Citrus Ransomware Uses LLM-Generated Scripts and VLESS Tunnels in Attacks

Nov 11, 2026 · Original article ↗

Summary

Kaspersky details Citrus ransomware attacks involving contractor credentials, LLM-assisted scripts, VLESS tunnels, credential theft, and Sn00py ransomware, and reports tactical similarities with Toy Ghouls.

Key points

Kaspersky says Citrus gained access through compromised contractors, using stolen employee credentials to connect to corporate VPNs or internet-facing RDP servers.
The group used LLM-generated commands and scripts alongside tools including Impacket, Mimikatz, Snaffler, and ADRecon.
For privilege escalation, attackers attempted to exploit CVE-2026-54121 against Active Directory Certificate Services; Kaspersky also found use of a CVE-2020-1337 exploit in one case.
Citrus used Xray to create reverse VLESS tunnels, and deployed AnyDesk for remote control of compromised hosts.
The attackers collected credentials and messaging-app data; Kaspersky reports that the Sn00py ransomware encrypted Windows user files with RSA-2048 and ChaCha20, adding the .citrus extension.
Kaspersky reports shared tools and tactics between Citrus and Toy Ghouls, and says both groups were observed compromising the same infrastructure in several incidents; it notes their infrastructure did not directly overlap.

Article Details

Attack Vectors: Initial access through compromised contractors, using stolen employee credentials to connect to corporate VPNs or internet-facing RDP servers.
Privilege escalation attempts involving CVE-2026-54121 and an exploit for CVE-2020-1337; attackers also exploited insecure configurations on 1C:Enterprise servers.
Lateral movement over SSH, RDP, and WinRM, including remote command execution with Impacket's atexec and 1C-Shell.
Delivery of Xray to victim systems followed by reverse VLESS tunnels to command-and-control infrastructure.
Deployment of the Sn00py-family ransomware through malicious Group Policy Objects and scheduled tasks.
Collection of credentials with mimikatz and a modified peeping-tom keylogger; searches of network shares for credentials and other secrets with Snaffler.
Collection of Telegram Desktop data, archiving it with 7-Zip, and uploading it to an external web service through Google Chrome.
Defensive Notes: Tightly control and restrict contractor access to organizational infrastructure and corporate VPNs.
Review and secure internet-facing terminal servers, Active Directory Certificate Services, and 1C:Enterprise configurations.
Monitor for unusual certificate requests, suspicious machine-account names beginning with GHOST, and anomalous certificate-based domain controller authentication.
Monitor for unexpected scheduled tasks, malicious Group Policy changes, unusual PowerShell activity, and use of tools such as atexec, Xray, mimikatz, fscan, and Snaffler.
Protect centralized security-management consoles and prevent unauthorized changes to antivirus settings and exclusion lists.
Preserve and review event logs and command histories; the attackers were reported to clear logs and delete tools and output files.

Indicators of compromise

Type	Indicator	Context
IPV4	`91[.]210[.]108[.]180`	Listed in the article's Citrus ransomware indicators of compromise as an IP address.
IPV4	`91[.]210[.]109[.]118`	Attacker-controlled system specified for certificate-authority validation; the article also reports stolen keylogger data was sent to this address.
MD5	`17b29b6c9de80402a45e321bbe1168fa`	Hash listed for the Sn00py ransomware executable build_64.exe.
MD5	`7107fb029e7c63523e3aca5fc8e56b38`	Hash listed for a Meterpreter stager associated with the reported activity.
MD5	`9eee984b187423c46c10a63d080da15d`	Hash listed for the Sn00py ransomware executable build_64.exe.
MD5	`cf903e4a1629aa0582fd0363b5786676`	Hash listed for fscan, which the attackers used to scan internal infrastructure.
MD5	`d631627131b90d576d77f4bf530e1abe`	Hash listed for Xray, which the attackers used to establish reverse VLESS tunnels.
MD5	`e251df2d0b7c3682965efb4d2009a2f4`	Hash listed for the keylogger executable jhost.exe used to capture keystrokes.