Ransomware Groups Are Escalating: Citrix Bleed 2, BYOVD and Stolen Credentials in One Campaign

Colleagues, I’d like to draw attention to a growing trend in cybersecurity.

I’m seeing ransomware groups increasingly combine multiple techniques: they exploit Citrix Bleed 2, valid VPN credentials, RMM tools and BYOVD to bypass defenses.

Attackers also rely on stolen supply chain data to gain access faster and move to lateral movement and exfiltration.

My key takeaway is simple: perimeter security alone is no longer enough. We need timely patching, tight control of VPN and RMM, and anomaly detection in accounts and administrator activity.

Why it matters: these attack chains reduce time to encryption and make detection harder.

How are you currently monitoring VPN and remote admin tools?

#cybersecurity #ransomware #VPN #BYOVD