CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce Ransomware

6+ org intrusions H1 2026 with identical 7-step IAB playbook. CVE-2025-5777 pre-auth memory leak harvests session tokens bypassing MFA. DragonForce ransomware in most advanced case under one hour from access. Mitigation: patch, terminate sessions, audit ScreenConnect/Zoho Assist, rogue admin accounts.