{"id":"CMP-202611-bixdrl","kind":"campaign","aliases":[],"related":[],"title":"Citrus ransomware gang gets in through contractors' stolen VPN/RDP logins, abuses the Certighost AD CS flaw for domain control, and pushes Sn00py ransomware via a fake 'Kaspersky GPO' (Kaspersky)","description":null,"summary":"Kaspersky (Securelist, 11 Nov 2026) documents Citrus Ransomware, a group it had not seen before and links to Toy Ghouls. It logs in with stolen credentials of contractors' employees, either to corporate VPNs or straight to internet-facing RDP terminal servers. It then tries the AD CS authentication bypass CVE-2026-54121 (Certighost) with a public GitHub exploit to get a domain controller certificate, plus CVE-2020-1337 via Metasploit, and abuses badly configured 1C:Enterprise servers. Other tools: LLM-written PowerShell scripts, Impacket atexec, mimikatz, a peeping-tom keylogger, Snaffler, ADRecon/SharpHound, fscan, Xray VLESS tunnels and AnyDesk. It switches off antivirus through security management consoles and a GPO, then deploys Sn00py ransomware through a Group Policy Object named 'Kaspersky GPO'. Victims are not named. The 1C and Russian-language artifacts point to Russian-speaking organisations, but Kaspersky does not say so outright. Start date unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T10:41:58+00:00","products":[{"name":"Active Directory Certificate Services","fixed":[],"ecosystem":"windows"},{"name":"1C:Enterprise","fixed":[]},{"name":"Windows Remote Desktop","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning","ransomware"],"not_affected_if":[],"how_to_check":"In AD, look for machine accounts named GHOST followed by 8 random letters (e.g. GHOSTAUFTAFGS, GHOSTCZYQVAZS, GHOSTIVPRLDZA) and AD CS Machine-template certificate requests whose SAN names a domain controller or that carry cdc: 91.210.109[.]118. Check network logs for traffic to 91.210.109[.]118. Look for a GPO named 'Kaspersky GPO'; files KasperskyGPO_Deploy_64.exe, KasperskyGPO_Deploy_64_FIXED.exe, Deploy-KasperskyGPO.ps1, KasperskyAgentInstaller.exe, KasperskyAgent.exe, agent.exe, Kaspersky_GPO_Deployment.log; scheduled tasks KasperskyAgentInstallTask, Sysvc, sIErKswD, PpMBCCSR, QwZtLmNp; C:\\ProgramData\\Oracle\\Java\\jhost.exe with %APPDATA%\\Microsoft\\CLR\\ErrorLog.txt; mimikatz files in C:\\ProgramData\\x64\\. Also check for unexpected Xray/VLESS or AnyDesk and for wevtutil log clearing.","fix":"Patch AD CS against CVE-2026-54121 (Certighost) and CVE-2020-1337. Require MFA on VPN and RDP for contractor accounts, and review or disable unused contractor access. Take RDP terminal servers off the internet. Lock down 1C:Enterprise server configuration. Restrict and alert on who can create machine accounts (set ms-DS-MachineAccountQuota to 0), who can change GPOs, and who can sign in to the AV/EDR management console. Keep offline backups.","status":"open","published_at":null,"first_seen_at":"2026-11-11T10:41:58+00:00","triaged_at":"2026-11-11T10:41:58+00:00","updated_at":"2026-11-11T10:42:27+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-11T10:45:18Z","path":"unknown","entry":"stolen-credential","reason":"The summary says the group logs in with stolen credentials of contractors' employees, either to corporate VPNs or directly to internet-facing RDP terminal servers, but it does not say whether the incident reached customers, users or dependents of the victims.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-1337':115B '-2020':114B '-2026':98B '-202611':31A '-54121':99B '11':49B '1c':37A,122B,176B '2026':51B 'abus':11A,119B 'active':33A 'ad':14A,93B 'adrecon/sharphound':141B 'antivirus':151B 'anydesk':147B 'artifact':181B 'atexec':133B 'authent':95B 'bad':120B 'bixdrl':32A 'bypass':96B 'campaign':42B 'certif':111B 'certificate':35A 'certighost':13A,100B 'citrus':1A,53B 'cmp':30A 'configur':121B 'consol':155B 'contractor':7A,74B 'control':19A,110B 'corpor':78B 'credenti':72B 'cs':15A,94B 'cve':97B,113B 'date':196B 'deploy':160B 'desktop':41A 'directory':34A 'document':52B 'domain':18A,109B 'earli':44B 'early-warn':43B 'either':76B 'employe':75B 'enterpris':123B 'enterprise':38A 'exploit':105B 'face':85B 'fake':26A 'flaw':16A 'fscan':142B 'gang':3A 'get':4A,107B 'ghoul':66B 'github':104B 'gpo':28A,158B,170B 'group':56B,165B 'impacket':132B 'internet':84B 'internet-fac':83B 'kasperski':27A,29A,47B,169B,189B 'keylogg':139B 'languag':180B 'link':63B 'llm':128B 'llm-written':127B 'log':68B 'login':10A 'manag':154B 'metasploit':117B 'mimikatz':134B 'name':168B,174B 'nov':50B 'object':167B 'organis':187B 'outright':194B 'peep':137B 'peeping-tom':136B 'plus':112B 'point':182B 'polici':166B 'powershel':130B 'public':103B 'push':21A 'ransomwar':2A,23A,46B,54B,162B 'rdp':86B 'remote':40A 'russian':179B,185B 'russian-languag':178B 'russian-speak':184B 'say':192B 'script':131B 'secur':153B 'securelist':48B 'seen':60B 'server':88B,124B 'services':36A 'sn00py':22A,161B 'snaffler':140B 'speak':186B 'start':195B 'stolen':8A,71B 'straight':81B 'switch':149B 'termin':87B 'tom':138B 'tool':126B 'toy':65B 'tri':91B 'tunnel':145B 'unknown':197B 'via':24A,116B 'victim':171B 'vless':144B 'vpn/rdp':9A 'vpns':79B 'warn':45B 'windows':39A 'written':129B 'xray':143B","nicknames":["Citrus Ransomware","Sn00py","Toy Ghouls"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["1centerprise","activedirectorycertificateservices","citrusransomware","directorycertificateservices","remotedesktop","sn00py","toyghouls","windowsremotedesktop"],"ptokens":["1c","active","certificate","desktop","directory","enterprise","remote","services","windows"],"labels":["campaign","earlywarning","high","other","ransomware"],"campaign_type":"exploitation","search_a":"'-202611':31A '1c':37A 'abus':11A 'active':33A 'ad':14A 'bixdrl':32A 'certificate':35A 'certighost':13A 'citrus':1A 'cmp':30A 'contractor':7A 'control':19A 'cs':15A 'desktop':41A 'directory':34A 'domain':18A 'enterprise':38A 'fake':26A 'flaw':16A 'gang':3A 'get':4A 'gpo':28A 'kasperski':27A,29A 'login':10A 'push':21A 'ransomwar':2A,23A 'remote':40A 'services':36A 'sn00py':22A 'stolen':8A 'via':24A 'vpn/rdp':9A 'windows':39A","search_b":"'-1337':115B '-2020':114B '-2026':98B '-54121':99B '11':49B '1c':122B,176B '2026':51B 'abus':119B 'ad':93B 'adrecon/sharphound':141B 'antivirus':151B 'anydesk':147B 'artifact':181B 'atexec':133B 'authent':95B 'bad':120B 'bypass':96B 'campaign':42B 'certif':111B 'certighost':100B 'citrus':53B 'configur':121B 'consol':155B 'contractor':74B 'control':110B 'corpor':78B 'credenti':72B 'cs':94B 'cve':97B,113B 'date':196B 'deploy':160B 'document':52B 'domain':109B 'earli':44B 'early-warn':43B 'either':76B 'employe':75B 'enterpris':123B 'exploit':105B 'face':85B 'fscan':142B 'get':107B 'ghoul':66B 'github':104B 'gpo':158B,170B 'group':56B,165B 'impacket':132B 'internet':84B 'internet-fac':83B 'kasperski':47B,169B,189B 'keylogg':139B 'languag':180B 'link':63B 'llm':128B 'llm-written':127B 'log':68B 'manag':154B 'metasploit':117B 'mimikatz':134B 'name':168B,174B 'nov':50B 'object':167B 'organis':187B 'outright':194B 'peep':137B 'peeping-tom':136B 'plus':112B 'point':182B 'polici':166B 'powershel':130B 'public':103B 'ransomwar':46B,54B,162B 'rdp':86B 'russian':179B,185B 'russian-languag':178B 'russian-speak':184B 'say':192B 'script':131B 'secur':153B 'securelist':48B 'seen':60B 'server':88B,124B 'sn00py':161B 'snaffler':140B 'speak':186B 'start':195B 'stolen':71B 'straight':81B 'switch':149B 'termin':87B 'tom':138B 'tool':126B 'toy':65B 'tri':91B 'tunnel':145B 'unknown':197B 'via':116B 'victim':171B 'vless':144B 'vpns':79B 'warn':45B 'written':129B 'xray':143B","search_c":"","cause_entry":"stolen-credential","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-bixdrl","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T10:41:58+00:00","fetched_at":"2026-11-11T10:41:58+00:00","note":null}],"documents":[{"id":124623,"url":"https://securelist.com/citrus-ransomware/121879/","title":"Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand","kind":"blog","source":"blog","publisher":null,"text":"Kaspersky Securelist (Larinsky, Vlasov, Trefilov), 11 Nov 2026. Previously undocumented Citrus Ransomware group, linked to Toy Ghouls. Initial access via stolen contractor employee credentials to corporate VPN or internet-facing RDP terminal servers. LLM-generated PowerShell commands/scripts; Impacket atexec scheduled tasks (sIErKswD, PpMBCCSR, QwZtLmNp); 1C:Enterprise servers abused via external data processors (1C-Shell). Privilege escalation: tries CVE-2026-54121 (Certighost) AD CS auth bypass using public GitHub exploit, creating machine accounts named GHOST + 8 random letters (GHOSTAUFTAFGS, GHOSTCZYQVAZS, GHOSTIVPRLDZA), Machine template cert requests with cdc: 91.210.109[.]118; CVE-2020-1337 via Metasploit. Masquerade as Kaspersky: KasperskyGPO_Deploy_64.exe, KasperskyGPO_Deploy_64_FIXED.exe, Deploy-KasperskyGPO.ps1, KasperskyAgent.exe, agent.exe, KasperskyAgentInstaller.exe, GPO 'Kaspersky GPO', tasks KasperskyAgentInstallTask and Sysvc, log Kaspersky_GPO_Deployment.log. Clears logs with wevtutil, disables AV, abuses security management consoles, GPO disabling Windows Defender, AV exclusions. Keylogger (modified peeping-tom) C:\\ProgramData\\Oracle\\Java\\jhost.exe, log AppData\\Roaming\\Microsoft\\CLR\\ErrorLog.txt, exfil to 91.210.109[.]118. mimikatz in C:\\ProgramData\\x64\\. Snaffler, KeePass. fscan (ports 135,139,1433,8006 Proxmox), ADRecon, SharpHound. Lateral via SSH, WinRM, RDP. Xray VLESS tunnels, AnyDesk. Exfil of messaging app data. Impact: Sn00py ransomware distributed by GPO.","published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}