Kaspersky reports Citrus ransomware using VLESS tunnels and Sn00py

What happened

According to Kaspersky’s Securelist, a previously undocumented group called Citrus Ransomware has been active in recent incidents. Kaspersky says the group’s toolset includes VLESS tunnels, used to disguise traffic as regular HTTPS, and a ransomware Trojan from the Sn00py family. Kaspersky also says the attackers use large language models (LLMs) during the compromise of infrastructure. The report is dated 2026-11-11 Kaspersky Securelist.

This is a single-vendor research report. No victim names, no victim confirmations and no independent verification are stated in the material available to us. Kaspersky’s report also has a section linking the group to “Toy Ghouls”, but the details of that link were not available to us, so the attribution is not confirmed here.

Kaspersky reports the following about the group’s behaviour Kaspersky Securelist:

• Initial access: through compromised contractors. The attackers use credentials stolen from contractor employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP.
• Execution: the standard Windows command interpreter and PowerShell, plus scripts, batch files and commands that Kaspersky says were generated by LLMs. Kaspersky bases this on comments that are unusual for attackers and typical of LLM output. It also reports use of atexec from Impacket to create scheduled tasks, and external data processors (1C-Shell) to run commands on compromised 1C:Enterprise servers.
• Persistence: scheduled tasks created manually through PowerShell. On systems that are rarely rebooted, such as terminal servers, the attackers sometimes run tools without persistence.
• Privilege escalation: the contractor domain account used for initial access had very limited privileges. Kaspersky says the attackers attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost), using an exploit published on GitHub. These attempts created machine accounts in Active Directory with names such as GHOSTAUFTAFGS, GHOSTCZYQVAZS and GHOSTIVPRLDZA. Kaspersky also reports PowerShell scripts containing an exploit for CVE-2020-1337, and interest in 1C:Enterprise servers with insecure configurations.
• Stealth: the attackers delete tools and output files and clear command history. While tools are in use, they give them legitimate-looking names, including KasperskyGPO_Deploy_64.exe, KasperskyAgentInstaller.exe, a Group Policy Object named Kaspersky GPO, and scheduled tasks named KasperskyAgentInstallTask and Sysvc. Kaspersky says the GPO distributes the ransomware Trojan in the victim’s infrastructure.

The Securelist article also covers defense impairment, credential access, discovery, lateral movement over SSH, RDP and WinRM, Xray tunnels, AnyDesk, exfiltration from messaging apps and the Sn00py ransomware Trojan. Those sections and the indicators of compromise were not available to us, so we do not summarise them.

Am I affected?

Not confirmed for any specific organisation. Kaspersky’s report describes the group’s methods, not a list of victims. You may want to check your environment if any of the following applies, based on what Kaspersky reports:

• Contractors or their employees connect to your VPN or to internet-facing RDP terminal servers.
• You run Active Directory Certificate Services (AD CS) and have not assessed exposure to CVE-2026-54121. Whether a patch exists is not confirmed in the material available to us.
• You run 1C:Enterprise servers with insecure configurations, or where support staff and administrators with elevated Active Directory privileges access them.
• Your directory contains machine accounts named GHOST plus random letters, or a Group Policy Object or scheduled task with the Kaspersky-themed names above that you did not create.

What to do now

1. Review VPN and RDP logins from contractor accounts, and consider whether those accounts need the access they have. Kaspersky says stolen contractor credentials were the entry point.
2. Search Active Directory for machine accounts matching GHOST followed by 8 random letters. Kaspersky reports these as a sign of exploit attempts against CVE-2026-54121.
3. On your AD CS server, look for certificate requests using the Machine template whose Attributes field contains a cdc value pointing to an unexpected system. Kaspersky reports 91.210.109[.]118 as the address used in one case.
4. Check for a Group Policy Object named Kaspersky GPO, scheduled tasks named KasperskyAgentInstallTask or Sysvc, and files such as KasperskyGPO_Deploy_64.exe or KasperskyAgentInstaller.exe that your security team did not deploy. Genuine Kaspersky software may use similar names, so confirm provenance before concluding anything.
5. Review 1C:Enterprise server configurations and who holds elevated Active Directory privileges while accessing them, as Kaspersky says insecure configurations were of interest to the attackers.
6. Read the full Securelist report, including its indicators of compromise, and compare them against your logs: Kaspersky Securelist.

Sources

• Kaspersky Securelist: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand