Skip to content
AI Security Wire

Published

- 4 min read

By

Citrus Ransomware Gang Likely Used LLMs and Contractor Logins, Kaspersky Says

Citrus ransomware Kaspersky Sn00py LLM-assisted attacks VLESS Toy Ghouls CVE-2026-54121
img of Citrus Ransomware Gang Likely Used LLMs and Contractor Logins, Kaspersky Says

Kaspersky published its analysis of Citrus on 11 November 2026, describing it as a previously undocumented ransomware group. The short version: contractor credentials for entry, a public exploit for escalation, and scripts that Kaspersky says were very likely written with an LLM.

Way in: contractors

Kaspersky says Citrus uses credentials stolen from employees of contractors to reach corporate VPNs or internet-facing terminal servers over RDP. In every case Kaspersky knows of, the contractor account had very limited privileges, so the attackers tried to escalate.

For that they tried CVE-2026-54121, an Active Directory Certificate Services elevation of privilege flaw that Microsoft and Kaspersky both call Certighost. The CVE record was published on 14 July 2026 by Microsoft as CNA with a CVSS v3.1 base score of 8.8; NVD has not published a score of its own. At publication Microsoft’s page listed it as not publicly disclosed, not exploited and “Exploitation Less Likely”, which predates Kaspersky’s observations. Kaspersky saw the attempts leave machine accounts named GHOST plus eight random letters in Active Directory, created by scripts built on an exploit published on GitHub. Kaspersky does not say whether the attempts succeeded. We found no entry for CVE-2026-54121 in the CISA KEV catalog (version 2026.11.10) as of 11 November 2026.

Where the LLMs show up

Kaspersky points to commands and PowerShell scripts carrying explanatory comments, such as those that disable an administrator account and verify the result. Attackers rarely bother with comments, so Kaspersky says they “very likely point to LLM use”. A script that enumerated active user sessions across domain systems carried the same kind of comments, and one version of the script that deploys the ransomware was “likely edited with an LLM”.

Kaspersky’s own summary is that “the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier.” Our reading: nothing in the report suggests an autonomous agent. It looks like a crew using a model as a scripting assistant.

Tunnels and payload, briefly

Kaspersky describes reverse VLESS tunnels through Xray over port 443, with REALITY settings that mimic requests to mirror.yandex.ru and yastatic.net, plus silent AnyDesk installs. Before encryption, archives whose names suggest Telegram Desktop tdata folders were created on a domain controller and uploaded to an external web service. Kaspersky infers this from the names, saying they “may refer to” Telegram Desktop’s tdata folder.

The payload is a Go ransomware from the Sn00py family that Kaspersky reads as a ransomware-as-a-service offering. It uses RSA-2048 and ChaCha20 and adds a .citrus extension. Kaspersky says decryption is currently impossible without the attackers’ private key. It is launched through a malicious Group Policy Object with files named as if they were Kaspersky software, which Kaspersky says does not stop its products detecting them (a vendor claim we have not tested). The ransomware’s host blacklist is a list Kaspersky says includes the domain controllers used to distribute the policy (DC01 to DC04 are named).

Kaspersky sees similarities with Toy Ghouls: shared tooling and directories, Russian-speaking operators, and attacks on Russian companies only. The infrastructures do not directly overlap, and in several incidents both groups compromised the same network. Kaspersky does not say they are one group.

Our suggestions, not Kaspersky’s

Kaspersky’s own advice is that contractor access to infrastructure must be tightly controlled and restricted. Beyond that, we would:

  • Restrict contractor VPN and RDP by source and require MFA.
  • Hunt for AD machine accounts named GHOST plus eight letters.
  • Alert on new GPOs that create scheduled tasks, stop Volume Shadow Copy or change Defender settings.

All Citrus activity details come from Kaspersky’s report. We found no independent corroboration as of 11 November 2026 (one web search). Indicators are in the original.

References

Frequently Asked Questions

How does Citrus get into victim networks?
Kaspersky says the group uses credentials stolen from employees of compromised contractors. It connects to corporate VPNs or to internet-facing terminal servers over RDP. In every case Kaspersky knows of, the contractor account had very limited privileges, so the attackers then tried to escalate.
How do we know Citrus used LLMs?
Kaspersky inferred it from the artefacts and says the comments very likely point to LLM use. Commands and PowerShell scripts carried explanatory comments, which attackers rarely bother to write, and one script's comments suggested it had been edited with an LLM. This is Kaspersky's reading of the evidence, not a confirmation from the attackers or a model provider.
Is Citrus tied to another group?
Kaspersky sees similarities with Toy Ghouls: shared tooling and directories, Russian-speaking operators and a focus on Russian companies. The infrastructures do not directly overlap, and in several incidents both groups were present in the same victim network. Kaspersky does not claim they are the same group.
Can victims decrypt Citrus-encrypted files?
Kaspersky states that decryption is currently impossible without the attackers' private key. The Sn00py ransomware uses RSA-2048 and ChaCha20 and adds a .citrus extension to encrypted files.