Anubis Ransomware Exploits Citrix Bleed 2 for Attacks

The Anubis ransomware group has begun exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) to gain initial access to target networks. This development has been observed by cybersecurity experts, who note that the attackers are using various tactics to achieve their goals. The attackers rely on legitimate Remote Management and Monitoring (RMM) tools to infiltrate systems unnoticed. This approach allows them to bypass the security measures of companies and move laterally within the networks. The use of such tools is a characteristic feature of the current attacks.

Another aspect of the attacks is the access to credentials, which is obtained through various methods. The attackers employ techniques that enable them to steal passwords and other sensitive data to gain access to additional systems. This approach significantly increases the effectiveness of the attacks. The Anubis group has distinguished itself in the past through its adaptability and the use of innovative techniques. The current exploitation of the Citrix Bleed 2 vulnerability demonstrates that the group remains active and is adapting its methods to the latest security vulnerabilities.

Experts warn that companies using Citrix products are particularly vulnerable. The vulnerability CVE-2025-5777 affects a wide range of Citrix applications and services, significantly enlarging the potential attack surface. Companies should urgently take measures to patch and secure their systems to protect against these attacks. The severity of the vulnerability is rated as high. In addition to the technical aspects of the attacks, the behavior of the attackers is also significant.

The Anubis group has stood out through a combination of automated and manual attack methods. This hybrid strategy allows them to act both quickly and purposefully, making detection by security solutions more difficult. The cybersecurity community has already responded to the threat and recommends that companies review and strengthen their security protocols. Implementing multi-factor authentication and conducting regular employee training are some of the recommended measures to minimize the risk of a successful attack. Security researchers emphasize the need to take proactive measures.

The Anubis ransomware group is not the only threat currently active in the landscape. Other groups have also begun using similar tactics, increasing the need for companies to remain vigilant. The threat of ransomware remains a central concern for IT security professionals worldwide. The vulnerability CVE-2025-5777 was first discovered in 2025 and has since caused significant concern.

Experts estimate that millions of systems worldwide are potentially affected, underscoring the urgency of security updates. Companies should ensure they have the latest patches to protect against these threats. "The threat of ransomware will continue to increase, and companies must adapt to protect their systems," said a leading cybersecurity expert. "The exploitation of Citrix Bleed 2 is a clear indication that attackers are constantly searching for new vulnerabilities."