kaspersky

Nov 11, 2026 4 min read

Citrus Ransomware Gang Likely Used LLMs and Contractor Logins, Kaspersky Says

Kaspersky says Citrus, a ransomware group it calls previously undocumented, got in through compromised contractor accounts, tried the Certighost AD CS flaw and likely used LLMs to write attack scripts.

img of CyberStrikeAI in the Wild: Kaspersky Describes an LLM-Orchestrated C2 Campaign

Nov 9, 2026 4 min read

News Brief

CyberStrikeAI in the Wild: Kaspersky Describes an LLM-Orchestrated C2 Campaign

Kaspersky describes attackers using the open-source CyberStrikeAI framework, where a server-side LLM plans post-exploitation. Victims included education organizations.