Citrus ransomware spreads through Group Policy and disables Defender
Stolen contractor VPN or RDP logins reach a domain controller; Sn00py encrypts user files with RSA-2048 and ChaCha20.
68
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 12, 2026
- Last mentioned18h ago
Timeline
2 articles · newest firstCitrus ransomware targets Russian firms with HTTPS-like VLESS tunnels
Operators use stolen contractor credentials, Certighost, and Sn00py encryption, and Kaspersky says decryption is not currently possible.
64
Related CVEs
by mentions- CVE-2026-541212%8.8Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network
- CVE-2020-133714%7.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system
Appears with
- Citrusthreat actor · 2
- Microsoftvendor · 2
- Toy Ghoulsthreat actor · 2
- Sn00pymalware · 2
- mimikatzmalware · 2
- 1C:Enterpriseproduct · 2
- Kasperskyorganization · 2
- Active Directory Certificate Servicesproduct · 1
- Securelistorganization · 1
- Microsoft Defenderproduct · 1
- AnyDeskmalware · 1
- Print Spoolerproduct · 1
- Snafflermalware · 1
- Windowsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.