Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Abuse CitrixBleed 2 to Steal Session Tokens and Bypass MFA Protections
Excerpt
Hackers are exploiting the CitrixBleed 2 vulnerability to steal active session tokens, bypass multi-factor authentication, and deploy ransomware in targeted Citrix NetScaler environments. Huntress Tactical Response investigated at least six similar incidents between January and June 202620262026, affecting unrelated organizations across multiple sectors. The intrusions consistently began with internet-facing Citrix NetScaler gateways . They progressed through privilege…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | db6bfe6e21a2492198001ea7077cea5b | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-5777 | High | Score 67/100 | First seen |
| Domain | temp.sh | High | Score 67/100 | First seen |
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| MD5 | 2c252861852b4980be2d4445c29538da | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…