Skip to content
Threat Feed
Subscribe

Tag

Dragonforce

1 brief RSS
high threat

CitrixBleed 2 (CVE-2025-5777) Exploitation Leading to Dragonforce Ransomware

Initial Access Brokers are actively exploiting CitrixBleed 2 (CVE-2025-5777) on NetScaler appliances to steal session tokens, achieve local privilege escalation, establish persistence via legitimate remote access tools, and ultimately deploy Dragonforce ransomware.

exploited NetScaler ransomware initial-access privilege-escalation persistence citrix dragonforce
4r 9t 1c 7i