Citrus Ransomware Enters Through Contractor Logins, Then Pushes a Fake 'Kaspersky GPO' Domain-Wide to Kill Defender and Encrypt Everything With Sn00py

High · 2026-11-13 · By H.A

Researchers detail Citrus, a Russian-speaking ransomware group that abuses compromised contractor accounts, Certighost (CVE-2026-54121), VLESS tunnels and AI-written scripts before deploying Sn00py RaaS encryption through a malicious Group Policy Object.

Overview

Security researchers have documented Citrus, a Russian-speaking ransomware group that gets into corporate Windows networks through compromised contractor accounts. It then uses a malicious Group Policy Object, disguised as a security-vendor deployment, to switch off defences and encrypt the entire domain at once.

The report, published on 11 November 2026, describes a payload from the Sn00py ransomware-as-a-service family. It also finds clear traces of LLM-generated scripts in the intrusions, and tooling and victim overlaps with the Toy Ghouls group. So far all known victims are Russian companies. The techniques work against any Active Directory environment.

The Campaign

• Initial access: stolen contractor credentials used to log in to corporate VPNs or internet-facing RDP terminal servers. The contractor domain accounts had very limited privileges, so the operators' first goal was escalation.
• Escalation: CVE-2026-54121 ("Certighost"), a certificate-services flaw used to obtain a certificate that authenticates as a domain controller. Also the older CVE-2020-1337 and misconfigured 1C:Enterprise servers.
• Impact: Sn00py encryption of user files (not system files) across the domain, with the .citrus extension and a CITRUS_README.txt note that threatens to leak data unless the victim makes contact within 72 hours.

Researchers say decryption is not possible without the attackers' private key.

Timeline

The researchers did not publish dates for individual incidents. The report, dated 11 November 2026, covers multiple intrusions with the same tooling. They place Citrus near Toy Ghouls, a group already known for attacking Russian enterprises. The two share tooling such as 1C-Shell, mimikatz, PsExec and ADRecon stored in the same directories, but no infrastructure overlaps directly, and in some cases both groups had compromised the same systems at the same time.

Tradecraft

• Tunnelling: Xray sets up reverse VLESS tunnels over port 443, using REALITY to imitate traffic to popular Russian web properties, so C2 looks like ordinary HTTPS.
• Remote access: AnyDesk installed silently with a preset password, plus a Meterpreter stager.
• Execution: cmd, PowerShell, batch files and Impacket atexec scheduled tasks. Several scripts have LLM-style comments (for example # Disable account), which suggests AI help writing hands-on-keyboard tooling.
• Credential access: mimikatz, a modified keylogger, Snaffler for secrets on file shares, and theft of KeePass data from admin workstations.
• Discovery: fscan, ADRecon, SharpHound, LDAP queries against neighbouring domains, and net.exe.
• Lateral movement: SSH, WinRM and RDP, through the tunnels or directly.
• Defence impairment: wevtutil log clearing, AV exclusions, and abuse of central security management consoles.
• Deployment: self-extracting archives named KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe. These drop a GPO called "Kaspersky GPO" into SYSVOL and link it with Import-GPO and New-GPLink. The policy copies the ransomware to every machine, enables WinRM, disables Windows Defender and Volume Shadow Copy, sets a ransom wallpaper and runs the payload from a scheduled task. The ransomware config skips hosts named DC01–DC04 so the domain controllers keep pushing the policy.

The vendor-themed names are a disguise. Researchers stress that they do not stop that vendor's products from detecting the activity.

Indicators of Compromise

• C2 / exfiltration IPs: 91.210.109[.]118, 91.210.108[.]180
• MD5 (Sn00py): 17b29b6c9de80402a45e321bbe1168fa, 9eee984b187423c46c10a63d080da15d
• MD5 (Xray): d631627131b90d576d77f4bf530e1abe
• MD5 (Meterpreter stager): 7107fb029e7c63523e3aca5fc8e56b38
• MD5 (keylogger): e251df2d0b7c3682965efb4d2009a2f4
• MD5 (fscan): cf903e4a1629aa0582fd0363b5786676
• Paths: C:\ProgramData\WebEx\webex.exe, C:\ProgramData\oracle\java\jhost.exe, C:\ProgramData\x64\mimikatz.exe, C:\ProgramData\steal_tgs.ps1, C:\ProgramData\Kaspersky\KasperskyAgent.exe
• Scheduled tasks: Java, rpchost, agent, KasperskyAgentInstallTask, Sysvc
• Files: KasperskyGPO_Deploy_64*.exe, KasperskyAgentInstaller.exe, CITRUS_README.txt, *.citrus
• External IP lookup: 2ip[.]io

Detection

Domain-wide GPO deployment is the last chance to stop the attack. Monitor for new or changed GPOs and links:

# GPOs created or modified in the last 7 days
Get-GPO -All | Where-Object { $_.ModificationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object DisplayName, CreationTime, ModificationTime

# Scheduled tasks matching the reported names
Get-ScheduledTask | Where-Object { $_.TaskName -match '^(Java|rpchost|agent|Sysvc|KasperskyAgentInstallTask)$' }

Also alert on:

• Directory Service Changes (event 5136/5137) touching groupPolicyContainer objects.
• Security log clears (event 1102) and System log clears (event 104).
• Defender being disabled through policy, and the VSS service being set to disabled.
• Unusual certificate requests that name a domain controller as the subject.
• xray, AnyDesk or fscan appearing under C:\ProgramData.
• Contractor accounts logging in at odd hours or from new IP ranges.

Recommended Actions

• Lock down contractor access: require MFA for every VPN and RDP login, use time-limited accounts, restrict access to named systems, and review contractor sessions regularly.
• Remove direct internet exposure of RDP terminal servers.
• Patch certificate services against CVE-2026-54121 and audit AD CS templates and enrolment rights.
• Harden 1C:Enterprise servers and remove default or shared credentials.
• Limit who can create and link GPOs, and alert on any change by an unexpected account.
• Keep offline, immutable backups. VSS snapshots will be destroyed.
• Block outbound traffic from servers to unknown hosts on 443 where possible, and inspect long-lived TLS sessions with unusual fingerprints.

Analyst Assessment

Citrus is not technically new. Contractor entry, AD CS abuse and GPO-based mass deployment are well-known ransomware steps. What stands out is how efficiently a small team chains commodity tools, a RaaS payload and AI-written glue scripts together. The low-privilege contractor account is the weak link. Organisations that give third parties broad network access over VPN or RDP should assume those credentials are being sold and traded, and limit their reach accordingly.