---
title: Hunt: Citrus ransomware enters through contractor accounts, tries Certighost for domain admin, tunnels over Xray VLESS and pushes Sn00py by a fake 'Kaspersky GPO' | ctxsec
url: https://ctxsec.com/items/hunt-kaspersky-citrus-ransomware-contractor-vpn-certighost-ghost-accounts-xray-vless-kaspersky-gpo
description: "Kaspersky describes Citrus, a previously undocumented Russian-speaking ransomware group that has only hit Russian companies and shares tools and habits with Toy Ghouls. It logs in with stolen contractor credentials over VPN or internet-facing RDP, uses LLM-written PowerShell and batch scripts, steals Telegram Desktop session data before encrypting, and deploys a Go ransomware from the Sn00py RaaS family (.citrus extension, CITRUS_README.txt) through a malicious Group Policy Object. The techniques are generic enough to hunt for anywhere."
status: "vendor research (Kaspersky Securelist, Nov 11, 2026); victims observed are Russian companies"
published: 2026-11-11
---

> Kaspersky describes Citrus, a previously undocumented Russian-speaking ransomware group that has only hit Russian companies and shares tools and habits with Toy Ghouls. It logs in with stolen contractor credentials over VPN or internet-facing RDP, uses LLM-written PowerShell and batch scripts, steals Telegram Desktop session data before encrypting, and deploys a Go ransomware from the Sn00py RaaS family (.citrus extension, CITRUS_README.txt) through a malicious Group Policy Object. The techniques are generic enough to hunt for anywhere.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-kaspersky-citrus-ransomware-contractor-vpn-certighost-ghost-accounts-xray-vless-kaspersky-gpo.md)

vendor research (Kaspersky Securelist, Nov 11, 2026); victims observed are Russian companies

2026-11-11 7:44 AM ET

### Hunt: Citrus ransomware enters through contractor accounts, tries Certighost for domain admin, tunnels over Xray VLESS and pushes Sn00py by a fake 'Kaspersky GPO'

- **Privilege escalation:** attempts at the AD CS bypass CVE-2026-54121 (Certighost) create machine accounts named `GHOST` plus 8 random letters, then request Machine-template certificates whose SAN names a domain controller and whose `cdc` attribute points to an attacker host.
- **Tunnels:** Xray with reverse VLESS on port 443 using REALITY to mimic `mirror.yandex.ru` or `yastatic.net`; binaries named `mst.exe`, `sabycenter.exe`, `webex.exe`, `rpchost.exe`; silent AnyDesk installs.
- **Tooling:** Impacket atexec tasks running `cmd.exe` through odd paths, fscan (watch for scans of 8006/Proxmox and 1433), ADRecon, SharpHound, Snaffler, mimikatz in `C:\ProgramData\x64`, a keylogger at `C:\ProgramData\Oracle\Java\jhost.exe`, `steal_tgs.ps1` zipping `tdata` folders.
- **Deployment:** self-extracting archives named `KasperskyGPO_Deploy_64.exe`, a GPO called 'Kaspersky GPO' linked with `Import-GPO`/`New-GPLink`, tasks `KasperskyAgentInstallTask` or `Sysvc`, files in SYSVOL, Defender and VSS disabled by policy, security consoles used to switch off protection.
- **IPs:** 91.210.109[.]118, 91.210.108[.]180. Hashes are in the report.
- **Lesson:** contractor accounts were the way in every time; give them their own MFA, narrow network scope and expiry.

Sources: [Kaspersky Securelist: Citrus Ransomware, VLESS for traffic, Sn00py for encryption, and LLMs lending a hand (Nov 11, 2026)](https://securelist.com/citrus-ransomware/121879/)