sensitive data for exfiltration (implied by ransomware patterns).
- **Exfiltration:** Standard ransomware-associated data theft.
- **Impact:** Encryption of files via Dragonforce ransomware.
## Impact Assessment
- **Financial:** High (Ransom demands and recovery costs).
- **Data Breach:** Compromise of internal session data and corporate files.
- **Operational:** Severe (Business disruption due to ransomware encryption).
- **Reputational:** Moderate to High depending on the organization's public disclosure.
## Indicators of Compromise
- **Network indicators:** Traffic to known ScreenConnect or Zoho Assist infrastructure from unauthorized internal hosts.
- **File indicators:** Presence of Dragonforce ransomware binaries; unauthorized RMM installers.
- **Behavioral indicators:**
- Creation of local accounts named "Citrix" or similar variations.
- Registry symlink activities related to `AppMgmt` service.
- Repeated use of specific, identical workstation names in logs.
## Response Actions
- **Containment:** Terminate all active Citrix NetScaler sessions immediately.
- **Eradication:** Identify and delete rogue local administrator accounts; uninstall unauthorized RMM software (ScreenConnect/Zoho Assist).
- **Recovery:** Patch NetScaler appliances to remediate CVE-2025-5777; restore data from offline backups if ransomware was executed.
## Lessons Learned
- **MFA is not a Silver Bullet:** Session hijacking vulnerabilities like CitrixBleed 2 can render MFA irrelevant if the session token itself is stolen.
- **Predictability is a Weakness:** The standardized "playbook" used by the IAB allowed for faster identification once the pattern was recognized across multiple victims.
- **Shadow IT/Tools:** Legitimate tools (ScreenConnect) remain a preferred method for attackers to maintain "quiet" persistence.
## Recommendations
- **Patch Management:** Prioritize the patching of edge-facing appliances (Citrix NetScaler).
- **Session Management:** Configure short session timeouts and implement mandatory session termination upon patch deployment.
- **Account Auditing:** Regularly audit local administrator groups for unrecognized accounts.
- **Software Whitelisting:** Use AppLocker or similar solutions to prevent the execution of unauthorized remote access software.