A cybersecurity firm tracking threat actors this week published findings that an initial access broker had weaponised a critical vulnerability in Citrix — dubbed CitrixBleed2 — across a series of attacks during the first half of 2026. The attacks followed a now-familiar pattern: exploit an unpatched internet-facing system, establish persistent access, then sell that access to ransomware groups on criminal marketplaces before the victim organisation has any idea anyone is inside their network.
This is not a sophisticated nation-state attack. It is a commercial transaction. And NZ businesses running unpatched Citrix — or any unpatched internet-facing systems — are inventory in that marketplace.
What Is an Initial Access Broker?
An initial access broker (IAB) is a threat actor whose entire business model is gaining unauthorised access to organisations and selling that access to other criminal groups. They do not deploy ransomware themselves. They do not steal data themselves. They find the unlocked door, step inside, confirm the access is real, and list it for sale.
Prices vary depending on what was accessed. A domain admin credential for a mid-size company sells for hundreds to low thousands of dollars. A foothold inside a large enterprise with confirmed access to financial systems can fetch tens of thousands. The buyers are ransomware-as-a-service affiliates who want to skip the hard part — getting in — and go straight to deploying their payload.
The CitrixBleed2 campaign followed this model precisely. The IAB identified organisations running vulnerable Citrix instances, exploited the flaw to gain session tokens (allowing them to bypass authentication entirely), established persistence, verified the access, and moved on. The actual ransomware deployment happened later, by different actors who bought the access.
What Is CitrixBleed2?
CitrixBleed2 is a critical vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Like its predecessor CitrixBleed (CVE-2023-4966), it allows unauthenticated attackers to retrieve session tokens from memory — effectively stealing active authenticated sessions without needing a username or password.
The practical impact: an attacker can hijack the session of a legitimate user who is already logged in, including a domain administrator, and inherit their full access. MFA does not protect against this because the session was already authenticated before it was stolen.
Citrix released patches. Organisations that applied them are not vulnerable. Organisations that did not apply them — or that patched the application but failed to terminate existing sessions, as happened widely during the original CitrixBleed response — remain at risk.
Why Unpatched Systems Are Inventory
The economics of initial access brokering explain why unpatched internet-facing systems are such a reliable target. Vulnerability scanning tools used by IABs can identify every internet-exposed Citrix instance in a country in minutes. NZ is a small market — but small markets are not invisible, and Shodan-style scanning does not respect geography.
Once a vulnerable instance is identified, exploitation is largely automated. The IAB invests minimal time per target. Even if only a fraction of scanned targets are exploitable, at scale the yield is sufficient to sustain a profitable operation.
This is why CERT NZ consistently emphasises patching internet-facing systems within 48 hours of a critical patch being released. The window between patch release and active exploitation has shortened dramatically. In several major vulnerability campaigns in 2025 and 2026, exploitation began within hours of public disclosure.
The Three-Stage Attack Chain You Need to Understand
Understanding how these attacks work helps explain why basic controls — patching, MFA, network segmentation — matter as much as they do.
Stage 1: Initial access. The IAB exploits a vulnerability in an internet-facing system — in this case, Citrix — and gains a foothold. At this point, most organisations have no indication anything has happened. There is no phishing email. No employee made a mistake. A software vulnerability was exploited by an automated tool.
Stage 2: Persistence and reconnaissance. The attacker establishes persistence so their access survives reboots and patches. They conduct internal reconnaissance to understand what they have accessed — what network segments are reachable, what credentials are available, whether domain admin access can be obtained. This stage can last days to weeks.
Stage 3: Sale and handoff. The IAB sells the access. The buyer — often a ransomware affiliate — uses the established foothold to deploy their payload. By the time ransomware is detonated, the original IAB has moved on to the next target. The victim organisation experiences the attack as a ransomware incident with no obvious entry point because the initial access happened weeks earlier.
See our guide to the first 24 hours of a ransomware attack for what happens after access is sold.
What NZ Businesses Should Do Now
- Audit your internet-facing systems. If you are running Citrix NetScaler ADC or NetScaler Gateway, confirm your patch version against Citrix's security bulletins and apply any outstanding updates immediately.
- Terminate all active sessions after patching. This was the gap in many organisations' CitrixBleed response. Patching prevents new exploitation but does not invalidate sessions already stolen. Force a full session termination after applying the patch.
- Check for indicators of compromise. If you have been running a vulnerable version, assume you may already have been accessed. Review authentication logs for anomalous session activity in the period your instance was exposed.
- Apply a 48-hour patching SLA for critical vulnerabilities on internet-facing systems. This is the CERT NZ recommendation and it reflects where the real risk sits. Internal systems matter too, but internet-facing systems are the entry point.
- Segment your network so initial access does not mean full access. The damage from an IAB foothold is amplified when an attacker can move laterally from a compromised Citrix instance to domain controllers and backup systems. Network segmentation limits the blast radius.
Start building a security-aware workforce with SecureAZ