---
id: "CMP-202611-bixdrl"
page: "https://infrastack.ai/live/CMP-202611-bixdrl"
kind: "campaign"
aliases: []
title: "Citrus ransomware gang gets in through contractors' stolen VPN/RDP logins, abuses the Certighost AD CS flaw for domain control, and pushes Sn00py ransomware via a fake 'Kaspersky GPO' (Kaspersky)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Active Directory Certificate Services", "fixed": [], "ecosystem": "windows"}, {"name": "1C:Enterprise", "fixed": []}, {"name": "Windows Remote Desktop", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning", "ransomware"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T10:41:58+00:00"
updated_at: "2026-11-11T10:42:27+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-11T10:41:58+00:00"}]
exploit_sources: []
---

# Citrus ransomware gang gets in through contractors' stolen VPN/RDP logins, abuses the Certighost AD CS flaw for domain control, and pushes Sn00py ransomware via a fake 'Kaspersky GPO' (Kaspersky)

Link for people: https://infrastack.ai/live/CMP-202611-bixdrl (this .md is for agents)

Kaspersky (Securelist, 11 Nov 2026) documents Citrus Ransomware, a group it had not seen before and links to Toy Ghouls. It logs in with stolen credentials of contractors' employees, either to corporate VPNs or straight to internet-facing RDP terminal servers. It then tries the AD CS authentication bypass CVE-2026-54121 (Certighost) with a public GitHub exploit to get a domain controller certificate, plus CVE-2020-1337 via Metasploit, and abuses badly configured 1C:Enterprise servers. Other tools: LLM-written PowerShell scripts, Impacket atexec, mimikatz, a peeping-tom keylogger, Snaffler, ADRecon/SharpHound, fscan, Xray VLESS tunnels and AnyDesk. It switches off antivirus through security management consoles and a GPO, then deploys Sn00py ransomware through a Group Policy Object named 'Kaspersky GPO'. Victims are not named. The 1C and Russian-language artifacts point to Russian-speaking organisations, but Kaspersky does not say so outright. Start date unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- windows:Active Directory Certificate Services affected range not listed fixed no fixed version listed
- :1C:Enterprise affected range not listed fixed no fixed version listed
- :Windows Remote Desktop affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: a stolen credential that still worked (stolen-credential). The summary says the group logs in with stolen credentials of contractors' employees, either to corporate VPNs or directly to internet-facing RDP terminal servers, but it does not say whether the incident reached customers, users or dependents of the victims.

How it reached others: not stated (unknown).

So it does not happen to you: List your long-lived credentials (GitHub tokens, cloud keys, app and service-principal secrets, CI secrets) with their last rotation; rotate anything older than 90 days or without an owner, and set expiry where it is offered.

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#stolen-credential

## How to check

In AD, look for machine accounts named GHOST followed by 8 random letters (e.g. GHOSTAUFTAFGS, GHOSTCZYQVAZS, GHOSTIVPRLDZA) and AD CS Machine-template certificate requests whose SAN names a domain controller or that carry cdc: 91.210.109[.]118. Check network logs for traffic to 91.210.109[.]118. Look for a GPO named 'Kaspersky GPO'; files KasperskyGPO_Deploy_64.exe, KasperskyGPO_Deploy_64_FIXED.exe, Deploy-KasperskyGPO.ps1, KasperskyAgentInstaller.exe, KasperskyAgent.exe, agent.exe, Kaspersky_GPO_Deployment.log; scheduled tasks KasperskyAgentInstallTask, Sysvc, sIErKswD, PpMBCCSR, QwZtLmNp; C:\ProgramData\Oracle\Java\jhost.exe with %APPDATA%\Microsoft\CLR\ErrorLog.txt; mimikatz files in C:\ProgramData\x64\. Also check for unexpected Xray/VLESS or AnyDesk and for wevtutil log clearing.

## Fix

Patch AD CS against CVE-2026-54121 (Certighost) and CVE-2020-1337. Require MFA on VPN and RDP for contractor accounts, and review or disable unused contractor access. Take RDP terminal servers off the internet. Lock down 1C:Enterprise server configuration. Restrict and alert on who can create machine accounts (set ms-DS-MachineAccountQuota to 0), who can change GPOs, and who can sign in to the AV/EDR management console. Keep offline backups.

## Timeline

- 2026-11-11T10:41:58+00:00 analyst

## Documents

- [describes] Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand https://securelist.com/citrus-ransomware/121879/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_