# CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress

CitrixBleed 2 (CVE-2025-5777) memory overread in NetScaler ADC/Gateway leaks session tokens, enabling pre-auth session hijack and ransomware deployment.

- Payout: Real-world hack
- Severity: critical
- Program: Citrix NetScaler
- Credited: Huntress
- Disclosed: 2026-07-09
- CVE: CVE-2025-5777
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware
- Tags: domain:infra impact:ato impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical technique:chained technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:privilege-escalation

**Target:** NetScaler ADC and Gateway (AAA virtual server)
**Root cause:** Memory overread when processing POST to login endpoint with empty login parameter, serializing adjacent heap memory into response.
**Steps:**
1. Send POST to `/p/u/doAuthentication.do` with login form variable present but empty.
2. Receive response containing ~127 bytes of leaked heap memory.
3. Repeat at high rate to collect heap fragments.
4. Carve leaked data for valid session tokens (e.g., Citrix session cookies).
5. Replay stolen session token from attacker IP to hijack authenticated session.
**How found:** Huntress SOC observed thousands of failed logins with unprintable usernames in ns.log, recognized as leaked heap memory, and correlated with session hijack evidence (valid session from attacker IP without authentication).
**Exploitation:** Attacker sprays malformed login POSTs to leak heap memory, extracts valid session tokens, and replays them to access Citrix environment without authentication. Then uses LPE tool (REG_LINK symlink abuse) to escalate to SYSTEM, creates backdoor admin, installs RMM tools (ScreenConnect, Zoho Assist), moves laterally, and deploys Dragonforce ransomware.
**Escalation:** Session hijack -> local privilege escalation via REG_LINK symlink and AppMgmt service -> backdoor admin -> RMM persistence -> lateral movement -> ransomware.
**Insight:** Monitor for AAA LOGIN_FAILED events with binary/non-printable usernames; these indicate memory leak exploitation. Also, Citrix auto-printer mapping leaks client workstation names, useful for tracking attacker infrastructure.