Citrus Ransomware Tactics: From Contractor Access to Encryption

Citrus ransomware is the name Kaspersky gives to a newly documented intrusion group and its use of Sn00py-family encryption. The group enters through compromised contractor accounts, crosses a corporate network, and uses Group Policy to spread the encryptor. Its distinctive features are Xray VLESS tunnels and scripts that Kaspersky assesses were probably assisted by large language models.

Those features do not replace the familiar access problem. An account with limited contractor privileges can still reach a VPN or exposed RDP server. Citrus then looks for ways to gain broader rights, disable protection, collect data, and launch encryption across Windows systems.

How Does the Citrus Ransomware Attack Chain Work?

Kaspersky reports that the attackers used credentials stolen from contractor employees to enter through corporate VPNs or internet-facing terminal servers. The contractor accounts initially had limited domain privileges in the cases Kaspersky knew. The group then attempted privilege escalation and explored systems reachable from that foothold.

Researchers observed attempts to exploit CVE-2026-54121, an authentication bypass affecting Active Directory Certificate Services. Kaspersky also described interest in insecurely configured 1C:Enterprise servers, whose administrators may hold elevated domain rights. These are separate escalation routes; a defender should not assume both occurred in every intrusion.

1. Stolen contractor accountContractorVPN or RDP access
2. Limited footholdInternal networkPrivilege escalation attempts
3. Domain administrationDomain controlMalicious Group Policy
4. Sn00py encryptionWindows hosts

The diagram condenses stages across Kaspersky’s observed cases, not a guaranteed sequence for each affected organization. Once inside, Citrus used PowerShell and Windows command tools for execution. It also used scheduled tasks for persistence, although Kaspersky says some long-running systems received tools without persistent installation.

Why Do VLESS Tunnels Matter to Defenders?

Kaspersky found that Citrus downloaded Xray and configured reverse VLESS tunnels to its command-and-control infrastructure. Recovered configurations used port 443 and REALITY settings intended to make the traffic resemble visits to legitimate websites. The group sometimes deleted the local configuration after the tunnel started, which can remove an obvious artifact.

The practical issue is sustained remote access hidden inside ordinary-looking encrypted traffic. A firewall rule that permits outbound HTTPS does not establish that each connection is benign. Review unexpected long-lived connections from terminal servers and administrative hosts, then correlate them with process launches and new remote access software.

Kaspersky also observed AnyDesk installed for remote control. Citrus used SSH, RDP, and WinRM to move between systems. Our command-and-control explainer describes why the control channel and the initial access path need separate checks.

What Does the LLM Evidence Actually Show?

Kaspersky found command and script comments that it considered atypical for attackers to write manually. The researchers assessed that these comments very likely indicate LLM assistance. They also reported scripts with the commenting style of generated output, including a script used to enumerate active user sessions.

This is an assessment about how auxiliary commands and scripts were prepared. It does not prove that an LLM selected targets, ran the intrusion, or controlled the ransomware. The observed behavior still requires valid access, privilege escalation, remote administration, and deployment across the domain.

For defenders, the difference matters because an AI label is not a detection rule. Alert on the resulting actions, such as unusual scheduled tasks, account changes, and wide user-session enumeration. Preserve the scripts and their execution context when investigating, but do not classify a script as malicious solely because its comments look generated.

What Happens Before Sn00py Encrypts Files?

Kaspersky says Citrus searched accessible shares for credentials and secrets, used a keylogger, and examined password-manager data on administrator workstations. Shortly before encryption, researchers observed a script that gathered messaging-app data from reachable systems. Kaspersky inferred the type of data from archive naming and the application directory involved; the report does not establish the contents of every archive.

The group also tried to reduce the chance of interruption. Kaspersky saw event-log clearing, antivirus disabling, and attempts to use centralized security management consoles against protection. Its Group Policy package also disabled Windows Defender and the Volume Shadow Copy service before launching the ransomware.

Sn00py is a Go-based Windows encryptor that Kaspersky says uses RSA-2048 and ChaCha20 on user files. The malicious policy distributes and launches it across hosts, while selected domain controllers are excluded from encryption. That exclusion helps the policy keep propagating. The ransom note threatens disclosure of stolen data, adding an extortion claim to the file-encryption impact.

Brandefense Blackhole counted 77 Citrus-related dark-chat posts from August 13 through November 11, 2026. This is discussion volume for the term, not a count of attacks, victims, or successful encryption. Kaspersky’s observed intrusion chain supplies the stronger evidence for operational risk.

Does Citrus Belong to Toy Ghouls?

Kaspersky reports overlapping techniques and tools between Citrus and Toy Ghouls, including shared use of several administration and credential tools. It also observed simultaneous compromise of the same infrastructure in several incidents. The report says the groups’ infrastructures do not directly overlap.

These findings support a relationship worth investigating, but they do not establish one operator or a formal rebrand. Treating every Toy Ghouls indicator as a Citrus indicator would overstate the published evidence. A case should be scoped from its own account, host, and network records.

Which Checks Should Defenders Prioritize?

Start with contractor identity paths because they are the observed entry point. Review VPN and RDP sign-ins for contractor accounts, especially access outside approved support windows or from new devices. Restrict these accounts to the systems and rights required for their work.

Next, review certificate-service and domain-account changes around the first suspicious access. Kaspersky observed CVE-2026-54121 attempts, so affected AD CS environments need the vendor’s applicable fix and a compromise assessment. Also examine 1C:Enterprise administration rights where that software is present. Our third-party risk guide explains why a supplier account can become a route into internal systems.

Inspect newly created scheduled tasks, security-tool policy changes, and domain Group Policy edits. Correlate these with unusual outbound encrypted connections and remote administration sessions. The lateral movement explainer provides a framework for tracing which hosts the compromised identity reached.

• Audit contractor VPN and RDP sessions, then revoke suspicious access
• Review AD CS, privileged account, and 1C:Enterprise changes where relevant
• Inspect scheduled tasks, Group Policy edits, and security-console actions
• Correlate Xray-like tunnel activity with processes and remote sessions
• Isolate affected hosts and validate recoverable backups before restoration

If these checks indicate a compromise, isolate affected hosts while preserving identity, endpoint, and domain-controller evidence. Revoke exposed sessions and rotate credentials that the attackers could have reached. Confirm that malicious Group Policy changes and security exclusions are removed before restoring systems from validated backups.