Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy

What happened

On 11 November 2026 Kaspersky researchers published an analysis of Citrus Ransomware, a group it had not documented before. Kaspersky describes it as Russian-speaking and, so far, attacking only companies in Russia. Encrypted files get the .citrus extension and a note called CITRUS_README.txt gives victims 72 hours before stolen data is leaked.

Kaspersky sees overlapping tools and techniques with the Toy Ghouls group (1C-Shell, Mimikatz, PsExec, ADRecon, the same tool folders), and in several incidents both groups compromised the same infrastructure, although their own infrastructure does not directly overlap.

How the attack works

Initial access. The contractor accounts had very limited privileges. From there the attackers ran discovery with fscan, ADRecon and SharpHound, searched shares with Snaffler, dumped credentials with Mimikatz and a modified keylogger, and kept remote control with silently installed AnyDesk. On 1C:Enterprise servers they used 1C-Shell; Kaspersky also saw a Metasploit-linked PowerShell script for CVE-2020-1337, a Windows Print Spooler privilege escalation patched in August 2020.

Hidden tunnels. Copies of Xray named mst.exe, sabycenter.exe, webex.exe or rpchost.exe opened reverse VLESS tunnels on port 443, using REALITY to look like traffic to mirror.yandex.ru and yastatic.net.

Domain takeover. With CVE-2026-54121 in Active Directory Certificate Services the attackers created machine accounts with names starting GHOST, requested a certificate on the Machine template with a validation address pointing to their own server, and put a domain controller's DNS name into it. That let them authenticate as the domain controller's account.

Encryption. A self-extracting archive posing as a Kaspersky tool (KasperskyGPO_Deploy_64.exe) ran a PowerShell script that copied the payload to SYSVOL and linked a new GPO to the domain. The policy dropped build_64.exe on every machine, started it from a scheduled task, enabled WinRM and disabled Volume Shadow Copy and Windows Defender. Sn00py is written in Go and encrypts user files (not system files) with ChaCha20 and RSA-2048. Earlier, 7-Zip packed a folder named tdatas – most likely Telegram Desktop tdata session data – and the archives were uploaded to a web service.

LLM help. Kaspersky found commands with typical LLM-style comments, complete LLM-written PowerShell scripts (such as one listing user sessions) and a GPO deployment script that an LLM most likely edited.

Who is affected

Kaspersky names victims only in Russia and gives no sector breakdown. The exposure, however, is generic: any Windows domain where contractors can log in over VPN or RDP, where an AD CS server lacks the July 2026 update and where nobody watches GPO changes. Fixed builds for CVE-2026-54121 cover Windows Server 2012 to 2025 (per NVD, for example 10.0.20348.5386 for Server 2022 and 10.0.26100.33158 for Server 2025).

How to tell if you were compromised

Kaspersky's indicators (MD5; IP addresses left defanged):

d631627131b90d576d77f4bf530e1abe  Xray (mst.exe, sabycenter.exe, webex.exe, rpchost.exe)
7107fb029e7c63523e3aca5fc8e56b38  Meterpreter stager (2341.exe)
e251df2d0b7c3682965efb4d2009a2f4  keylogger (jhost.exe)
17b29b6c9de80402a45e321bbe1168fa  Sn00py (build_64.exe)
9eee984b187423c46c10a63d080da15d  Sn00py (build_64.exe)
cf903e4a1629aa0582fd0363b5786676  fscan (fscan.exe)
91.210.109[.]118
91.210.108[.]180

Selected paths and artefacts from the same report:

C:\ProgramData\WebEx\webex.exe
C:\ProgramData\oracle\java\jhost.exe
C:\ProgramData\x64\mimikatz.exe
C:\ProgramData\steal_tgs.ps1
C:\ProgramData\tdatas
C:\Windows\SYSVOL\domain\build_64.exe
C:\Windows\SYSVOL\domain\KasperskyAgent.exe
C:\Users\*\Desktop\KasperskyGPO_Deploy_64.exe
C:\Users\*\AppData\Local\Temp\Kaspersky_GPO_Deployment.log
Scheduled tasks: Java, rpchost, agent, KasperskyAgentInstallTask, Sysvc
Ransom note: CITRUS_README.txt   Extension: .citrus

Our hunting suggestions, based on Kaspersky's description:

• List computer accounts whose names start with GHOST and review certificates issued from the Machine template whose subject or SAN contains a domain controller name but whose requester is not that DC.
• Alert on new or changed GPOs linked at the domain level and on executables appearing in SYSVOL.
• Find internal hosts other than proxies that make long-lived 443 connections to mirror.yandex.ru or yastatic.net.
• Check whether wevtutil was used to clear logs and whether AnyDesk was installed without a ticket.

Paste logs or reports into our IOC extractor to pull out hashes and IPs; it runs only in your browser.

What to do

1. Install the July 2026 updates on every AD CS server (CVE-2026-54121) and review who may enrol on the Machine template.
2. Lock down contractor access – this is Kaspersky's main recommendation: MFA, named accounts, time-limited access and no direct RDP from the internet.
3. Watch the domain's control points: GPO changes, SYSVOL contents, new computer accounts and scheduled tasks on many hosts at once.
4. Keep offline backups and test restoring them; without the attackers' key, Sn00py-encrypted files cannot be decrypted.
5. If you find traces, treat the domain as compromised: revoke forged certificates, reset the krbtgt and privileged passwords, and log out Telegram Desktop sessions on affected machines.

Timeline

Updates

• 11 November 2026 (evening) – we checked the status of CVE-2026-54121: according to NVD it is not yet in the CISA KEV catalog, and in July 2026 CISA rated it as not exploited (SSVC "exploitation: none"). The exploitation Kaspersky describes is not reflected in the catalog yet – don't wait for a KEV listing, patch your AD CS servers now.
• 11 November 2026 – first version of the article.