Initial access broker linked to weaponization of CitrixBleed2 flaw

1. Executive summary

An initial access broker weaponized the CitrixBleed 2 vulnerability in a series of attacks across multiple organizations during the first half of 2026, according to a single-sourced report by Huntress. The attackers escalated privileges, created rogue local administrator accounts, and established persistence via legitimate remote access tools (ScreenConnect, Zoho Assist). In the most advanced of approximately half-a-dozen cases, the adversary deployed DragonForce ransomware almost immediately following privilege escalation. EMEA financial services running Citrix NetScaler ADC or Gateway as internet-facing virtual servers are directly exposed to the initial access vector. Attribution to the actor "DragonForce" is unconfirmed — no MITRE ATT&CK profile exists for this actor in the verified reference data, and the ransomware deployment represents a single observed case within the campaign.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Active exploitation of CitrixBleed 2 against NetScaler infrastructure constitutes an ICT-related incident requiring detection, analysis, and response under the entity's incident management process.	Entities must ensure their incident response playbooks cover NetScaler exploitation scenarios and that detection controls are in place for rogue account creation and legitimate-tool abuse.
DORA Art. 18: classification of ICT-related incidents and cyber threats	The campaign involves a critical vulnerability being weaponized by an initial access broker with progression to ransomware in at least one case.	Incidents triggered by this campaign must be classified per the entity's taxonomy; ransomware deployment would likely meet a higher severity tier.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If exploitation results in ransomware deployment or significant operational impact, major incident reporting thresholds may be engaged.	Entities must assess whether an active compromise meets the major incident criteria and prepare for regulatory notification timelines.
DORA Art. 24: digital operational resilience testing — general requirements	The vulnerability in NetScaler ADC/Gateway was exploited in the wild and had prior guidance from Citrix; unpatched systems indicate a gap in resilience testing.	Entities should verify that vulnerability scanning and patch management for externally facing ICT assets are included in operational resilience testing programmes.
NIS2 Art. 23: incident reporting obligations	In-scope financial entities under NIS2 (where applicable) experiencing exploitation of this vulnerability with significant impact must meet incident reporting obligations.	Ensure early warning and notification procedures are ready if exploitation is confirmed in the environment.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties	UK operators of essential services and registered digital service providers with exposed NetScaler infrastructure must consider notification duties if exploitation causes significant disruption.	Confirm whether active compromise triggers OES/RDSP reporting thresholds under the UK NIS framework.

3. Technical analysis & attack chain

Confirmed attack chain (based on Huntress report — single-sourced; verify before enforcement)

Initial access — The adversary exploited the CitrixBleed 2 vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw stems from insufficient input validation when NetScaler is configured as a Gateway or virtual server, resulting in a memory overread condition. This is analogous to the original 2023 CitrixBleed vulnerability (CVE-2023-4966) that enabled session token theft and was widely exploited against organizations including Comcast and a Boeing subsidiary. The specific CVE identifier for CitrixBleed 2 is not provided in the source material.
Privilege escalation — Following initial access, the attackers executed a local privilege escalation (LPE) script. The specific script name, technique, or CVE leveraged for LPE is not detailed in the source.
Account creation — The attackers created rogue local administrator accounts on compromised systems. Specific account names are not provided in the source material.
Persistence — Persistence was established using legitimate remote access tools: ScreenConnect (ConnectWise) and Zoho Assist. These are commercially available remote management tools abused for command-and-control and ongoing access. No specific configuration details, installation paths, or connection parameters are provided.
Ransomware deployment (single case) — In one of approximately six cases, the adversary deployed DragonForce ransomware. Deployment occurred almost immediately following execution of the LPE script, leaving minimal response time for defenders. The speed of execution was described as the adversary's "singular advantage."

In April 2026, Sophos researchers tracked a similar cluster of activity under the designation STAC3725. Those attacks involved abuse of QEMU, an open-source machine emulator. The relationship between STAC3725 and the Huntress-reported campaign is not explicitly defined beyond the similar pattern of activity and shared exploitation vector.

Attribution caveat

The actor "DragonForce" has no MITRE ATT&CK profile in the verified reference data. Attribution is based solely on the Huntress report's description of ransomware deployment in a single case. The initial access broker responsible for the broader campaign is not named. Treat all attribution as unconfirmed.

Technical gaps in source material

The source does not provide: specific CVE identifiers for CitrixBleed 2, CVSS scores, CISA KEV status, specific NetScaler firmware versions affected, LPE script names or hashes, rogue account names, ScreenConnect/Zoho Assist configuration details, C2 infrastructure, exfiltration evidence, ransom note content, or file extensions used by the DragonForce payload. The advisory from Citrix referenced in the source was released "last year" (2025); the specific advisory URL or CTX number is not provided.

4. Mitigation & containment

P1 — Within 24 hours

Patch NetScaler immediately. Apply the latest Citrix firmware for NetScaler ADC and NetScaler Gateway. Citrix released guidance on this vulnerability in 2025 — ensure the fix is applied to all instances configured as Gateway or virtual server. Verify patch level via the NetScaler CLI: show version.
Audit for rogue local administrator accounts. On all systems accessible from NetScaler infrastructure, enumerate local admin accounts:
Windows: net localgroup Administrators
Review for any accounts not created by authorised IT staff. Disable and remove suspicious accounts immediately.
Hunt for ScreenConnect and Zoho Assist installations. If these tools are not part of the approved software baseline, identify and isolate systems where they are installed:
ScreenConnect default paths: C:\Program Files (x86)\ScreenConnect\
Zoho Assist default paths: C:\Program Files (x86)\ZohoMeeting\
Check running services: sc query | findstr -i "screenconnect zoho"
Restrict external access to NetScaler management interfaces. Ensure NSIP (NetScaler IP) and SNIP are not internet-reachable. Only the Gateway virtual server should be exposed.

P2 — Within 72 hours

Review NetScaler session tokens. Given the memory overread mechanism (consistent with the original CitrixBleed pattern), terminate all active sessions and force re-authentication: kill aaa session -all
Deploy EDR detection rules for rapid local administrator account creation followed by remote access tool installation — this is the observed attack pattern.
Block unauthorized remote access tools at the network egress level. If ScreenConnect and Zoho Assist are not approved, block their associated domains and IP ranges at the firewall.
Review NetScaler logs for anomalous session activity during January–June 2026. Look for unexpected session token issuance or memory-related error conditions.

P3 — Within 7 days

Validate third-party remote access tool governance. Ensure only approved remote management tools are permitted and that all installations are inventoried and monitored.
Conduct tabletop exercise incorporating the observed attack chain: NetScaler exploitation → LPE → rogue admin account → legitimate RAT persistence → ransomware deployment. The near-instantaneous ransomware deployment timeline leaves no room for manual response — automated containment triggers are essential.
Engage DORA Art. 24 resilience testing. Include externally facing NetScaler infrastructure in the next cycle of vulnerability scanning and operational resilience testing.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source report does not provide specific IP addresses, domains, file hashes, account names, file paths, or other atomic indicators. The behavioural indicators described (rogue local admin account creation, ScreenConnect/Zoho Assist installation, rapid LPE-to-ransomware execution) are covered in §6 Detection.

6. Detection

The source material provides behavioural indicators but no specific strings, file names, hashes, or command-line artefacts. Detection is authored based on the described attack behaviours.

Sigma rule — rogue local administrator account creation

title: Suspicious Local Administrator Account Creation Following NetScaler Exposure
id: AT-2026-07-10-271-001
status: experimental
description: >
  Detects creation of a new local administrator account, consistent with the
  CitrixBleed 2 attack chain reported by Huntress where attackers created rogue
  local admin accounts following initial access via NetScaler exploitation.
references:

  - https://www.cybersecuritydive.com/news/initial-access-broker-citrixbleed2-flaw-DragonForce/824961/
author: Adverse Trace
date: 2026/07/10
logsource:
  product: windows
  service: security
detection:
  selection_account_creation:
    EventID: 4720
  filter_known_accounts:
    SubjectUserName|contains:

      - 'IT_'
      - 'Admin_'
      - 'Service_'
  condition: selection_account_creation and not filter_known_accounts
falsepositives:

  - Legitimate administrator account creation by approved IT staff
level: high

Sigma rule — local admin group modification

title: Addition to Local Administrators Group by Non-Standard Process
id: AT-2026-07-10-271-002
status: experimental
description: >
  Detects addition of a user to the local Administrators group, consistent with
  the CitrixBleed 2 campaign where attackers escalated privileges and created
  rogue local administrator accounts.
references:

  - https://www.cybersecuritydive.com/news/initial-access-broker-citrixbleed2-flaw-DragonForce/824961/
author: Adverse Trace
date: 2026/07/10
logsource:
  product: windows
  service: security
detection:
  selection_group_change:
    EventID: 4732
    TargetUserName: Administrators
  condition: selection_group_change
falsepositives:

  - Legitimate administrative group changes
level: medium

Sigma rule — ScreenConnect or Zoho Assist service creation

title: ScreenConnect or Zoho Assist Service Installation
id: AT-2026-07-10-271-003
status: experimental
description: >
  Detects installation of ScreenConnect or Zoho Assist services, which the
  CitrixBleed 2 campaign actors used for persistence following NetScaler
  exploitation and privilege escalation.
references:

  - https://www.cybersecuritydive.com/news/initial-access-broker-citrixbleed2-flaw-DragonForce/824961/
author: Adverse Trace
date: 2026/07/10
logsource:
  product: windows
  service: system
detection:
  selection_service_create:
    EventID: 7045
  selection_screenconnect:
    ServiceName|contains:

      - 'ScreenConnect'
      - 'ConnectWise Control'
  selection_zoho:
    ServiceName|contains:

      - 'Zoho'
      - 'ZohoMeeting'
      - 'ZohoAssist'
  condition: selection_service_create and (selection_screenconnect or selection_zoho)
falsepositives:

  - Legitimate deployment of approved remote support tools
level: medium

7. Sources

Cybersecurity Dive — "Initial access broker linked to weaponization of CitrixBleed2 flaw" — https://www.cybersecuritydive.com/news/initial-access-broker-citrixbleed2-flaw-DragonForce/824961/ — 2026-07-10
Huntress (referenced via Cybersecurity Dive) — Report on CitrixBleed 2 exploitation campaign, January–June 2026 — URL not provided in source material
Sophos (referenced via Cybersecurity Dive) — Tracking of STAC3725 cluster involving QEMU abuse, April 2026 — URL not provided in source material
Citrix (referenced via Cybersecurity Dive) — Guidance on NetScaler ADC/Gateway input validation vulnerability — released 2025; specific CTX advisory number not provided in source material

8. Adverse Trace position

This campaign represents a credible and active threat to EMEA financial services organizations with internet-facing Citrix NetScaler ADC or Gateway infrastructure. The attack chain is straightforward, relies on a known vulnerability class (memory overread in NetScaler Gateway configuration), and the near-instantaneous ransomware deployment in the most advanced case leaves minimal detection-to-response window. The single-sourced nature of this reporting (Huntress via Cybersecurity Dive) and the absence of a MITRE ATT&CK profile for "DragonForce" mean attribution should be treated as unconfirmed — the initial access broker responsible for the broader campaign is unnamed. We are assessing this as a high-severity advisory for clients with unpatched NetScaler infrastructure and a medium-severity advisory for clients with patched systems, given the legitimate-tool persistence technique (ScreenConnect, Zoho Assist) which can bypass controls that focus solely on malware signatures. Adverse Trace will monitor for additional source corroboration, specific CVE identifiers, and IOC publication from Huntress or Sophos, and will issue an update if technical indicators become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.