From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Anubis ransomware affiliates are leveraging both stolen VPN credentials and the CitrixBleed 2 vulnerability (CVE-2025-5777), combined with abuse of legitimate remote management tools and stealthy lateral movement, to blend in with normal IT operations and maximize impact before deploying ransomware and exfiltrating data.