"We`re going to do something special today :). Made with RaaS platform Sn00py." — string observed in the ransomware's console output.
Initial access through compromised contractors
Citrus gains entry to target networks by abusing credentials stolen from contractors. The attackers used contractor employee credentials to connect to corporate VPNs or to internet-facing terminal servers over RDP. When 1C:Enterprise servers were reachable, Citrus executed commands through external data processors (1C‑Shell) to advance access.
Execution: LLM-generated artifacts, PowerShell, and Impacket
The group blends human tooling with LLM-generated content. Analysts found command fragments and full scripts that include natural-language comments — for example: "# Disable account # Verify result" and script lines such as "Creating background tasks for each computer with a thread limit" and "Concurrent task limit control" — evidence the attackers used LLMs to produce operational commands and scripts. Citrus also used atexec from the Impacket collection to create scheduled tasks; recovered task entries show launched executables like C:\Windows\System32\..\System32\cmd.exe and C:\Windows\system32\cmd.exe. Group Policy was refreshed after those tasks ran, indicating the tasks likely executed gpupdate /force.
For privilege escalation the group repeatedly attempted exploitation of CVE-2026-54121 (Certighost). Attempts created machine accounts named with a GHOST prefix (for example, GHOSTAUFTAFGS, GHOSTCZYQVAZS), and used a published exploit to request certificates from an Active Directory Certification Authority by specifying a cdc attribute pointing at an attacker-controlled host (91.210.109[.]118). In at least one case the attackers uploaded an executable that carried metadata suggesting Metasploit usage and ran a CVE-2020-1337 exploit found in the Metasploit repository.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCommand-and-control tunneling with Xray and VLESS
Citrus delivered Xray to victims using built-in OS utilities — certutil, the Windows BITS background service, cURL, and PowerShell — then used Xray to create reverse VLESS tunnels. Configuration files named config.json were frequently deleted after tunnel startup to hide evidence. The recovered configuration files show the group used port 443 on the VLESS server to blend with HTTPS traffic and included REALITY protocol blocks that disguised traffic as legitimate requests to mirror.yandex.ru and yastatic.net. The group also installed AnyDesk with a --silent flag, set a connection password, and extracted the infected machine’s AnyDesk ID from the client configuration for remote control.
Credential theft, lateral movement, and data collection
Citrus used multiple credential-harvest techniques. They ran a modified peeping‑tom keylogger with binaries and logs at C:\ProgramData\Oracle\Java\jhost.exe and C:\Users\\AppData\Roaming\Microsoft\CLR\ErrorLog.txt, with stolen data observed sent to 91.210.109[.]118. Memory-dumping was performed with mimikatz (files found at C:\ProgramData\x64\mimikatz.exe and related DLLs). To hunt for secrets on network shares and workstations they used Snaffler and dropped configuration files to facilitate its use; they also searched password managers such as KeePass on administrator workstations.
For discovery they ran local commands (whoami, tasklist, quser, ipconfig, curl 2ip[.]io), used the fscan scanner to enumerate internal services and ports (notably 135, 139, 1433, 8006), and executed ADRecon on domain controllers and SharpHound from a workstation. Lateral movement employed standard administration protocols: SSH, WinRM, and RDP — either through tunnels or directly from compromised hosts.
Shortly before encryption, the attackers ran steal_tgs.ps1 on a domain controller and created a tdatas directory. NTFS USN journal entries show 7‑Zip archives named like <system_name>_<date>_<username>_tdata.zip, consistent with harvesting Telegram Desktop session data (tdata) and exfiltrating it via Google Chrome to an external web service.
Impact: Sn00py ransomware, malicious GPOs, and defense impairment
Citrus deployed Sn00py-family ransomware — written in Go and configured to use RSA‑2048 and ChaCha20 to encrypt user files (not system files). Encrypted files get the .citrus extension and, as recovered, the ransomware contained the group's public key in its configuration. The configuration also included a host_blacklist that exempted domain controllers named DC01–DC04 so the malicious Group Policy distribution continued to propagate.
The ransomware drops CITRUS_README.txt ransom notes containing a demand to contact the group within 72 hours (the note instructs victims to register an account and email the attackers, and to use VPNs and particular channels). The group distributed the Trojan via self‑extracting archives that create a malicious Group Policy Object — the GPO copies the archive to SYSVOL, creates a scheduled task to run the archive (/quiet /norestart), enables WinRM, disables Volume Shadow Copy service and Windows Defender, and sets a ransom-note wallpaper.
To impede response, Citrus cleared logs with wevtutil, disabled antivirus protections and centralized security-management consoles where possible, and added exclusions to antivirus lists. The analysis notes Kaspersky solutions detect all the activity described and that Kaspersky binaries and GPO names were impersonated in file names (for example, KasperskyGPO_Deploy_64.exe and KasperskyAgent.exe), but that the impersonation did not prevent detection.
What this means for technologists, procurement leaders, and IT defenders
- Technologists and security teams should monitor for Xray binaries and config.json alongside VLESS/REALITY indicators, the specific scheduled‑task names (Java, rpchost, agent, KasperskyAgentInstallTask, Sysvc), and the listed file paths such as C:\ProgramData\xray.exe and C:\ProgramData\x64\mimikatz.exe.
- Procurement and contractor managers must restrict and monitor contractor account privileges: Citrus repeatedly used compromised contractor credentials for initial access and then attempted escalation (including CVE‑2026‑54121 exploitation), making tight controls on contractor VPN/RDP access and certificate-issuance monitoring essential.
- IT defenders should watch for creation of machine accounts named with a GHOST prefix, unexpected certificate requests referencing external cdc addresses (for example, 91.210.109[.]118), and the tdatas/7‑Zip archive pattern indicating messaging‑app data harvesting prior to encryption.
Citrus combines familiar tools with two modern twists: tunneling that deliberately mimics HTTPS via VLESS/REALITY and auxiliary content generated by LLMs. The combination has produced detectable artifacts — specific task names, file locations, IP addresses (91.210.109[.]118 and 91.210.108[.]180), and file hashes (for example, the Sn00py sample 17b29b6c9de80402a45e321bbe1168fa) — that defenders can hunt for even as the group continues to evolve. Kaspersky said it will continue to track the group and report new techniques as discovered.
