Threat actor
Citrus Ransomware
Tracked by CyberSIXT since 11 Nov · RSS
1Articles, all time
1Articles, last 30 days
2CVEs exploited, attributed · all time
0Research reports, all time
Activity
Developinglatest 12 hours ago1 article1 outlet
One article so far, 11 Nov. A pattern appears once more outlets cover Citrus Ransomware.
- Wed 11 Nov. Securelist. Citrus ransomware uses contractor access to breach networks.
- CVE not in KEV
- Article naming Citrus Ransomware
- Articles a day, all coverage
Drawn: the only article.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 11 Nov | Article | Securelist | Citrus ransomware uses contractor access to breach networks |
Connections
2 exploited CVEs. What the record links this actor to; hover or use the arrow keys.
Show as a listHide the list
- Exploited CVEs
- CVE-2026-54121, CVE-2020-1337
- Affected vendors
- Microsoft
CVEs exploited2
CVEs an article attributes to Citrus Ransomware, most covered first
Windows Print Spooler Elevation of Privilege Vulnerability
7.8High14% EPSS · 0 articlesMicrosoft Windows 10 Version 1607 vulnerability
8.8High1.8% EPSS · 2 articles
MITRE ATT&CK techniques
No MITRE ATT&CK® techniques are recorded for Citrus Ransomware.
Articles1
Drawn: the only article.
- Citrus ransomware uses contractor access to breach networksSecurelistCVE-2026-54121