CitrixBleed 2 exploited in repeatable attack chain culminating in DragonForce ransomware, researchers find

Threat hunters at managed detection and response firm Huntress say they have tracked a single, highly consistent attack chain across at least half a dozen unrelated organisations in the first half of 2026; one that begins with exploitation of the “CitrixBleed 2” vulnerability in Citrix NetScaler appliances and, in its most advanced form, ends in DragonForce ransomware. Huntress assesses with high confidence that the activity is the work of an initial access broker (IAB) weaponising CVE-2025-5777