Citrus ransomware hits firms via stolen contractor logins and GPO
November 12: Cyber Security News details the Kaspersky GPO that deploys Sn00py from SYSVOL, disables Defender and shadow copies, enables WinRM, and leaves a 72-hour note.
Kaspersky says new Citrus ransomware encrypts company networks after stolen contractor logins, and decryption is not currently possible.
Kaspersky describes Citrus, a previously undocumented ransomware operation, including against Russian companies. Attackers use stolen contractor VPN or RDP credentials, then PowerShell, Impacket, scheduled tasks, and scripts Kaspersky says look LLM-generated. They tried CVE-2026-54121, nicknamed Certighost and patched by Microsoft on July 14, 2026, to obtain domain-controller certificates; one case also used a Metasploit-linked exploit for CVE-2020-1337. A malicious Group Policy Object copies the Go-based Sn00py payload to SYSVOL, schedules it, disables Volume Shadow Copy and Windows Defender, and enables WinRM. Sn00py uses RSA-2048 and ChaCha20, appends .citrus, and leaves a 72-hour note. Kaspersky says decryption is not currently possible.
- Entry uses stolen contractor VPN or RDP credentials.
- Certighost is CVE-2026-54121; Microsoft patched it on July 14, 2026.
- One case used a Metasploit-linked exploit for CVE-2020-1337.
- Sn00py is Go-based, uses RSA-2048 and ChaCha20, and skips domain controllers.
- The Kaspersky GPO policy disables Defender and Volume Shadow Copy and enables WinRM.
- GBHackers says tools and targeting overlap Toy Ghouls without shared infrastructure.
Timeline
dated events in the reporting · oldest first- Jul 14, 2026Microsoft patched CVE-2026-54121, nicknamed Certighost. · GBHackers
- Nov 11, 2026Securelist published its Citrus ransomware report. · Cyber Security News
What each outlet adds
beyond the shared facts- Kaspersky SecurelistLLM-like scripts, GHOST machine accounts, and 1C:Enterprise commands.
- GBHackersRussian victims, no decryption, and Toy Ghouls tool overlap.
- Cyber Security NewsGPO disables Defender and shadow copies, enables WinRM, 72-hour note.
- Vendors
- Microsoft
- Threat actors
- CitrusToy Ghouls
- Organizations
- KasperskySecurelist
- Countries
- Russia
Coverage
oldest first · one row per article · UTC- · 1d ago
Kaspersky SecurelistFirst report
Citrus ransomware uses VLESS, Sn00py, and LLM-written attack scripts
Kaspersky says the new group enters via contractor VPN or RDP logins, then tries Certighost and an old print-spooler bug.
- · 20h ago
GBHackers
Citrus ransomware targets Russian firms with HTTPS-like VLESS tunnels
Operators use stolen contractor credentials, Certighost, and Sn00py encryption, and Kaspersky says decryption is not currently possible.
- · 18h ago
Cyber Security News
Citrus ransomware spreads through Group Policy and disables Defender
Stolen contractor VPN or RDP logins reach a domain controller; Sn00py encrypts user files with RSA-2048 and ChaCha20.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system | 7.8 | 14% | PoC ×2 | |
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | PoC ×4 |