Hari 
A previously undocumented extortion group tracked as Citrus is chaining contractor account compromise, Active Directory certificate abuse, and VLESS-based tunneling to deploy Sn00py ransomware.
Kaspersky researchers report that the operators also use large language models to produce reconnaissance scripts and administrative commands, which marks a shift in how mid-tier crews build their intrusion tooling.
Initial access comes through compromised contractors. Attackers reuse stolen employee credentials to authenticate to corporate VPN gateways or to RDP services exposed on terminal servers.
Citrus Ransomware
Execution relies on cmd.exe and PowerShell, with Impacket’s atexec module creating scheduled tasks for remote command execution. The scripts carry verbose inline comments typical of LLM-generated payloads, including a session enumeration routine and commands that disable administrator accounts.
Because contractor accounts hold minimal rights, Citrus escalates through AD CS abuse. The operators exploit the authentication bypass CVE-2026-54121, known as Certighost, to request a Machine-template certificate with a forged SubjectAlternativeName pointing at a domain controller.
The cdc attribute redirects the certification authority to an attacker-controlled host that returns spoofed validation data. Failed attempts leave machine accounts named GHOST followed by eight random letters.
The group also deployed a CVE-2020-1337 privilege escalation exploit through a Metasploit-linked loader and targeted misconfigured 1C:Enterprise servers via external 1C-Shell data processors.
Credential access involves mimikatz staged in C:\ProgramData\x64, a modified peeping-tom keylogger masquerading as jhost.exe, and Snaffler sweeps of SMB shares for SSH keys and tokens. Discovery uses fscan against ports 135, 139, 1433 and 8006, followed by ADRecon and SharpHound for Active Directory graphing.
Before encryption, a script named steal_tgs.ps1 archived Telegram Desktop tdata directories with 7-Zip for exfiltration through Chrome. Defense impairment includes wevtutil log clearing, antivirus exclusions, and mass disabling through centralized security consoles.
The command-and-control design is the group’s most distinctive element. Citrus pulls Xray down through certutil, BITS and cURL, then builds reverse VLESS tunnels over port 443 with REALITY settings that mimic TLS handshakes to mirror.yandex.ru and yastatic.net.
This approach to covert command-and-control channels defeats simple SNI and destination reputation filtering. AnyDesk, installed silently with the –silent flag, provides a secondary remote access path.
Impact relies on Sn00py, a Go-based RaaS payload that encrypts user files with RSA-2048 and ChaCha20 and appends the .citrus extension. Deployment runs through a malicious Group Policy Object, disguised under Kaspersky-themed names such as KasperskyGPO_Deploy_64.exe, which copies the payload to SYSVOL.
The policy also creates a scheduled task, enables WinRM, stops Volume Shadow Copy, and disables Defender. A host_blacklist excludes DC01 through DC04 so policy propagation continues uninterrupted.
This mirrors the staging discipline seen in Settra ransomware intrusions. Kaspersky also notes overlaps with the Toy Ghouls group in tooling and directory paths, with both targeting Russian organizations.
Defenders should restrict contractor VPN scope, audit AD CS certificate templates, monitor SYSVOL writes and GPO creation, and alert on Xray binaries and anomalous outbound REALITY handshakes.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
