Kaspersky’s Securelist team published research on 11 November 2026 on Citrus, which it calls a previously undocumented ransomware group. Everything below comes from that single report unless stated otherwise. Kaspersky does not give a victim count, a date range for the incidents or a sector breakdown, so we do not offer one either. It does say that, like the related Toy Ghouls group, Citrus attacks Russian companies only.
How the intrusions start
Kaspersky says the attackers get in through compromised contractors. They use credentials stolen from contractor employees to log in to corporate VPNs or to reach internet-facing terminal servers over RDP. In every case Kaspersky knows of, that contractor account had very limited privileges, so the group worked to escalate.
Two escalation routes are described:
- Certighost (CVE-2026-54121). Kaspersky saw attempts to exploit this Active Directory Certificate Services authentication bypass, visible as machine accounts named
GHOSTplus eight random letters. The report does not say whether any attempt succeeded. Microsoft’s 31 July 2026 post says the flaw lets an attacker obtain certificates for arbitrary domain computer accounts, including domain controllers, that a fix shipped on 14 July 2026, and that a public proof of concept appeared on 24 July. At that time Microsoft had not observed confirmed threat-actor exploitation. Kaspersky reports attempts only, and that is a single-vendor observation; we opened no second source on in-the-wild use. - 1C:Enterprise servers. Kaspersky says the group targets insecurely configured 1C:Enterprise servers, which are often accessed by administrators with elevated Active Directory rights, and uses external data processors (1C-Shell) to run commands.
Tooling and stealth
Per Kaspersky, the toolset is mostly off the shelf: mimikatz, Snaffler, fscan, ADRecon, SharpHound, Impacket’s atexec, and a modified peeping-tom keylogger. Tools are fetched with certutil, BITS, cURL or PowerShell, and AnyDesk is installed silently for remote control.
The distinctive parts are two:
- VLESS tunnels. The group deploys Xray and sets up reverse VLESS tunnels over port 443, with REALITY configuration meant to make the traffic look like requests to mirror.yandex.ru and yastatic.net. Config files were sometimes deleted right after the tunnel started.
- LLM-written scripts. Kaspersky points to comments in PowerShell commands and scripts, such as session enumeration and account disabling, as very likely evidence of LLM use. This is Kaspersky’s inference from code style; the report does not name a model or show chat logs.
Before encryption, a script named steal_tgs.ps1 created archives with 7-Zip whose names include tdata, which Kaspersky says may refer to Telegram Desktop’s tdata directory. The report does not show upload in that passage, and the purpose is Kaspersky’s inference from directory and file names.
The ransomware and its deployment
Encryption uses Sn00py, a Go-based family using RSA-2048 and ChaCha20, appending .citrus and skipping system files. Kaspersky says decryption is not possible without the attackers’ private key. A console string, “Made with RaaS platform Sn00py”, leads Kaspersky to say the family is “likely” distributed as ransomware-as-a-service. That is an inference from one string.
Deployment is the part defenders can act on. A self-extracting archive builds a malicious Group Policy Object, copies the payload to SYSVOL and links the policy to the domain. The GPO drops the payload, creates a scheduled task that runs it with /quiet /norestart, enables WinRM, disables Volume Shadow Copy and Windows Defender, and sets a ransom-note wallpaper. The configuration exempts DC01 to DC04 from encryption (the report does not say why; we assume it keeps the GPO distribution working). Files and tasks use Kaspersky-themed or generic service-like names (KasperskyGPO_Deploy_64.exe, KasperskyAgentInstallTask, Sysvc), so a legitimate-looking name proves nothing. The ransom note, CITRUS_README.txt, gives 72 hours to make contact and threatens data dumps.
Link to Toy Ghouls
Kaspersky sees shared TTPs with Toy Ghouls (1C-Shell, mimikatz, PsExec, ADRecon, tools stored in the same directories) and says both groups are Russian-speaking, attack Russian companies, and were seen in the same infrastructure at the same time in several incidents. It also says their infrastructures do not directly overlap. Kaspersky stops short of calling them the same actor, and so do we. Our assessment: the evidence supports overlap in method, not common identity.
Indicators published by Kaspersky (defanged)
- IP addresses:
91.210.109[.]118(also the destination of keylogger data and the Certighostcdcvalue in the example),91.210.108[.]180 - Xray MD5:
d631627131b90d576d77f4bf530e1abe(seen as mst.exe, sabycenter.exe, webex.exe, rpchost.exe) - Sn00py MD5s:
17b29b6c9de80402a45e321bbe1168fa,9eee984b187423c46c10a63d080da15d(build_64.exe) - Ransom note:
CITRUS_README.txt; extension.citrus
What defenders should check
Our assessment, drawing on the report’s findings and not a vendor recommendation:
- Treat contractor VPN and RDP accounts as a primary entry path: enforce MFA and restrict what they can reach.
- Confirm the 14 July 2026 Microsoft update for CVE-2026-54121 is applied on the AD CS servers in your estate (which hosts need it is for your Microsoft guidance to say), and look for machine accounts matching
GHOSTplus random letters. - Alert on new GPOs, new
Import-GPOorNew-GPLinkactivity, and unexpected files in SYSVOL. - Review who can alter antivirus exclusions and central security-console policy; Kaspersky says the group used both.
Limits
This is one vendor’s research on activity inside its own telemetry. We have no second source on Citrus, no leak-site data and no victim list. Kaspersky concludes that the group relies mostly on well-known tools that make early detection somewhat easier; that is its own view.