A previously undocumented ransomware group called Citrus is breaking into Russian companies through their contractors, then using AI-written scripts, disguised tunnels and fake Kaspersky files to encrypt whole networks, Kaspersky researchers Stanislav Larinsky, Vladislav Vlasov and Boris Trefilov report in an analysis on Securelist.
The way in is mundane. Citrus logs in with credentials stolen from contractors' employees, either to corporate VPNs or straight to internet-facing terminal servers over RDP. In every case the researchers know of, that contractor account had very limited privileges, so most of what follows is a push for more.
Comments that give the AI away
The crew runs commands through cmd and PowerShell, and some arrived with tidy explanatory comments, something attackers rarely bother with. The researchers say those comments very likely point to large language model (LLM) use, and Citrus went beyond single commands: it produced full scripts, such as one that enumerated active user sessions across domain systems, complete with the comments typical of LLM output. One version of the script that deploys the ransomware also appears to have been edited with an LLM.
To escalate, Citrus tried to exploit CVE-2026-54121, an Active Directory Certificate Services (AD CS) authentication bypass nicknamed Certighost, using an exploit published on GitHub. The attempts leave a tell: machine accounts in Active Directory named GHOST followed by eight random letters. If exploitation succeeds, the certificate authority issues a certificate that lets the attackers authenticate as the domain controller. The group also ran a Metasploit exploit for the older CVE-2020-1337 and went after 1C:Enterprise servers with insecure configurations, running commands there through 1C-Shell.
Traffic dressed up as Yandex
For command and control, Citrus downloads Xray and builds reverse VLESS tunnels over port 443 so the traffic blends in with ordinary HTTPS. Recovered configurations use the REALITY protocol to make it look like requests to mirror.yandex.ru and yastatic.net. The crew also installs AnyDesk silently, dumps credentials with mimikatz, hunts secrets on network shares with Snaffler, logs keystrokes with a modified peeping-tom keylogger and, just before encrypting, archived Telegram Desktop session data from the systems it could reach.
The payload is from the Sn00py family: written in Go, using RSA-2048 and ChaCha20, and appending .citrus to files. Its console output says it was made with the "RaaS platform Sn00py", which likely means Citrus rents rather than writes its encryptor. It is pushed out through a malicious Group Policy Object named Kaspersky GPO, alongside files such as KasperskyAgent.exe and Deploy-KasperskyGPO.ps1, and the domain controllers distributing the policy are exempt from encryption so it keeps spreading. Decryption is currently impossible without the attackers' private key.
The researchers note clear overlaps with Toy Ghouls. Both are Russian-speaking, attack only Russian companies, use 1C-Shell, mimikatz, PsExec and ADRecon stored in the same directories, and in several incidents both had compromised the same network at once. Their infrastructures do not directly overlap.
Lock down contractor access and watch AD CS
The defense starts where the attack does. Restrict and monitor contractor VPN and RDP access, which Kaspersky singles out as the lesson of these intrusions. Hunt Active Directory for GHOST-prefixed machine accounts and check AD CS exposure to CVE-2026-54121 against the vendor advisory. Look for an unexpected GPO named Kaspersky GPO, wevtutil log clearing, new antivirus exclusions, and Xray or AnyDesk binaries under C:\ProgramData. Protect the central security management console too, since Citrus uses it to switch off protection en masse.
Indicators
- C2 and keylogger exfiltration: 91[.]210[.]109[.]118, plus 91[.]210[.]108[.]180 from the report's indicator list
- Sn00py (build_64.exe): 17b29b6c9de80402a45e321bbe1168fa, 9eee984b187423c46c10a63d080da15d
- Xray: d631627131b90d576d77f4bf530e1abe
- Keylogger (jhost.exe): e251df2d0b7c3682965efb4d2009a2f4
Citrus is not inventing much. Its strength is stitching together well-known tools, rented ransomware and a chatbot's help, which is exactly why the unglamorous controls on who can log in, and from where, still decide how these intrusions end.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.