Citrus Ransomware Leverages LLMs, VLESS Tunnels, and Sn00py for Hybrid Attacks
A new ransomware group, dubbed Citrus, employs a sophisticated hybrid attack strategy combining VLESS tunnels for traffic obfuscation, Sn00py ransomware, and large language models for infrastructure compromise.
A previously undocumented ransomware group, operating under the name Citrus, has emerged with a complex and multi-faceted attack methodology. This group distinguishes itself by integrating cutting-edge techniques with established cybercriminal tactics, creating a formidable threat. Their arsenal includes VLESS tunnels, a method for disguising malicious traffic as legitimate HTTPS, and the Sn00py ransomware family for encryption. Notably, Citrus actively incorporates large language models (LLMs) to automate and enhance various stages of their infrastructure compromise, from disabling administrator accounts to enumerating active network sessions.
Initial access for Citrus is typically achieved through compromised contractor credentials. Attackers leverage these stolen credentials to gain entry into corporate VPNs or directly access internet-facing terminal servers via Remote Desktop Protocol (RDP). Once inside, they employ standard Windows command-line tools and PowerShell for initial execution. As the attack progresses, the group increasingly relies on LLM-generated scripts and commands, often complete with comments that are characteristic of AI output. One such example involved commands designed to disable administrator accounts, demonstrating the group's ability to automate critical system modifications.
The LLM integration extends beyond simple command generation. Citrus has been observed using these models to produce entire scripts, including those for enumerating active user sessions across domain systems. These scripts, often featuring comments like "Creating background tasks for each computer with a thread limit," strongly suggest AI assistance. Furthermore, the attackers utilize atexec, a tool from the Impacket collection, to establish persistence through scheduled tasks, which are likely used to execute commands such as gpupdate /force to refresh Group Policy settings across compromised systems.
Persistence is a key element of Citrus's operations, primarily achieved through the creation of scheduled tasks. These tasks are manually configured by the attackers using PowerShell, ensuring their malicious tools are launched automatically. In environments where systems, such as terminal servers, are not frequently rebooted, the attackers may forgo establishing persistence altogether, opting instead to run their tools directly.
Privilege escalation is a critical step for Citrus, as initial access is usually gained with limited contractor account privileges. The group actively attempts to exploit the authentication bypass vulnerability CVE-2026-54121, also known as Certighost. Successful exploitation of this vulnerability results in the creation of machine accounts in Active Directory with distinctive names, often prefixed with "GHOST," followed by random letters. These accounts are then used to request certificates from the Active Directory Certificate Services (AD CS) role, enabling attackers to authenticate as domain controller accounts.
Beyond exploiting known vulnerabilities, Citrus also targets 1C:Enterprise servers that suffer from insecure configurations. These systems are often accessed by support staff and administrators with elevated privileges, making them prime targets for privilege escalation and lateral movement once compromised. The attackers also demonstrate a focus on stealth, actively deleting their tools and output files, and clearing command histories to hinder incident response efforts. Auxiliary files and executables are often given legitimate-sounding names, such as KasperskyGPO_Deploy_64.exe, to evade detection.
In one observed instance, attackers uploaded an executable that appeared to be a component of the Metasploit framework. PowerShell scripts executed through this file included an exploit for CVE-2020-1337, further indicating the use of publicly available exploit tools. The hybrid nature of Citrus's attacks, combining obfuscation techniques like VLESS tunnels with LLM-driven automation and known exploits, presents a significant challenge for defenders. Their ability to adapt and integrate new technologies into their existing toolkit underscores the evolving landscape of ransomware threats.