Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand

Securelist · November 11, 2026

We break down the Citrus Ransomware group's attacks: the attackers' TTPs and tooling, including VLESS traffic tunneling and LLM use, plus their links to Toy Ghouls.

In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family. The attackers also integrate LLMs (large language models) into the process of infrastructure compromise.

In this article, we review the tactics and techniques the group used in recent incidents.

The attackers gain initial access to victims’ infrastructure through compromised contractors. They use credentials stolen from these contractors’ employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP.

The attackers run commands on compromised systems through the standard Windows command interpreter and PowerShell. As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs. One example of the latter is the commands below, which disable the account of one of the administrators.

# Disable account # Verify result Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use. And the models did more than generate commands. The attackers also produced full scripts, complete with the comments typical of LLM output.

# Creating background tasks for each computer with a thread limit # Concurrent task limit control # Quick ping The fragment above comes from a script Citrus used to enumerate active user sessions on domain systems.

Besides LLMs, the attackers use atexec, a classic tool from the Impacket collection, to create scheduled tasks that run commands on hosts:

We did not see the exact commands behind these tasks, but Group Policy was refreshed after they ran, so they most likely executed gpupdate /force .

When the group compromises 1C:Enterprise servers, it uses external data processors (1C-Shell) to run commands.

Citrus uses scheduled tasks to launch its malicious tools automatically. The attackers create the tasks manually through PowerShell:

On systems that are not regularly rebooted, such as terminal servers, they sometimes run their tools without establishing persistence at all.

In every case we know of, the contractor domain account used for initial access had very limited privileges, so the attackers tried to escalate them.

To do this, they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost) ; these attempts created machine accounts with telltale names in Active Directory, such as:

These names are generated by scripts making use of an exploit published on GitHub.

The exploit works like this: on behalf of the newly created account, it requests a certificate based on the Machine template from the system holding the AD CS role. The Attributes , Subject , and SubjectAlternativeName fields contain parameters like these:

CertificateTemplate:Machine\nSAN:dns=dc01.victim.domain\ncdc:91.210.109[.]118\nrmd:dc01.victim.domain CN=GHOSTABUIEFAD.victim.domain DNS name =dc01.victim.domain\r\n The cdc attribute specifies the IP address or name of the system that the certification authority must contact to verify the data. The attackers specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, the certification authority issues a certificate with the specified parameters, based on the specified template.

Once the certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account.

In one case, the attackers also uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with nonstandard HostName (Имя узла) field value.

Severity HostName HostVersion HostId HostApplication EngineVersion RunspaceId PipelineId CommandName CommandType ScriptName Although the file was later deleted, indirect evidence hints at its purpose. For example, the MSFConsole value may indicate that the file is a component of the Metasploit framework. The PowerShell scripts run through this file included an exploit for the CVE-2020-1337 vulnerability; the same exploit is available in the Metasploit GitHub repository.

Beyond classic vulnerabilities in Microsoft products, the attackers also took an interest in 1C:Enterprise servers with insecure configurations (article in Russian) .

On top of the configuration flaws, 1C:Enterprise systems are frequently accessed by support staff and administrators who hold elevated privileges in Active Directory. Together, these factors make it easy for attackers to escalate privileges and start moving laterally.

To hinder incident response, the attackers delete their tools and output files and clear the command history.

While the tools are still in use in the victim’s infrastructure, the attackers typically give them and their auxiliary objects legitimate-looking names:

Note that using the Kaspersky name in malicious file names doesn’t help the attackers avoid detection. Kaspersky solutions successfully detect and block these malicious files.

To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility.

In addition, once they have sufficient privileges, they disable antivirus protection on hosts, which lets them run tools such as mimikatz.

The attackers also go after the centralized management consoles for security solutions, which they then use to disable protection en masse.

At the Impact stage, the attackers also use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off. As a result, the antivirus did not respond when the ransomware was launched.

Finally, if they have sufficient privileges, the attackers manually add their malicious tools to the antivirus exclusion list.

To capture keystrokes on a compromised system, the attackers use a modified version of the peeping-tom keylogger, whose source code is available on GitHub. The keylogger executable and its log file are located at the following paths:

In the sample we found, stolen data was sent to 91.210.109[.]118. Persistence for the keylogger is provided by the scheduled task described above in the Persistence section.

To dump credentials from memory, the attackers use mimikatz. Files related to mimikatz are located at the following paths:

To hunt for credentials and other secrets (SSH keys, access tokens, and the like) in files on accessible network shares, the group uses Snaffler. To simplify running the tool, the attackers drop a configuration file on the system:

Besides data from network shares, the attackers were interested in data stored in password managers (for example, KeePass) on administrator workstations.

After gaining control of a compromised system, the attackers ran a basic set of commands to identify the current user, running processes, network interface settings, the system’s external IP address, and so on:

whoami tasklist quser ipconfig curl 2ip[.]io

In the early stages, the attackers used the fscan scanner to gather information on the internal infrastructure. They were particularly interested in the following ports:

Once they had the access they needed and had moved laterally, the attackers ran ADRecon on domain controllers and SharpHound on one of the workstations.

The attackers also used PowerShell to run LDAP queries against the controllers of adjacent domains, pulling lists of domain systems, users, and groups.

The user has no additional groups in memberOf (primary only) User not found As an alternative to PowerShell, the attackers used the net.exe utility to get information about domain users and privileged groups:

net users /domain net group "Domain Admins" /domain net group "Администраторы домена" /domain

For lateral movement, the group relies on standard remote administration protocols: SSH, WinRM, and RDP. The attackers connect to systems either through previously deployed tunnels or directly from the compromised host.

To deliver its tools to target hosts, the group uses built-in OS utilities. Specifically, the incidents involved:

The certutil and BITS commands shown above are what the attackers used to download Xray onto victim systems. They then used Xray to set up reverse VLESS tunnels to the command-and-control server. The configuration file, stored alongside the Xray executable, was usually named config.json. In some cases, the attackers deleted it right after starting the tunnel to hide the Xray configuration from defenders.

Judging by the configuration files recovered during the analysis, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic. The configuration files also contain blocks that set up the REALITY protocol, which is intended to disguise the attackers’ traffic as requests to the legitimate site mirror.yandex.ru:

The traffic was also disguised as requests to another legitimate site, yastatic.net:

The PowerShell command above AnyDesk, which the attackers used to remotely control compromised hosts.

After the download, the attackers installed the software with the --silent flag to avoid alerting the user, set a connection password, and used PowerShell to pull the infected machine’s ID (which AnyDesk uses for remote connections on the client side) from the configuration file:

Right before encrypting the data, the attackers connected to one of the domain controllers and ran the PowerShell script steal_tgs.ps1, which created the tdatas directory. According to the NTFS USN journal, while the script ran, 7-Zip created archives in this directory with telltale names hinting at their contents:

_ _ _tdata.zip The directory name tdatas and the substring tdata may refer to the C:\Users\ \AppData\Roaming\Telegram Desktop\tdata directory. The Telegram messaging app uses this directory to store authorization keys, session data, app settings, and other session information.

So the attackers were harvesting messaging app data from remote systems they could reach, packing it with 7-Zip and uploading it to an external web service through Google Chrome.

The Citrus group uses ransomware from the Sn00py family to encrypt data. It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems. Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key.

When launched, the ransomware opens a console on the victim’s device, where it outputs the commands it runs. It also attempts to modify the boot configuration data (BCD) by invoking a nonexistent executable, bcedit (likely a typo for bcdedit ):

The ransomware’s console output contains the string:

We`re going to do something special today :). Made with RaaS platform Sn00py. The string likely means the ransomware is distributed under the ransomware-as-a-service model, where attackers don’t write the malware themselves but subscribe to a ready-made offering.

The ransomware configuration contains the Citrus group’s public key in the pubkey parameter:

[ "DC01", "DC02", "DC03", "DC04" ] This list includes the domain controllers used to distribute the policy that launches the ransomware. This way, the attackers ensure the policy keeps propagating uninterrupted.

As it runs, the Trojan drops CITRUS_README.txt files containing the ransom note:

-[ All your data were encrypted ] | |-If you try to decrypt them yourself, you will lose your data. To decrypt all systems, you need to contact us for guidance and a data recovery tool in the future. If you ignore our offer and the conversation does not take place, we will take extreme measures against your company and your employees, as a result of which you will lose access to all resources of your network and lose your reputation. | |-To contact us - register your mail here: https://account.proton.me/mail/signup?plan=free and write to us by email: [REDACTED] |-Further negotiations regarding this situation will be conducted there. Also we have Telegram: [REDACTED] | |-Be sure to use a VPN, and do not attempt to write from other email addresses, as there is a high chance that the messages will not be delivered to either party. | |-You have 72 hours to contact us to establish negotiations and interaction, starting from the date of creation of this file. |-If you do not contact us within 3 days, we will consider this a refusal to cooperate. This will entail immediate measures, such as: Dumps of your services, personal data of employees, accounting, contracts and source code. | |-Warning: \\_ Do not delete, modify, or attempt to recover files by any means other than using our key and decryptor. This will damage your data, and we cannot guarantee its recovery. \\_ Do not try to make this public, as you will only harm yourself and your reputation. As mentioned above, the group uses malicious Group Policy Objects to launch the ransomware across victim systems en masse. The GPOs are created by self-extracting archives, of which we have seen two versions. Each archive contains:

One version of the PowerShell script contained comments suggesting that it was likely edited with an LLM:

While analyzing Citrus activity, we noticed several similarities to Toy Ghouls. Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories. What’s more, both groups are Russian-speaking and attack Russian companies only. In several incidents, we saw the same infrastructure compromised simultaneously by both Toy Ghouls and Citrus.

What makes Citrus interesting is its unconventional approach to network tunneling and its use of AI to generate auxiliary tools. Even so, the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier. Kaspersky solutions detect all the activity described in this article.

That said, the Citrus attacks are another reminder that contractor access to an organization’s infrastructure must be tightly controlled and restricted. After all, compromising contractor accounts is exactly how the attackers get into their victims’ networks. We’ll continue to track the group’s activity and report new techniques as we discover them.

Источник: Securelist