Citrus ransomware targets Russian firms with HTTPS-like VLESS tunnels
Original title: New Citrus Ransomware Hides Malicious Traffic as HTTPS to Evade Corporate Network Security
Operators use stolen contractor credentials, Certighost, and Sn00py encryption, and Kaspersky says decryption is not currently possible.
Kaspersky describes Citrus, a previously undocumented ransomware operation against Russian companies. Access starts with compromised contractors and stolen VPN or RDP credentials, followed by privilege escalation aimed at CVE-2026-54121 in Active Directory Certificate Services. Operators tunnel over port 443 with VLESS REALITY, deploy AnyDesk, and encrypt files with the Go-based Sn00py payload, appending .citrus. The group shares tools and targeting with Toy Ghouls, but their infrastructure does not directly overlap.
Unconfirmed: Kaspersky infers LLM assistance from comments; shared tooling does not prove Citrus and Toy Ghouls are the same group.
- Microsoft patched CVE-2026-54121, nicknamed Certighost, on July 14, 2026.
- One intrusion also used a Metasploit-linked exploit for CVE-2020-1337.
- VLESS REALITY traffic is disguised as requests to mirror.yandex.ru and yastatic.net.
- Sn00py uses RSA-2048 and ChaCha20 and drops CITRUS_README.txt.
- A host blacklist excludes DC01 through DC04 so the spreading GPO continues.
Impact: domain compromise, file encryption, and threatened data leaks
| Product | Affected |
|---|---|
| Microsoft Active Directory Certificate Services | — |
| Microsoft Print Spooler | — |
- 1.Patch every Enterprise CA for CVE-2026-54121 and enable AD CS auditing.
- 2.Require 1C authentication, ban empty passwords, and limit external processors.
- 3.Monitor unexpected Xray or AnyDesk binaries and mismatched port 443 sessions.
- ATT&CK
- T1078 Valid AccountsT1021.001 Remote Desktop ProtocolT1068 Exploitation for Privilege EscalationT1572 Protocol TunnelingT1486 Data Encrypted for Impact
- Vendors
- Microsoft
- Threat actors
- CitrusToy Ghouls
- Organizations
- Kaspersky
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system | 7.8 | 14% | PoC ×2 | |
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 7107fb029e7c63523e3aca5fc8e56b38 | , sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.e |
| md5 | d631627131b90d576d77f4bf530e1abe | imed destination. Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter |
| md5 | e251df2d0b7c3682965efb4d2009a2f4 | stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Note: IP addresses and domains are intentionally |
From the original article
3 min read at gbhackers.com
A previously undocumented group called Citrus Ransomware is combining VLESS tunnels that mimic ordinary HTTPS, the Sn00py ransomware-as-a-service Trojan, and large language model (LLM) assistance to compromise Russian companies. Citrus gains access through compromised contractors. It uses stolen employee credentials to reach corporate VPNs or internet-facing terminal servers over RDP.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.