The cybersecurity landscape in late 2025 was shaken by revelations that an advanced persistent threat actor exploited critical zero-day vulnerabilities in Citrix NetScaler and Cisco ISE products well before patches or public advisories were released. The attacks, uncovered by Amazon’s MadPot honeypot intelligence network, demonstrate the growing sophistication of state-level threat actors and the widening gap between exploitation and detection in enterprise security infrastructure.
The Exploit Mechanics
At the center of this campaign sat CVE-2025-5777, dubbed “CitrixBleed 2,” an out-of-bounds memory read vulnerability affecting NetScaler ADC and NetScaler Gateway products. The flaw allowed attackers to exfiltrate up to 127 bytes of sensitive data per request, potentially exposing session tokens, authentication cookies, and user credentials through memory disclosure. Unlike typical buffer overflows, this vulnerability exploited the way NetScaler handled memory allocation during session validation, leaking fragments of adjacent memory that often contained active session identifiers.
The attackers chained CitrixBleed 2 with CVE-2025-20337, a maximum-severity flaw in Cisco Identity Services Engine (ISE) that enabled pre-authentication remote code execution with root privileges. By combining both vulnerabilities, the threat actor gained persistent access to critical network infrastructure, deploying a custom web shell named “IdentityAuditAction” that masqueraded as a legitimate ISE component. The web shell registered as an HTTP listener to intercept all incoming requests and used Java reflection to inject into Tomcat server threads, employing DES encryption with non-standard Base64 encoding to evade detection.
Affected Systems
The scope of affected infrastructure was vast. Citrix NetScaler ADC and Gateway are deployed across tens of thousands of enterprise networks globally, serving as the primary secure access gateway for remote workers. Cisco ISE functions as the central policy enforcement point for network access control in many organizations, meaning compromise of this system effectively grants attackers the keys to the entire network kingdom. Any organization running unpatched versions of these products between June and November 2025 remained at risk.
Amazon’s threat intelligence team confirmed that exploitation attempts were detected before either vendor published security bulletins, indicating a highly resourced threat actor with advance knowledge of these vulnerabilities. The targeting appeared surprisingly indiscriminate, which is unusual for advanced persistent threat operations that typically focus on specific high-value targets. This broad targeting pattern suggests the actor was building infrastructure for future operations rather than pursuing immediate objectives.
The Mitigation Strategy
Citrix released patches for CVE-2025-5777 in late June 2025, though the company took considerable time to confirm active exploitation despite multiple third-party reports. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 11, 2025, requiring federal agencies to patch within a single day. Cisco published its advisory for CVE-2025-20337 on July 17, with active exploitation confirmed within five days of the initial disclosure.
Organizations should immediately apply all available security updates for both CVE-2025-5777 and CVE-2025-20337. Beyond patching, network administrators must invalidate all active sessions on NetScaler devices, rotate administrative credentials, and audit ISE deployments for indicators of compromise including the “IdentityAuditAction” web shell. Implementing network segmentation to limit lateral movement from compromised gateway devices provides an essential defense-in-depth measure.
Lessons Learned
This incident exposes several critical failures in the current vulnerability disclosure and response ecosystem. First, the gap between private exploitation and public patching can stretch weeks or months, during which organizations remain unknowingly exposed. Second, edge network devices like VPN gateways and access controllers represent high-value targets that receive insufficient monitoring compared to internal servers. Third, the sophistication of custom malware deployed in these attacks, including deep knowledge of Java and Tomcat internals, indicates that threat actors are investing heavily in understanding the specific technologies they target.
The discovery by Amazon’s MadPot honeypot network also highlights the value of threat intelligence infrastructure that can detect exploitation before vendors acknowledge vulnerabilities. Organizations that rely solely on vendor advisories for threat awareness will always remain behind the curve.
User Action Required
Security teams should conduct immediate audits of all Citrix NetScaler and Cisco ISE deployments. Check for unauthorized web shells, unusual Java processes, and anomalous network traffic patterns. Apply all available patches, reset session tokens, and implement continuous monitoring for these critical infrastructure components. Consider deploying network detection and response solutions that can identify exploitation patterns independent of signature-based detection. The crypto and blockchain space should take particular note, as many exchanges and DeFi platforms rely on similar enterprise infrastructure for their operational security.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified cybersecurity professionals for specific security concerns.
Bug bounties are the most cost-effective security investment
Yuto bounties work when the payout matches the risk. too many protocols offer $50K for a critical finding worth millions in potential damage
bug bounties work when the payout matches the risk. too many protocols lowball critical findings and then act surprised when exploits happen
chromium paid nothing for a critical while zerodium paid $250K for the same bug. the bounty market is completely broken
payout_gap chromium paying zero for a critical while zerodium pays 250K tells you everything about who actually values security research
patch_debt_ the chromium vs zerodium gap proves the legitimate market undervalues research. as long as gray markets pay 5x for the same bug, critical vulns will keep going to buyers not vendors
bounty_hunt the gap between exploitation and detection is what makes this scary. threat actors had weeks before public disclosure
zero_day_grind weeks of exploitation before disclosure means threat actors were already inside when the patch dropped. anyone running NetScaler should assume compromise not hope for it
bugtraq_og assume compromise is the only sane response. if you ran NetScaler and didnt patch within hours youre already inside their network
bugtraq_og weeks of exploitation before disclosure means every NetScaler instance in that window should be treated as compromised. incident response teams are going to be chasing lateral movement for months
ir_komodo_ lateral movement from NetScaler compromises takes months to trace. most teams treat patching as the fix but the attackers already have persistence in the internal network
The cost of a security breach always exceeds the cost of prevention
Formal verification should be mandatory for high-value protocols
Hardware wallet adoption is the single biggest security improvement anyone can make
127 bytes per request doesnt sound bad until you realize session tokens are like 40 bytes. one request and they own your session
Malik D. 127 bytes is exactly one session token plus overhead. the precision of that leak is terrifying
MadPot honeypot catching this before anyone else is wild. amazon security research has been quietly carrying enterprise threat intel for a while now
MadPot catching state-level actors before public disclosure is genuinely impressive. amazon security research is underrated
Malik D. 127 bytes to steal a 40 byte session token. the efficiency of that exploit is genuinely impressive from a technical standpoint
Malik D. 127 bytes is plenty when session cookies are 32-40 bytes. attackers just poll the endpoint and sort through what they get
Malik D. 127 bytes is exactly one session token plus overhead. CitrixBleed 2 didnt need to be fancy it just read memory adjacent to active sessions and grabbed credentials
MadPot honeypots catching nation-state actors weeks before disclosure. threat intel works, the problem is nobody acts on it fast enough
MadPot honeypots caught nation state actors exploiting NetScaler weeks before public disclosure. Amazon threat intel is carrying enterprise security and nobody talks about it
Pavel D. Amazon quietly built one of the best threat intel networks on the planet. MadPot data has flagged like 4 nation state campaigns this year before anyone else noticed
chaining CitrixBleed 2 with CVE-2025-20337 is the part that worries me. two max severity bugs used together means these actors have full exploit chains ready before vendors even know about one flaw