Hackers Exploited CitrixBleed 2 Vulnerability Before Public PoC Release

Security researchers at GreyNoise have uncovered alarming evidence that threat actors began actively exploiting CVE-2025-5777, dubbed “CitrixBleed 2,” nearly two weeks before any public proof-of-concept (PoC) code became available.

This memory overread vulnerability in Citrix NetScaler appliances demonstrates how sophisticated attackers can identify and weaponize zero-day vulnerabilities before the broader security community becomes aware of exploitation techniques.

Exploitation Timeline Reveals Advanced Threat Activity

The exploitation timeline reveals concerning gaps in vulnerability disclosure processes.

GreyNoise sensors first detected malicious activity targeting CVE-2025-5777 on June 23, 2025, with attackers demonstrating a sophisticated understanding of the memory overread vulnerability affecting Citrix NetScaler devices.

The public PoC code wasn’t released until July 4, 2025, creating an 11-day window where threat actors possessed exclusive exploitation capabilities.

GreyNoise responded by creating a dedicated tracking tag on July 7, 2025, enabling retroactive analysis of pre-tag traffic patterns.

This retrospective capability proved crucial in understanding the full scope of exploitation attempts.

The Cybersecurity and Infrastructure Security Agency (CISA) contacted GreyNoise on July 9 to confirm the exploitation activity, subsequently adding CVE-2025-5777 to the Known Exploited Vulnerabilities (KEV) catalog.

Targeted Attack Patterns

Analysis of the exploitation attempts reveals highly targeted behavior rather than opportunistic scanning.

The malicious IP addresses, primarily geolocated in China, specifically targeted GreyNoise sensors configured to emulate Citrix NetScaler appliances.

This precision suggests that threat actors conducted thorough reconnaissance to identify vulnerable systems before launching exploitation attempts.

The targeting methodology indicates advanced persistent threat (APT) characteristics, with attackers demonstrating knowledge of specific NetScaler configurations and deployment patterns.

Rather than employing broad-spectrum vulnerability scanning, these actors focused their efforts on high-value targets running Citrix infrastructure, suggesting potential espionage or data exfiltration objectives.

Industry Response and Dynamic Mitigation Strategies

The rapid response from both GreyNoise and CISA highlights the importance of threat intelligence sharing in modern cybersecurity.

CISA’s decision to add CVE-2025-5777 to the KEV catalog within days of confirmed exploitation demonstrates improved coordination between private security firms and government agencies.

GreyNoise has implemented dynamic IP blocklists to help defenders rapidly respond to emerging threats.

Organizations running Citrix NetScaler appliances should immediately implement these blocklists and apply available security patches.

The company is developing enhanced dynamic IP blocklist capabilities to enable faster response times for emerging vulnerabilities.

Defenders must prioritize patching Citrix NetScaler systems and implementing network segmentation to limit potential impact.

The pre-PoC exploitation of CVE-2025-5777 underscores the critical importance of proactive vulnerability management and threat hunting capabilities in detecting zero-day exploitation attempts.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates