Citrus ransomware spreads through Group Policy and disables Defender
Original title: Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender
Stolen contractor VPN or RDP logins reach a domain controller; Sn00py encrypts user files with RSA-2048 and ChaCha20.
Securelist says a previously undocumented group, Citrus, uses stolen contractor credentials, then pushes Sn00py ransomware with a malicious Group Policy Object. The policy copies the payload to SYSVOL, schedules it, disables Volume Shadow Copy and Windows Defender, and enables WinRM. Encrypted files get a .citrus extension and a 72-hour note. The crew also uses mimikatz, Xray reverse tunnels, and AnyDesk.
Unconfirmed: Securelist infers large-language-model use from neat script comments and links Citrus to Toy Ghouls from similar tools, without confirmed shared infrastructure.
- The policy is named Kaspersky GPO and uses Import-GPO and New-GPLink.
- Sn00py is written in Go, skips domain controllers, and leaves system files alone.
- Entry uses contractor VPN or RDP logins; privilege attempts included CVE-2026-54121 and CVE-2020-1337.
- Xray opens reverse VLESS tunnels on port 443 that resemble visits to Yandex hosts.
- Securelist published the report on November 11, 2026.
Impact: domain-wide file encryption and disabled endpoint protection
- 1.Limit and review contractor access to VPNs and RDP.
- 2.Alert on new Group Policy Objects and gPLink changes.
- 3.Watch for unexpected Microsoft Defender and Volume Shadow Copy changes.
- ATT&CK
- T1484.001 Domain Policy ModificationT1562.001 Disable or Modify ToolsT1078 Valid AccountsT1003.001 LSASS MemoryT1572 Protocol Tunneling
- Vendors
- Microsoft
- Threat actors
- CitrusToy Ghouls
- Organizations
- KasperskySecurelist
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system | 7.8 | 14% | PoC ×2 | |
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 91.210.108.180 | address 91.210.109[.]118 Reported by Securelist IP address 91.210.108[.]180 Reported by Securelist Scheduled task KasperskyAgentInsta |
| ipv4 | 91.210.109.118 | scan) cf903e4a1629aa0582fd0363b5786676 fscan.exe IP address 91.210.109[.]118 Reported by Securelist IP address 91.210.108[.]180 Report |
| md5 | 17b29b6c9de80402a45e321bbe1168fa | er) e251df2d0b7c3682965efb4d2009a2f4 jhost.exe MD5 (Sn00py) 17b29b6c9de80402a45e321bbe1168fa build_64.exe MD5 (Sn00py) 9eee984b187423c46c10a63d080da15d |
| md5 | 7107fb029e7c63523e3aca5fc8e56b38 | center.exe, webex.exe, rpchost.exe MD5 (Meterpreter stager) 7107fb029e7c63523e3aca5fc8e56b38 2341.exe MD5 (Keylogger) e251df2d0b7c3682965efb4d2009a2f4 j |
| md5 | 9eee984b187423c46c10a63d080da15d | 17b29b6c9de80402a45e321bbe1168fa build_64.exe MD5 (Sn00py) 9eee984b187423c46c10a63d080da15d build_64.exe MD5 (fscan) cf903e4a1629aa0582fd0363b5786676 f |
| md5 | cf903e4a1629aa0582fd0363b5786676 | ) 9eee984b187423c46c10a63d080da15d build_64.exe MD5 (fscan) cf903e4a1629aa0582fd0363b5786676 fscan.exe IP address 91.210.109[.]118 Reported by Securelis |
| md5 | d631627131b90d576d77f4bf530e1abe | f compromise (IoCs):- Category Indicator Details MD5 (Xray) d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe MD5 (Meterp |
| md5 | e251df2d0b7c3682965efb4d2009a2f4 | ) 7107fb029e7c63523e3aca5fc8e56b38 2341.exe MD5 (Keylogger) e251df2d0b7c3682965efb4d2009a2f4 jhost.exe MD5 (Sn00py) 17b29b6c9de80402a45e321bbe1168fa bui |
From the original article
4 min read at cybersecuritynews.com
A new ransomware group called Citrus is using Windows Group Policy to push its malware across entire company networks and switch off Microsoft Defender first. Group Policy is a trusted Windows tool that admins use to manage many computers at once. Here, the attackers turn it into a delivery system.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.