CitrixBleed 2: How 127 Bytes of Memory Became a Ransomware Blueprint
28.07.2026 citrixbleednetscalersession-hijackingransomware
It starts with a single empty form field. A malformed POST request to a Citrix NetScaler gateway’s login endpoint tricks the appliance into serializing adjacent process memory straight into its HTTP response. Malformed POST requests to the login endpoint, sent with an empty login form variable, cause the appliance to serialise roughly 127 bytes of adjacent process memory into its response. What made headlines in 2023 as the original “CitrixBleed” is back under the name CVE-2025-5777, dubbed “CitrixBleed 2” — and throughout the first half of 2026, incident responders have been tracking a strikingly uniform wave of exploitation.
Reading the Tell-Tale Signs in the Appliance Log
Managed detection provider Huntress investigated at least half a dozen incidents at completely unrelated organizations that turned out to be near-identical forensic blueprints. In the first half of 2026 (between January and June) they responded to a half-dozen incidents at unrelated organizations—different industries, different managed service providers, different parts of the country—that were so mechanically similar that by the latest case they could predict the next steps. At the log level, the pattern surfaces in AAA LOGIN_FAILED events: the leaked memory lands in the User field of the resulting AAA LOGIN_FAILED events, frequently preceded by the appliance’s own diagnostic breadcrumbs — “Login request is not expected to be encrypted” and “X509 cert not found” — but these two diagnostic log lines are not by themselves reliable forensic evidence. Only binary data in the user parameter, or a session that exists with no corresponding login, provides the real discriminator. The discriminator that actually separates an attack from background noise is the binary data leaking through the user parameter, or even more simply, a session that exists with no corresponding session login.
In one case, analysts counted thousands of suspicious login attempts within hours: Huntress identified nearly 5,937 AAA LOGIN_FAILED events from attacker-controlled IP addresses over roughly five hours in one incident. Because tokens harvested this way are already fully authenticated, MFA offers no protection whatsoever. Because the session was already fully authenticated, MFA offered no protection; it had already been satisfied by the legitimate user.
From Foothold to Encryption in Under an Hour
What should worry responders most is speed. After examining half a dozen intrusions at unrelated organizations between January and June 2026, analysts at Huntress identified a repeatable seven-stage playbook — the same access route, escalation technique, rogue accounts, and remote-control tools, indicating a standardized operation rather than isolated opportunistic attacks. In one documented case, the operator progressed from initial access to ransomware deployment in under an hour, with DragonForce used in the most advanced case. Huntress assesses the activity as the work of a single broker systematically weaponizing the flaw. Huntress assesses with high confidence that the activity is the work of an initial access broker (IAB) weaponising CVE-2025-5777 to gain footholds in Citrix environments before selling or handing off access, ultimately for the purpose of ransomware deployment.
The biggest forensic obstacle, however, isn’t the analysis itself — it’s evidence preservation, since NetScaler logs rotate fast enough to erase the trail before anyone notices. Log preservation is equally important: NetScaler logs can rotate quickly, leaving only a short window to find the malformed login requests, memory leakage, session anomalies, and diagnostic messages associated with the attack. Forwarding appliance logs to a SIEM or another central repository gives responders a better chance to reconstruct the intrusion before that evidence disappears. Compounding matters, harvested tokens frequently survive a straightforward patch, so sessions must be actively invalidated. The incident pattern shows why patching alone is not enough after suspected exploitation, since stolen session tokens can remain usable after an appliance update.
That this vulnerability class isn’t going away is confirmed by a fresh NetScaler flaw disclosed mid-2026: CVE-2026-8451, a new CitrixBleed-class NetScaler memory bug (CVSS 8.8), was exploited within 24 hours of Citrix’s June 30 patch. For DFIR teams, the takeaway is clear: running NetScaler at the edge demands not just disciplined patch management, but a resilient, externally forwarded logging pipeline — because by the time the next alert fires, the evidence may already be gone.
← Back to overview