Kaspersky describes Citrus, a ransomware group that gets in through contractors and uses AI-written commands

Kaspersky’s Securelist published a report on November 11, 2026 on a previously undocumented ransomware group it calls Citrus. The attackers get their first foothold through compromised contractors, hide command-and-control traffic in tunnels that look like ordinary HTTPS, and use a ransomware strain from the Sn00py family to encrypt files. Kaspersky also says the group has used large language models to help write some of the commands and scripts it runs. Here’s what the researchers found, and why contractor access is the part worth taking seriously.

How the attacks start

In the incidents Kaspersky reviewed, Citrus did not begin with a public-facing exploit at the victim company itself. The attackers used credentials stolen from employees of the company’s contractors to connect to corporate VPNs, or to internet-facing terminal servers over RDP.

Once inside, they ran commands through the ordinary Windows command interpreter and PowerShell, and created scheduled tasks to keep their tools around. Kaspersky says some of the commands and even full scripts look like they were produced by a language model: they come with the kind of explanatory comments attackers rarely bother to write by hand, including notes such as “Disable account” and “Verify result.”

The group also used familiar administrator tools, including Impacket’s atexec to run commands through scheduled tasks, and, on 1C:Enterprise servers, external data processors known as 1C-Shell.

What happens after that

To move around and stay hidden, Citrus leans on well-known techniques mixed with a less common way of tunnelling traffic. Kaspersky describes VLESS tunnels, set up with a tool called Xray, used to disguise command-and-control traffic as regular HTTPS. The attackers also installed AnyDesk, collected credentials with tools such as mimikatz and a keylogger, and in some cases tried to escalate privileges, including attempts to exploit an authentication-bypass vulnerability tracked as CVE-2026-54121 (Certighost).

When they are ready to encrypt, they use ransomware from the Sn00py family. Kaspersky says the strain is written in Go and uses RSA-2048 and ChaCha20 to encrypt user files, but not system files, on Windows. Encrypted files get a .citrus extension. For now, the researchers say, decryption is impossible without the attackers’ private key. A string in the ransomware’s console output, “Made with RaaS platform Sn00py,” suggests the encryptor is sold as ransomware-as-a-service rather than written by Citrus itself.

Links to another group, and who is being targeted

Kaspersky noticed several similarities to a group it tracks as Toy Ghouls. The two groups’ infrastructures don’t overlap directly, but they share tactics and tools, store those tools in the same directories, and are both Russian-speaking. Kaspersky says both groups have so far attacked Russian companies only, and that in several incidents the same infrastructure was compromised by both groups at once.

That targeting matters for readers outside Russia: this is not, on the evidence Kaspersky has published, a global consumer outbreak. The useful lesson travels anyway. The way in was contractor access that had not been tightly limited.

What you can do

1. If you hire contractors who connect to your network, give them only the access they need, on accounts you can revoke quickly, with multifactor authentication and its own logging.
2. Treat unused or standing VPN and RDP access as a risk, especially on internet-facing terminal servers.
3. Watch for unexpected remote-access software such as a new AnyDesk install, and for encrypted files with a .citrus extension.
4. Keep offline backups that ransomware running on the main network cannot reach, and test that they restore.
5. If you don’t run a company network, there’s nothing you need to change on your own devices because of this report.

How Frame helps

Citrus has been seen in attacks on company networks, not as a published list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan corporate networks.

Related coverage

• Kaspersky: reused root passwords and monitoring access let ransomware hit ESXi and Proxmox: another recent Kaspersky report on how ransomware groups abuse everyday access and configuration mistakes.
• A researcher published 33 N-central flaws with working exploits, and N-able took the service offline: a reminder that tools used to manage many customer networks are high-value targets.
• Symantec: AI helped attackers revive a stalled break-in at a US retailer: a separate report this week on attackers using AI-written scripts in the middle of an intrusion.

Sources

• Kaspersky Securelist, Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand, November 11, 2026