Attackers Now 'Scanning Extensively' for Citrix Bleed 2

Ransomware Group Among Attackers Focused on Exploiting Citrix Netscaler Flaw Mathew J. Schwartz (euroinfosec) • July 14, 2025

Attackers have ramped up their collective attempts to find exploitable Citrix NetScaler devices that remain unpatched to fix a flaw first publicly detailed last month.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

The scanning activity appears to be heavily focused on finding a pre-authentication remote memory disclosure vulnerability in Citrix NetScaler ADC and Gateway appliances, tracked as CVE-2025-5777 and assigned a CVSS score of 9.3, which makes it "critical" (see: Attackers Actively Exploit 'Citrix Bleed 2' Vulnerability).

Cloud Security Group released a patch to fix CVE-2025-5777 on June 17.

"Since the disclosure of CVE-2025-5777, we have observed increasing attack activity ...