> TritonInfoSec News
Home / Jul 03, 2026 / Story
0
#4 The Hacker News general July 02, 2026 at 18:30 UTC

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

By [email protected] (The Hacker News)

AI Summary

Threat actors affiliated with the Anubis ransomware operation are actively exploiting CVE-2025-5777 (Citrix Bleed 2) for initial access, with affiliate tradecraft also incorporating BYOVD techniques, legitimate RMM tooling, and stolen supply chain credentials for lateral movement. The pattern of reusing legitimate tooling makes detection significantly harder for defenders relying on signature-based controls. Organizations running Citrix NetScaler should treat unpatched appliances as actively targeted.

Read full article → https://thehackernews.com/2026/07/ransomware-group…

Relevance score: 84.0/100

# More from July 03

  1. 1
    FBI Seizes NetNut Proxy Platform, Popa Botnet Krebs on Security
  2. 2
    FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations The Hacker News
  3. 3
    SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation The Hacker News
  4. 5
    AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack The Hacker News
  5. 6
    Cisco finally confirms attackers exploiting Unified CM flaw BleepingComputer
  6. 7
    New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos The Hacker News
  7. 8
    Hackers target Microsoft 365 accounts with 81 million login attempts BleepingComputer
  8. 9
    Spyware found on phone of European Parliament member probing it The Record
  9. 10
    Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities SecurityWeek