Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

Published on July 2, 2026

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral

Continue reading on website
Other news

ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories

July 2, 2026
This week’s security news is mostly about weak spots.Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through.This is not one big break. It is small permissions, weak checks, open systems, and normal tools doing things they were allowed to do. That same pattern runs

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

July 2, 2026
Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic.Working with the FBI, Lumen, and others, Google's Threat Intelligence Group (GTIG) said this week it had reduced the network's pool of usable devices by millions.Google identifies NetNut, also tracked as Popa, as a network spread across home