Citrus Ransomware Uses VLESS Tunnels, LLM Scripts, and Sn00py Encryptor Against Russian Companies
Do Son 
At a Glance
| Malware Family | Citrus Ransomware (Go-based Sn00py RaaS encryptor, Xray VLESS/REALITY tunnels, and modified peeping-tom keylogger) |
| Threat Actor | Confirmed as the Russian-speaking Citrus Ransomware group; suspected links to Toy Ghouls via shared TTPs and simultaneous victim access |
| Target / Victims | Russian companies exclusively (exact victim count undisclosed; Brandefense Blackhole tracked 77 dark-chat posts mentioning Citrus over 90 days) |
| Delivery Vector | Stolen contractor employee credentials used over corporate VPNs or internet-facing RDP terminal servers, followed by malicious Group Policy Object rollout |
| Key Capabilities | CVE-2026-54121 (Certighost) AD CS privilege escalation, LLM-generated PowerShell scripts, Xray REALITY traffic spoofing, Telegram tdata theft, RSA-2048 and ChaCha20 encryption |
TL;DR
Kaspersky Labs uncovered a previously undocumented threat group called Citrus Ransomware that breaches Russian enterprises through compromised contractor accounts. Once inside, the operators use large language models to write PowerShell scripts, exploit the Certighost Active Directory flaw, and hide network traffic inside VLESS tunnels. Finally, the Sn00py Citrus Ransomware payload deploys across the domain disguised as an official Kaspersky Group Policy update.
Delivery and Attribution
In incidents analyzed in November 2026, attackers gained initial access by stealing credentials belonging to employees of third-party contractors. Using those valid logins, the intruders connected to corporate VPN gateways or logged directly into internet-facing Remote Desktop Protocol terminal servers. While Kaspersky did not publish a total victim count, independent dark web monitoring by the Brandefense Research Team recorded 77 dark-chat posts referencing the group between August 13 and November 11, 2026.
Confirmed Versus Suspected Attribution
Confirmed attribution identifies the operators as a Russian-speaking group that attacks Russian companies exclusively. Meanwhile, suspected attribution links the operation to another Russian-focused group known as Toy Ghouls. According to the Kaspersky Labs research report, “Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories.” Furthermore, in several incidents, investigators saw the exact same victim infrastructure compromised by both Toy Ghouls and Citrus Ransomware at the same time.
Infection Chain
Because the stolen contractor accounts held low domain privileges, the attackers sought immediate privilege escalation. On several networks, they ran public scripts targeting CVE-2026-54121, an Active Directory Certificate Services authentication bypass known as Certighost. Those scripts created rogue machine accounts named GHOST followed by eight random letters and tricked the certification authority into issuing a domain controller certificate. In another incident, the group ran a Metasploit executable that exploited the older Windows Print Spooler flaw CVE-2020-1337, and they also abused misconfigured 1C:Enterprise business servers via 1C-Shell.
LLM-Assisted Scripting and Defense Impairment
Throughout the intrusion, the attackers ran PowerShell commands and multi-threaded session enumeration scripts containing detailed Russian-language inline comments. As the researchers noted, “Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use.” The attackers also used an LLM to debug and rewrite their domain Group Policy deployment script, adding an ADSI fallback and fixing XML path handling.
To harvest additional credentials, the group registered a scheduled task named “Java rpchost agent” to run a modified peeping-tom keylogger disguised as a Java binary. They also dumped memory with Mimikatz, scanned network shares for secrets with Snaffler, and searched administrator PCs for KeePass databases. Next, they mapped the network using fscan, ADRecon, and SharpHound, cleared Terminal Services event logs via wevtutil, and used captured security management consoles to turn off endpoint protection across the fleet.
Command-and-Control and Data-Exfiltration Behavior
Using built-in Windows utilities like certutil, BITS, and curl, the operators downloaded the Xray proxy client and disguised the binary as a WebEx or system executable. They then established reverse VLESS tunnels over TCP port 443 using the REALITY protocol, which spoofed TLS server names to make the traffic look like requests to legitimate Yandex domains. In addition, the intruders installed AnyDesk in silent mode to maintain interactive remote desktop access.
Right before launching encryption, the attackers connected to a domain controller and ran a PowerShell script named steal_tgs.ps1. This script searched reachable workstations for Telegram Desktop tdata folders, packed the session files into 7-Zip archives, and uploaded them to an external web service via Google Chrome.
Sn00py Encryptor and Fake Kaspersky GPO
To deploy the final payload en masse, the group packaged the Go-based Sn00py Citrus Ransomware executable inside self-extracting archives named after Kaspersky, such as KasperskyGPO_Deploy_64.exe and KasperskyAgent.exe. A companion script copied the archive to the domain controller’s SYSVOL share and linked a malicious Group Policy Object that disabled Windows Defender, stopped Volume Shadow Copy services, and ran the encryptor.
When launched, the encryptor prints the console banner: “We’re going to do something special today :). Made with RaaS platform Sn00py.” It encrypts user files using RSA-2048 and ChaCha20, appends the .citrus extension, and skips domain controllers named DC01 through DC04 so the malicious Group Policy continues spreading. Interestingly, its console output shows a failed attempt to disable Windows recovery because the author mistyped bcdedit as bcedit, though the malware still deleted the Windows backup catalog and dropped CITRUS_README.txt ransom notes giving victims 72 hours to negotiate via Proton Mail or Telegram.
Defense and Detection Guidance
Gridinsoft and Kaspersky analysts emphasize that the fake Kaspersky filenames merely borrow the vendor’s brand and do not involve any flaw in legitimate security software. Defenders can spot the Sn00py Citrus Ransomware chain early by auditing Active Directory for machine accounts starting with the prefix GHOST and patching AD CS servers against CVE-2026-54121. Organizations should also enforce strict multi-factor authentication and least-privilege network segmentation on all contractor VPN and RDP accounts, restrict access to 1C:Enterprise and antivirus management consoles, and alert on certutil or BITS jobs downloading executables into ProgramData folders.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
