Citrus ransomware crew pairs LLM-generated tooling with VLESS tunnels

Security researchers have documented a previously unknown ransomware group, dubbed Citrus, whose playbook combines stolen contractor credentials, LLM-generated attack scripts, VLESS tunnels disguised as ordinary HTTPS traffic, and encryption by a Sn00py-family ransomware Trojan. Kaspersky's Securelist team published the analysis after investigating recent incidents at Russian companies.

The detail that stands out is not the ransomware itself but the workflow around it. Attackers ran PowerShell commands and batch files that, judging by their structure, were written by large language models. In one case the generated commands disabled an administrator's account. In another, a full script enumerated active user sessions across domain systems, complete with threaded task limits and comments of the kind LLMs typically produce.

Plainly put: this crew lets a language model write its intrusion code.

How does Citrus get in?

Initial access comes through compromised contractors. The attackers steal credentials from contractor employees and use them to connect to corporate VPNs or internet-facing terminal servers over RDP. In every case Kaspersky examined, those contractor domain accounts held very limited privileges, forcing the group to escalate.

Their main escalation path is CVE-2026-54121 (Certighost), an authentication bypass. Exploitation attempts leave a clear fingerprint in Active Directory: machine accounts with names such as GHOSTAUFTAFGS, GHOSTCZYQVAZS and GHOSTIVPRLDZA — always "GHOST" followed by eight random letters, matching exploit scripts published on GitHub.

The exploit works by requesting a certificate based on the Machine template from the AD CS role holder, with a SubjectAlternativeName pointing at the domain controller. A forged attribute (cdc) tells the certification authority to verify data against an attacker-controlled host, 91.210.109[.]118. If the CA complies, the attackers can authenticate as the domain controller itself.

The group also uploads a persistence executable, likely a Metasploit component — PowerShell logs show an MSFConsole value — used to run scripts exploiting CVE-2020-1337. Insecure 1C:Enterprise configurations, plus the elevated AD privileges that support staff often hold on those servers, round out the escalation options.

The takeaway: low-privilege contractor accounts plus unpatched AD CS equal domain compromise.

How do they stay hidden?

Stealth comes from masquerading. Tools and auxiliary objects get legitimate-looking names:

• KasperskyGPO_Deploy_64.exe — self-extracting archive holding the deployment script and a malicious Group Policy Object
• KasperskyAgentInstaller.exe, KasperskyAgent.exe, agent.exe — self-extracting archives containing the ransomware
• KasperskyAgentInstallTask and Sysvc — scheduled task names that launch the ransomware archives
• "Kaspersky GPO" — the Group Policy Object distributing the ransomware fleet-wide

Borrowing a security vendor's name buys nothing here. Kaspersky notes its products detect and block these files regardless of the label.

Defense impairment is systematic. The attackers clear event logs with wevtutil, disable antivirus on individual hosts to run mimikatz, seize centralized security-management consoles to switch off protection en masse, and use a GPO that edits Windows Defender's registry settings so the antivirus stays silent when the ransomware fires.

Credential harvesting spans three methods: mimikatz memory dumps from C:\ProgramData\x64, a modified "peeping-tom" keylogger masquerading as C:\ProgramData\Oracle\Java\jhost.exe with logs beamed to 91.210.109[.]118, and Snaffler sweeping network shares for SSH keys and access tokens. Password-manager databases, including KeePass stores on administrator workstations, were also in scope.

What does the tunneling look like?

For command and control, Citrus downloads the Xray proxy onto victim hosts using built-in utilities — certutil, Windows BITS, cURL and PowerShell — then builds reverse VLESS tunnels to its server over port 443, blending with legitimate HTTPS. The REALITY protocol settings inside config.json disguise the traffic as requests to mirror.yandex.ru and yastatic.net. In some incidents the configuration file was deleted immediately after the tunnel started. AnyDesk, installed silently with a set connection password, provided hands-on remote control.

What happens at impact?

The Sn00py ransomware, written in Go, encrypts user files — not system files — with RSA-2048 and ChaCha20, appending the .citrus extension. Recovery without the attackers' private key is currently impossible. Its console outputs the string "Made with RaaS platform Sn00py," pointing to a ransomware-as-a-service subscription.

A configuration blacklist exempts domain controllers DC01 through DC04 from encryption. That keeps the malicious GPO propagating the ransomware running uninterrupted. The policy drops the ransomware to SYSVOL, schedules it with /quiet /norestart, enables WinRM, disables Volume Shadow Copy and Defender, and sets a ransom-note wallpaper. Victims get 72 hours to make contact via Proton Mail or Telegram before threatened publication of dumps, employee personal data, accounting, contracts and source code.

Before encryption, the attackers ran steal_tgs.ps1 on a domain controller, using 7-Zip to archive Telegram Desktop tdata directories — authorization keys and session data — from reachable systems, uploading them through Chrome.

Who is behind it?

Kaspersky sees strong overlap with Toy Ghouls: shared tooling (1C-Shell, mimikatz, PsExec, ADRecon), identical tool directories, a Russian-speaking profile, targets limited to Russian companies, and several incidents where both groups hit the same infrastructure simultaneously.

The countermeasure is unglamorous but decisive: strictly limit and monitor contractor access to your network — that is the door Citrus walks through.