Citrus ransomware targets Russian firms using stolen credentials

Kaspersky Labs has identified a previously undocumented threat group, dubbed Citrus Ransomware, that breaches Russian enterprises using compromised contractor credentials. The operators reportedly target Russian companies exclusively, with Brandefense Research Team logging 77 dark‑chat posts mentioning Citrus between 13 August and 11 November 2026.

The group uses Go‑based Sn00py ransomware in conjunction with VLESS/REALITY tunnels to conceal traffic and a modified peeping‑tom keylogger to harvest credentials, according to Daily CyberSecurity.

Infection and intrusion chains describe attackers gaining initial access with stolen contractor credentials to corporate VPNs or internet‑facing RDP endpoints, followed by a malicious Group Policy rollout. Researchers note the use of LLM‑generated PowerShell scripts to draft and debug deployment tooling, including a domain Group Policy that enables the final payload.

Citrus is said to leverage CVE‑2026‑54121 (Certighost) for AD CS privilege escalation and has in some incidents used a Metasploit module for CVE‑2020‑1337 (Windows Print Spooler). The final payload, the Sn00py Citrus Ransomware, encrypts files with RSA‑2048 and ChaCha20, appends the .citrus extension, and propagates across domain controllers not named DC01–DC04, with the ransom note delivered via CITRUS_README.txt. Investigators report the malware’s console banner: “We’re going to do something special today :). Made with RaaS platform Sn00py.”

Defence and attribution notes come from Gridinsoft and Kaspersky, stating the fake Kaspersky filenames are branding rather than legitimate software compromise. The report calls for patching CVE‑2026‑54121, auditing for Ghost machine accounts, enforcing MFA, and tightening contractor VPN/RDP access, while highlighting the use of VLESS tunnels and domain‑wide Group Policy deployment as key indicators.