vendor research (Kaspersky Securelist, Nov 11, 2026); victims observed are Russian companies
Hunt: Citrus ransomware enters through contractor accounts, tries Certighost for domain admin, tunnels over Xray VLESS and pushes Sn00py by a fake 'Kaspersky GPO'
Privilege escalation: attempts at the AD CS bypass CVE-2026-54121 (Certighost) create machine accounts named GHOST plus 8 random letters, then request Machine-template certificates whose SAN names a domain controller and whose cdc attribute points to an attacker host.
Tunnels: Xray with reverse VLESS on port 443 using REALITY to mimic mirror.yandex.ru or yastatic.net; binaries named mst.exe, sabycenter.exe, webex.exe, rpchost.exe; silent AnyDesk installs.
Tooling: Impacket atexec tasks running cmd.exe through odd paths, fscan (watch for scans of 8006/Proxmox and 1433), ADRecon, SharpHound, Snaffler, mimikatz in C:\ProgramData\x64, a keylogger at C:\ProgramData\Oracle\Java\jhost.exe, steal_tgs.ps1 zipping tdata folders.
Deployment: self-extracting archives named KasperskyGPO_Deploy_64.exe, a GPO called 'Kaspersky GPO' linked with Import-GPO/New-GPLink, tasks KasperskyAgentInstallTask or Sysvc, files in SYSVOL, Defender and VSS disabled by policy, security consoles used to switch off protection.
IPs: 91.210.109[.]118, 91.210.108[.]180. Hashes are in the report.
Lesson: contractor accounts were the way in every time; give them their own MFA, narrow network scope and expiry.