Post

Kevin Beaumont
@doublepulsar.com

I’m tracking 128 active CitrixBleed 2 victims in telemetry, today, from attacker infrastructure (one threat actor group).

5 reposts33 likes

Kevin Beaumont
@doublepulsar.com

Amazon have a blog out about this now. They’re 100% right. The same threat actor I was tracking this was also talking to Cisco ISE boxes at US universities — at the time I didn’t know why. www.bleepingcomputer.com/news/securit...

bleepingcomputer.comHackers exploited Citrix, Cisco ISE flaws in zero-day attacksAn advanced threat actor exploited the critical vulnerabilities "Citrix Bleed 2" (CVE-2025-5777) in NetScaler ADC and Gateway, and CVE-2025-20337 affecting Cisco Identity Service Engine (ISE) as zero-...