Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

Threat actors are increasingly leveraging a combination of sophisticated techniques, including the exploitation of a critical Citrix vulnerability, Bring Your Own Vulnerable Driver (BYOVD) attacks, and the misuse of compromised supply chain credentials, to gain initial access for ransomware operations.

The Anubis ransomware group, for instance, has been observed actively exploiting the Citrix Bleed 2 vulnerability, identified as CVE-2025-5777. This vulnerability allows attackers to gain unauthorized entry into targeted systems. While specific methods may vary among different affiliates of the ransomware operation, common patterns in their attack methodologies have been identified.

Beyond exploiting known vulnerabilities, threat actors are also employing Bring Your Own Vulnerable Driver (BYOVD) techniques. This method involves attackers using legitimate, but vulnerable, drivers already present on a victim's system. By exploiting these drivers, they can elevate their privileges and bypass security measures that might otherwise detect malicious code. This approach is particularly insidious as it leverages trusted components of the operating system, making detection more challenging for security solutions.

Furthermore, the compromise and subsequent misuse of credentials obtained through supply chain attacks represent another significant vector for initial access. This involves targeting organizations that provide services or software to other companies. By infiltrating a trusted supplier, attackers can gain access to the credentials of their downstream customers, effectively bypassing perimeter defenses and moving laterally within the victim's network.

The convergence of these tactics highlights a concerning trend in ransomware attacks. Attackers are not relying on a single method but are instead combining multiple techniques to increase their chances of success and evade detection. The exploitation of vulnerabilities like Citrix Bleed 2 provides an initial foothold, while BYOVD and compromised supply chain credentials facilitate privilege escalation and lateral movement within the network.

These advanced persistent threats necessitate a robust and multi-layered security strategy. Organizations are advised to prioritize patching known vulnerabilities, such as CVE-2025-5777, as soon as updates become available. Implementing strong access controls, multi-factor authentication, and regularly reviewing third-party vendor security practices are also crucial steps in mitigating the risks associated with supply chain compromises.

Additionally, security teams should focus on endpoint detection and response (EDR) capabilities that can identify anomalous driver behavior and suspicious credential usage. Continuous monitoring of network traffic and system logs can help detect the early stages of an attack, even when sophisticated evasion techniques are employed.

The evolving landscape of ransomware attacks underscores the importance of proactive security measures and a comprehensive understanding of the tactics, techniques, and procedures employed by threat actors. Staying informed about emerging vulnerabilities and attack vectors is essential for organizations to effectively defend against these persistent threats.