Citrus Ransomware Enters Through Contractor Logins, Then Pushes a Fake 'Kaspersky GPO' Domain-Wide to Kill Defender and Encrypt Everything With Sn00py

High · 2026-11-13 · By H.A

Citrus Ransomware Enters Through Contractor Logins, Then Pushes a Fake 'Kaspersky GPO' Domain-Wide to Kill Defender and Encrypt Everything With Sn00py

Researchers detail Citrus, a Russian-speaking ransomware group that abuses compromised contractor accounts, Certighost (CVE-2026-54121), VLESS tunnels and AI-written scripts before deploying Sn00py RaaS encryption through a malicious Group Policy Object.

Overview

Security researchers have documented Citrus, a Russian-speaking ransomware group that gets into corporate Windows networks through compromised contractor accounts. It then uses a malicious Group Policy Object, disguised as a security-vendor deployment, to switch off defences and encrypt the entire domain at once.

The report, published on 11 November 2026, describes a payload from the Sn00py ransomware-as-a-service family. It also finds clear traces of LLM-generated scripts in the intrusions, and tooling and victim overlaps with the Toy Ghouls group. So far all known victims are Russian companies. The techniques work against any Active Directory environment.

The Campaign

Researchers say decryption is not possible without the attackers' private key.

Timeline

The researchers did not publish dates for individual incidents. The report, dated 11 November 2026, covers multiple intrusions with the same tooling. They place Citrus near Toy Ghouls, a group already known for attacking Russian enterprises. The two share tooling such as 1C-Shell, mimikatz, PsExec and ADRecon stored in the same directories, but no infrastructure overlaps directly, and in some cases both groups had compromised the same systems at the same time.

Tradecraft

The vendor-themed names are a disguise. Researchers stress that they do not stop that vendor's products from detecting the activity.

Indicators of Compromise

Detection

Domain-wide GPO deployment is the last chance to stop the attack. Monitor for new or changed GPOs and links:

# GPOs created or modified in the last 7 days
Get-GPO -All | Where-Object { $_.ModificationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object DisplayName, CreationTime, ModificationTime

# Scheduled tasks matching the reported names
Get-ScheduledTask | Where-Object { $_.TaskName -match '^(Java|rpchost|agent|Sysvc|KasperskyAgentInstallTask)$' }

Also alert on:

Recommended Actions

Analyst Assessment

Citrus is not technically new. Contractor entry, AD CS abuse and GPO-based mass deployment are well-known ransomware steps. What stands out is how efficiently a small team chains commodity tools, a RaaS payload and AI-written glue scripts together. The low-privilege contractor account is the weak link. Organisations that give third parties broad network access over VPN or RDP should assume those credentials are being sold and traded, and limit their reach accordingly.

REEF SENTINEL