Ransomware Is Now a Supply Chain Problem: Citrix Bleed 2, BYOVD Drivers, and Rented Credentials

Ransomware crews stopped writing their own malware years ago. Now they’ve stopped stealing their own credentials too — the Anubis, The Gentlemen, and VECT operations are outsourcing initial access to VPN brokers, weaponizing obscure vendor drivers, and buying seats in supply chain compromises like they’re renting cloud infrastructure. If your threat model still treats ransomware as a single-actor smash-and-grab, the reporting from Arctic Wolf, Kaspersky, Expel, and Sophos this week should make you rewrite it.

Why Citrix Bleed 2 Became the Perimeter Problem You Can’t Patch Away

Arctic Wolf’s report on Anubis confirms affiliates are actively exploiting CVE-2025-5777 — Citrix Bleed 2, CVSS 9.3 — to bypass authentication on NetScaler ADC and Gateway appliances configured as Gateway or AAA virtual servers. Once inside, affiliates pivot with valid Cisco AnyConnect logins sourced from hosting ASNs like AS20473 (The Constant Company) and AS55286 (ServerMania), then chain RDP, SMB, and PsExec to move laterally.

The CVE isn’t the issue — it’s the operational pattern around it. Anubis affiliates deliberately blend into normal IT activity using ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, then set up Cloudflare Tunnels for persistent command channels. That means every RMM tool your helpdesk uses is also a ransomware C2. Detection based on tool identity is dead; you now have to detect on behavior.

If you’re a mid-sized enterprise running NetScaler in front of a flat internal network, this is your nightmare scenario: an unpatched appliance leaks a session, an affiliate logs in through your own VPN, and your EDR sees nothing but a ScreenConnect session that looks like every other one your MSP runs. The prediction: expect the next 12 months of ransomware incident reports to name legitimate RMM software more often than they name custom loaders.

How BYOVD Turned Kernel Drivers Into the New Initial Access Broker Market

Kaspersky and Expel independently dissected The Gentlemen RaaS group, and the technical detail worth flagging is their bring-your-own-vulnerable-driver (BYOVD) technique. The group weaponized a zero-day in ktapi.sys — a driver from an API developed by Kontron that most defenders have never heard of — to gain kernel-level access and terminate protected security processes belonging to Microsoft, ESET, Palo Alto Networks, and SentinelOne. Their Go-based backdoor beacons to 81.177.215.15:9443, executes commands via cmd.exe when the operator sends byte c, and opens a SOCKS proxy when it receives s.

BYOVD used to mean a small pool of well-known signed drivers that vendors could blocklist. The Gentlemen went digging for an industrial API driver from a niche vendor, which suggests the market for vulnerable-but-signed drivers is diversifying faster than Microsoft’s driver blocklist can keep up. Marcus Hutchins of Expel put it plainly: even the latest Windows with all mitigations enabled does not provide complete protection.

Imagine you’re a hospital security team that just finished a Windows 11 rollout and paid for a top-tier EDR. A single signed driver from a vendor whose product you don’t even own can be dropped on disk, loaded, and used to kill your agents in seconds. That’s what makes healthcare a repeat target, and it’s why teams building healthcare software need driver allowlisting and kernel-level integrity monitoring, not just endpoint agents. Prediction: within the next year, we’ll see a major EDR vendor ship a driver-reputation feed as a paid tier — because the free Microsoft blocklist can’t move fast enough.

When Supply Chain Compromise Becomes a Ransomware Distribution Channel

The biggest story is Sophos Counter Threat Unit’s reporting on the VECT and TeamPCP partnership, formalized in March 2026. TeamPCP handled the Trivy and LiteLLM supply chain attacks, harvesting credentials at scale; VECT provides the ransomware payload. That’s a clean division of labor: one crew owns distribution, the other owns encryption.

Supply chain credential theft has historically fed espionage or cryptomining. Bolting it directly onto a RaaS distribution pipeline means every developer who pulled a compromised container scanner or LLM proxy is now a potential ransomware entry point for their entire employer. TeamPCP previously ran the CipherForce brand, listed six victims in February 2026, and rebranded the leak site as TeamPCP in May — so this isn’t a fly-by-night crew, it’s an evolving operation.

The messy irony, per Check Point and JUMPSEC analyses, is that VECT’s encryptor destroys any file larger than 128 KB rather than encrypting it — TeamPCP publicly denied ever using it and claimed their private CipherForce locker instead. Broken crypto or not, Sophos calls the alliance an “unprecedented model of industrialized ransomware deployment,” and they’re right. If you’re a fintech relying on open-source dependency scanners, this is the moment to invest in signed builds, SBOM verification, and hardened supply chain traceability — because your CI pipeline is now a ransomware ingress vector. Prediction: at least two more RaaS crews will announce formal partnerships with supply chain attack specialists before the end of 2026.

What Anubis’s Wiper Threat Says About Payment Pressure

One detail from Rubrik Zero Labs’ July 2025 report stands apart. Anubis pairs an 80% affiliate profit split with a /WIPEMODE module that reduces files to 0 KB regardless of ransom payment. Files stay in their directories — same names, same paths — but the contents are gone permanently. Ransomware.Live data cited in the reporting shows Anubis has claimed 91 victims total, with 11 in June 2026 alone, more than half in the U.S., across healthcare, business services, manufacturing, technology, and financial services.

This changes the negotiation math. Traditional ransomware creates a decryption call option: pay and maybe get your data back. A wiper switch destroys the option entirely and turns the ransom into a protection racket. Backups become the only real defense, and they have to be immutable, offline, and tested — not just “we have snapshots.”

FAQ

Q: What is Citrix Bleed 2 (CVE-2025-5777)? A: It’s a critical authentication bypass vulnerability, CVSS 9.3, affecting Citrix NetScaler ADC and Gateway appliances configured as Gateway or AAA virtual servers. Threat actors including Anubis ransomware affiliates are actively using it for initial access, according to Arctic Wolf.

Q: What does BYOVD mean and why is it dangerous? A: Bring Your Own Vulnerable Driver is a technique where attackers load a legitimately signed but vulnerable kernel driver onto a target system to gain kernel-level privileges. Expel reports The Gentlemen ransomware group used this to disable EDR products from Microsoft, ESET, Palo Alto Networks, and SentinelOne — even on fully patched Windows.

Q: How does the VECT and TeamPCP partnership change ransomware risk? A: The March 2026 partnership, documented by Sophos, lets VECT deploy ransomware across organizations that TeamPCP already compromised via the Trivy and LiteLLM supply chain attacks. It industrializes ransomware by separating credential harvesting from payload delivery, lowering the barrier for other crews to follow the same model.

Key Takeaways

• Treat every RMM tool in your environment as a potential C2 channel and build behavioral detections instead of relying on process-name allowlists.
• Patch Citrix NetScaler now if you haven’t, and audit VPN authentication logs for logins from hosting ASNs like AS20473 and AS55286 before assuming your perimeter is clean.
• Ship a driver allowlist policy — Microsoft’s blocklist is table stakes, not a strategy — and inventory kernel drivers from third-party vendors you don’t actively use.
• Assume any compromised dependency in your CI pipeline is a ransomware entry point and invest in SBOM verification and build signing accordingly.
• Immutable, offline, regularly tested backups are now the only reliable answer to wiper-equipped ransomware like Anubis; snapshot-only strategies will lose.