Kaspersky researchers have documented a previously undocumented ransomware group they call Citrus, which disguises its traffic with VLESS tunnels and encrypts victims with a Trojan from the Sn00py family. The findings were published on November 11, 2026.
How Citrus gets in
According to Kaspersky, the attackers gain initial access to victims' infrastructure through compromised contractors, using credentials stolen from contractors' employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP. In every case the researchers know of, the contractor domain account used for initial access had very limited privileges, so the group tried to escalate them.
Kaspersky said the attackers attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost), which created machine accounts in Active Directory with names such as GHOSTAUFTAFGS and GHOSTIVPRLDZA. Those names are generated by scripts making use of an exploit published on GitHub, the researchers said.
LLMs write the commands
Kaspersky said the group runs commands through the standard Windows command interpreter and PowerShell, and that as the attack progresses it creates and runs PowerShell scripts, batch files and commands generated by LLMs. The researchers pointed to comments attached to the commands, something attackers rarely bother with, as very likely evidence of LLM use, and said the models also produced full scripts complete with the comments typical of LLM output.
One PowerShell script that copies the ransomware archive to the SYSVOL directory on the domain controller and links the malicious Group Policy Object to the domain contained comments suggesting it was likely edited with an LLM, Kaspersky said.
Tunnels disguised as HTTPS
The group downloads Xray onto victim systems using certutil, the Windows BITS background service, cURL and PowerShell, then uses it to set up reverse VLESS tunnels to its command-and-control server, according to Kaspersky. Judging by recovered configuration files, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic, and the files contain blocks that set up the REALITY protocol to disguise traffic as requests to mirror.yandex.ru and yastatic.net.
Kaspersky said the attackers also installed AnyDesk with the –silent flag to avoid alerting the user, and ran a PowerShell script named steal_tgs.ps1 that created a tdatas directory, with 7-Zip archives whose names hint at Telegram session data.
Defense evasion and the Sn00py Trojan
To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility, Kaspersky said. Once they have sufficient privileges they disable antivirus protection on hosts, go after the centralized management consoles for security solutions, and use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off.
The Sn00py ransomware Trojan is written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files, but not system files, on Windows systems, according to Kaspersky. Encrypted files receive the .citrus extension, and the researchers said decryption is impossible without the attackers' private key for now. The configuration's host_blacklist exempts systems named DC01 to DC04.
Kaspersky said its solutions detect all the activity described in the report, and that using the Kaspersky name in malicious file names does not help the attackers avoid detection. The company said the attacks are a reminder that contractor access to an organization's infrastructure must be tightly controlled and restricted.
What to do
- Kaspersky says organizations should tightly control and restrict contractor access to their infrastructure, because compromising contractor accounts is how the attackers get into victims' networks.
Key facts and where they come from
- The group gains initial access through compromised contractors.
The attackers gain initial access to victims’ infrastructure through compromised contractors.
- Attackers ran commands and scripts generated by large language models.
As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs.
- The group tried to exploit the Certighost authentication bypass flaw.
they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost)
- VLESS tunnels used port 443 to look like ordinary HTTPS traffic.
the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic
- Event logs were cleared with the built-in wevtutil utility.
To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility.
- The Sn00py Trojan is written in Go and uses RSA-2048 and ChaCha20.
It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems.
- Encrypted files get the .citrus extension and cannot currently be decrypted without the attackers' key.
Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key.
- Kaspersky says contractor access must be tightly controlled.
contractor access to an organization’s infrastructure must be tightly controlled and restricted
The open question: How much of Citrus's tooling was actually written by LLMs rather than by the attackers themselves?
Tell us what you think · Discuss it in the Threat Intel room
Hacking Techniques tracker: how this works, how it is advancing and how to defend — Ransomware and data extortion · Attacks using or targeting AI
