Ransomware Gangs Finding New Ways to Break Into Business Systems

The Anubis ransomware operation has been caught exploiting a vulnerability called Citrix Bleed 2 to break into business systems. Citrix is software that allows people to access work computers and applications remotely. Once inside, these ransomware attackers use legitimate remote management tools, steal more credentials, and move through networks to lock up files and demand ransom payments. They are also using different techniques including bringing their own vulnerable drivers and using stolen supply chain credentials.

This attack primarily targets businesses and organizations that use Citrix systems for remote work access. If you work remotely or your company uses Citrix to let employees access work computers from home, your employer could be vulnerable. Home users who do not connect to corporate networks through Citrix are not directly at risk from this specific vulnerability. However, if your employer gets hit with ransomware, it could affect your ability to work, access payroll information, or could potentially expose employee data.

If you use Citrix or similar remote access tools for work, there are steps you should take right now:

1. Contact your IT department and ask if your organization has patched the Citrix Bleed 2 vulnerability.
2. Change your work login password immediately and make sure it is strong and unique.
3. Enable multi-factor authentication on your work accounts if you have not already done so.
4. Be extremely cautious about any remote access tools or software you are asked to install, even if the request seems to come from IT.
5. Report any suspicious activity or unusual requests to your IT security team immediately. For long-term protection, keep your work and personal digital lives separate. Use different passwords for work and personal accounts. Never reuse your work password anywhere else. If your company allows remote access to work systems, always use the official, approved methods rather than shortcuts or third-party tools. Stay alert to phishing emails that try to steal your work credentials. Finally, make sure your personal devices are secure with updated software and antivirus protection, especially if you work from home on personal equipment.