Citrus ransomware uses VLESS, Sn00py, and LLM-written attack scripts
Original title: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
Kaspersky says the new group enters via contractor VPN or RDP logins, then tries Certighost and an old print-spooler bug.
Kaspersky describes Citrus, a previously undocumented ransomware group, in recent incidents. Attackers use stolen contractor credentials for corporate VPNs or RDP, then PowerShell, Impacket atexec, scheduled tasks, and scripts the firm says look LLM-generated. They tried CVE-2026-54121 (Certighost) to obtain domain-controller certificates and, in one case, ran a Metasploit exploit for CVE-2020-1337. Encryption is attributed to a Sn00py-family Trojan, with VLESS tunnels hiding traffic as HTTPS.
Unconfirmed: Kaspersky infers LLM use from commented commands; it did not see the exact scheduled-task payloads and says they most likely ran gpupdate.
- Initial access used credentials stolen from contractors’ employees.
- Certighost attempts created AD machine accounts named GHOST plus eight letters.
- A controlled host at 91.210.109[.]118 was set as the certificate cdc contact.
- Tools were renamed to look like Kaspersky GPO deployers, then deleted.
- On 1C:Enterprise servers the group ran commands through 1C-Shell processors.
Impact: Domain-controller impersonation and later ransomware encryption
| Product | Affected |
|---|---|
| Certighost | — |
| Microsoft Windows | — |
- 1.Hunt Active Directory for machine accounts named GHOST plus random letters.
- 2.Review contractor VPN and RDP accounts used for initial access.
- 3.Look for scheduled tasks and files masquerading as Kaspersky GPO deployers.
- ATT&CK
- T1078 Valid AccountsT1021.001 Remote Desktop ProtocolT1059.001 PowerShellT1053.005 Scheduled TaskT1486 Data Encrypted for Impact
- Products
- 1C:Enterprise
- Threat actors
- Citrus
- Malware
- Sn00py
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system | 7.8 | 14% | PoC ×2 | |
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | yastatic.net | was also disguised as requests to another legitimate site, yastatic.net: Installing AnyDesk The PowerShell command above AnyDesk, w |
| ipv4 | 91.210.109.118 | specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, |
| md5 | 17b29b6c9de80402a45e321bbe1168fa | Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe |
| md5 | 7107fb029e7c63523e3aca5fc8e56b38 | , sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.e |
| md5 | 9eee984b187423c46c10a63d080da15d | st.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.e |
| md5 | cf903e4a1629aa0582fd0363b5786676 | _64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.exe File… |
| md5 | d631627131b90d576d77f4bf530e1abe | we discover them. Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter |
| md5 | e251df2d0b7c3682965efb4d2009a2f4 | stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64. |
From the original article
12 min read at securelist.com
We break down the Citrus Ransomware group's attacks: the attackers' TTPs and tooling, including VLESS traffic tunneling and LLM use, plus their links to Toy Ghouls.
By Stanislav Larinsky, Vladislav Vlasov, Boris Trefilov · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.