Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
Citrus ransomware operators have been identified as a previously undocumented group that combines classic hacking tools with large language models (LLMs) and advanced techniques to infiltrate corporate networks.
Citrus ransomware represents a new evolution in cyberattacks, blending traditional infrastructure compromise methods with modern evasion techniques and automation powered by large language models.
The group, which uses VLESS tunnels to disguise traffic as regular HTTPS, has been linked to the Toy Ghouls threat actor and employs a ransomware Trojan from the Sn00py family.
AI-generated commands and Impacket tools
Attackers gain initial access to victims’ infrastructure through compromised contractors, using stolen credentials to connect to corporate VPNs or directly to internet-facing terminal servers over RDP.
They run commands on compromised systems through the standard Windows command interpreter and PowerShell, creating scripts and commands generated by LLMs to disable administrator accounts and enumerate user sessions.
Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use.
The attackers also use the Impacket collection tool atexec to create scheduled tasks that run commands on hosts, refreshing Group Policy to execute commands like gpupdate /force.
When compromising 1C:Enterprise servers, they use external data processors (1C-Shell) to run commands, taking advantage of insecure configurations and the elevated privileges of support staff.
Impersonating domain controllers
To escalate privileges, the attackers attempt to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost), creating machine accounts with telltale names in Active Directory such as GHOSTAUFTAFGS and GHOST{8 random letters}.
The exploit works by requesting a certificate based on the Machine template from the system holding the AD CS role, with the cdc attribute specifying the IP address of a system they control.
Once a certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account, granting them full control over the network.
In one case, they uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with a nonstandard HostName field value, possibly a component of the Metasploit framework.
Stealth and disabling security tools
To hinder incident response, the attackers delete their tools and output files and clear the command history, while giving their malicious tools legitimate-looking names such as KasperskyGPO_Deploy_64.exe and KasperskyAgent.exe.
They also clear event logs on some systems using the built-in wevtutil utility and disable antivirus protection on hosts, which lets them run tools such as mimikatz.
The attackers go after centralized management consoles for security solutions, using them to disable protection en masse and modifying Windows Defender settings in the registry to switch it off.
If they have sufficient privileges, they manually add their malicious tools to the antivirus exclusion list, ensuring the ransomware can run without interference.
Credential access and lateral movement
To capture keystrokes on a compromised system, the attackers use a modified version of a keylogger executable located at C:\ProgramData\Oracle\Java\jhost.exe, with its log file sent to 91.210.109[.]118.
They use mimikatz to dump credentials from memory, with files related to the tool located at C:\ProgramData\x64, and employ Snaffler to hunt for credentials and secrets in files on accessible network shares.
The attackers use a standard toolkit for discovery, running commands like whoami and tasklist locally, and using fscan to scan for open ports such as 135, 139, 1433, and 8006.
They move laterally through SSH, RDP, and WinRM, using PowerShell to run LDAP queries against domain controllers and net.exe to get information about domain users and privileged groups.
