Attackers turned Citrix, Cisco 0-day exploits into custom-malware hellscape

An "advanced" attacker exploited CitrixBleed 2 and a max-severity Cisco Identity Services Engine (ISE) bug as zero-days to deploy custom malware, according to Amazon Chief Information Security Officer CJ Moses. The cloud giant's MadPot honeypot detected the unnamed miscreant(s) attempting to break into buggy Citrix NetScaler ADC and NetScaler Gateway devices via CVE-2025-5777 before the critical vulnerability was publicly disclosed, Moses said in a Wednesday security blog. CVE-2025-5777 is an out-of-bounds read flaw in NetScaler Gateway and AAA virtual servers that can allow remote attackers to leak memory contents. Security researchers dubbed it CitrixBleed 2 due to similarities with the original CitrixBleed that allowed both nation-state spies and ransomware gangs to steal session secrets. Citrix disclosed and issued a fix for CVE-2025-5777 on June 17, and soon after bug hunters started warning that things could get really, really bad if customers didn't patch immediately. By July, the US Cybersecurity and Infrastructure Security Agency and private researchers said the flaw was under exploitation and being abused to hijack user sessions - although Citrix still hasn't commented on the attacks. "Through further investigation of the same threat exploiting the Citrix vulnerability, Amazon Threat Intelligence identified and shared with Cisco an anomalous payload targeting a previously undocumented endpoint in Cisco ISE that used vulnerable deserialization logic," Moses wrote. Th...