ACTIVE DIRECTORY CERTIFICATE SERVICES · CMP-202611-bixdrl · Other
NO FIX YET · SEE WHAT TO DO
Kaspersky (Securelist, 11 Nov 2026) documents Citrus Ransomware, a group it had not seen before and links to Toy Ghouls. It logs in with stolen credentials of contractors' employees, either to corporate VPNs or straight to internet-facing RDP terminal servers. It then tries the AD CS authentication bypass CVE-2026-54121 (Certighost) with a public GitHub exploit to get a domain controller certificate, plus CVE-2020-1337 via Metasploit, and abuses badly configured 1C:Enterprise servers. Other tools: LLM-written PowerShell scripts, Impacket atexec, mimikatz, a peeping-tom keylogger, Snaffler, ADRecon/SharpHound, fscan, Xray VLESS tunnels and AnyDesk. It switches off antivirus through security management consoles and a GPO, then deploys Sn00py ransomware through a Group Policy Object named 'Kaspersky GPO'. Victims are not named. The 1C and Russian-language artifacts point to Russian-speaking organisations, but Kaspersky does not say so outright. Start date unknown.
first public Nov 11, 2026
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Who cares ransomware
Kaspersky GPO; files KasperskyGPO_Deploy_64.exe, KasperskyGPO_Deploy_64_FIXED.exe, Deploy-KasperskyGPO.ps1, KasperskyAgentInstaller.exe, KasperskyAgent.exe, agent.exe, Kaspersky_GPO_Deployment.log; scheduled tasks KasperskyAgentInstallTask, Sysvc, sIErKswD, PpMBCCSR, QwZtLmNp; C:\ProgramData\Oracle\Java\jhost.exe with %APPDATA%\Microsoft\CLR\ErrorLog.txt; mimikatz files in C:\ProgramData\x64\Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.