Citrus ransomware uses contractor access to breach networks

Kaspersky’s Securelist reports detail Citrus Ransomware as a hybrid operation that blends old-school offence playbooks with modern automation and AI assistance. The group reportedly gains initial access via compromised contractors, using stolen credentials to connect to VPNs or internet-facing RDP.

The activity is framed around a mix of standard Windows commands, PowerShell, and scripts apparently generated with large language models (LLMs), including examples where LLMs produce commands to disable administrator accounts and generate background tasks. The attackers also leverage Impacket’s atexec to schedule tasks and, in some cases, 1C:Enterprise shells for command execution.

The report notes use of Xray to establish reverse VLESS tunnels (traffic disguised as HTTPS on port 443) and Even installing AnyDesk for remote control, with the client’s ID drawn from configuration files.

Code-names aside, Citrus deploys Sn00py ransomware to encrypt data (Go-based, RSA-2048 and ChaCha20, target files only, .citrus extension) and uses a custom ransom note.

Defence-impairing steps include disabling antivirus via a Group Policy Object, clearing event logs, and exporting credentials with tools like mimikatz and Snaffler; the attackers also attempt to exploit CVE-2026-54121 (Certihost) to escalate privileges and create trusted machine certificates, and in one instance leveraged CVE-2020-1337 via a Metasploit component for lateral movement.

The ransomware’s configuration embeds a public key and enforces a domain-wide policy to propagate encryption, with domain controllers listed to ensure persistence. Evidence includes file paths, scheduled task names, and IPs such as 91.210.109[.]118. The report stresses contractor access as a principal entry vector and notes that, despite AI-assisted tooling, many techniques remain well-known, enabling earlier detection.