Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5752 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Citrus Certighost (CVE-2026-54121) AD CS Exploitation - GHOST Machine Account and CDC Certificate Request

Detects the Certighost (CVE-2026-54121) privilege-escalation chain used by Citrus: creation of machine accounts named GHOST plus random letters (Event 4741) and AD CS certificate requests (Events 4886/4887) carrying a cdc attribute or the attacker server 91.210.109.118. Chain completion on the same host means a forged certificate request impersonating a domain controller account is likely.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1649, T1068, T1078
• Data sources: windows_security, active_directory_certificate_services, wineventlog:WinEventLog:Security
• Severity: critical
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h ((EventCode=4741 SAM_Account_Name="GHOST*") OR (EventCode IN (4886,4887) (Attributes="*cdc:*" OR "91.210.109.118")))
| eval phase=if(EventCode=4741,"ghost_machine_account_created","adcs_request_with_cdc_or_attacker_ip")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(phase) as phases values(SAM_Account_Name) as ghost_accounts values(Requester) as requesters values(Attributes) as request_attributes count by host
| eval chain_complete=if(mvcount(phases)>1,"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host phases ghost_accounts requesters request_attributes chain_complete count

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(24h)
| where (EventID == 4741 and SamAccountName startswith "GHOST")
    or (EventID in (4886, 4887) and (EventData has "cdc:" or EventData has "91.210.109.118"))
| extend Phase = iff(EventID == 4741, "ghost_machine_account_created", "adcs_request_with_cdc_or_attacker_ip")
| project TimeGenerated, Computer, EventID, Phase, SamAccountName, SubjectAccount, EventData

Sigma

title: Certighost CVE-2026-54121 AD CS Exploitation - GHOST Machine Account or CDC Certificate Request
id: 7c1e5a3d-2b4f-4e8a-9a61-3f0d5b7e1a01
status: experimental
description: Detects creation of machine accounts named GHOST plus random letters and AD CS certificate requests carrying a cdc attribute or the Citrus server 91.210.109.118, as used to exploit Certighost (CVE-2026-54121).
references:
  - https://securelist.com/citrus-ransomware/121879/
  - https://kudelskisecurity.com/research/certighost
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.credential_access
  - attack.t1649
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.54121
logsource:
  product: windows
  service: security
detection:
  selection_ghost_account:
    EventID: 4741
    SamAccountName|startswith: 'GHOST'
  selection_cdc_request:
    EventID:
      - 4886
      - 4887
    Attributes|contains:
      - 'cdc:'
      - '91.210.109.118'
  condition: 1 of selection_*
falsepositives:
  - Legitimate computers whose names start with GHOST (for example imaging or Ghost-based tooling)
  - Legitimate certificate requests using a chase client DC attribute
level: critical

Known false positives:

• Legitimate computers or imaging tools using a GHOST-prefixed machine account name
• Authorized certificate requests that legitimately specify a cdc attribute

Tuning notes: Enable Certification Services auditing (Issued/Denied requests, Events 4886/4887) on all CAs and Computer Account Management auditing on DCs. Allow-list known GHOST-named assets. Apply the July 2026 AD CS updates and reduce ms-DS-MachineAccountQuota; treat chain_complete=yes as critical.

• 🔒 Citrus Initial Access - External RDP/VPN Logon Followed by Tool Download · unlock with TL Creds
• 🔒 Citrus Credential Access and Collection - peeping-tom Keylogger, mimikatz, Snaffler, Telegram tdata Theft · unlock with TL Creds
• 🔒 Citrus Discovery and Lateral Movement - fscan, SharpHound, ADRecon, WinRM Enablement and Management-Port Fan-out · unlock with TL Creds
• 🔒 Citrus Print Spooler Privilege Escalation (CVE-2020-1337) - Spooler Child Shells and mimispool.dll · unlock with TL Creds
• 🔒 Citrus Defense Evasion - Event Log Clearing, Defender Tampering and VSS Inhibition · unlock with TL Creds
• 🔒 Citrus Sn00py Ransomware GPO Deployment and Impact (Kaspersky GPO, build_64.exe, [indicator]) · unlock with TL Creds
• 🔒 Citrus Impacket atexec and Malicious Scheduled Tasks (sIErKswD, PpMBCCSR, QwZtLmNp, KasperskyAgentInstallTask) · unlock with TL Creds
• 🔒 Citrus Xray Reverse VLESS/REALITY Tunnel and Silent AnyDesk Install · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5752.

Sample indicators (3 of 22)

• IP address: 91.210.109[.]118
• Domain: mirror[.]yandex[.]ru
• File hash: d631627131b90d576d77f4bf530e1abe

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

Technical analysis

Citrus is a Russian-speaking ransomware group, first documented by Kaspersky (Securelist, 2026-11-11), that attacks only Russian companies. Initial access is obtained with valid credentials stolen from contractor employees, used against corporate VPNs or internet-facing RDP terminal servers. Operators work with cmd, PowerShell and batch scripts; Kaspersky notes that some scripts and commands appear LLM-generated based on comments typical of model output. Impacket atexec is used to create scheduled tasks (sIErKswD, PpMBCCSR, QwZtLmNp), and external data processors (1C-Shell) are used on 1C:Enterprise servers.

Privilege escalation relies on CVE-2026-54121 (Certighost), an AD CS authentication bypass in the CA 'chase' fallback lookup: the operators created machine accounts named GHOST plus random letters, pointed the cdc attribute of forged certificate requests at 91.210.109.118 and set the SAN to a domain controller, allowing impersonation of the DC account. CVE-2020-1337 (Windows Print Spooler EoP, a bypass of the PrintDemon CVE-2020-1048 fix) is also used via a Metasploit-style component, alongside insecure 1C:Enterprise configurations and privileged support/admin accounts. Credential access uses a modified peeping-tom keylogger (jhost.exe, log ErrorLog.txt, data sent to 91.210.109.118), mimikatz, Snaffler and KeePass databases on admin workstations. Discovery uses fscan (ports 135, 139, 1433, 8006), ADRecon, SharpHound and net commands. Lateral movement uses SSH, WinRM and RDP.

C2 and tunneling use Xray reverse VLESS tunnels on port 443 with REALITY configured to mimic mirror.yandex.ru and yastatic.net, plus silently installed AnyDesk. Tools are disguised under legitimate-looking names (including Kaspersky, WebEx, Java names), event logs are cleared with wevtutil, Defender is disabled via GPO and tools are added to AV exclusions. On domain controllers, steal_tgs.ps1 collects Telegram Desktop tdata, packed with 7-Zip into <system>_<date>_<user>_tdata.zip archives and uploaded to an external web service via Chrome.

Impact is delivered by Sn00py, a Go ransomware (RSA-2048 + ChaCha20) appending .citrus to user files and dropping CITRUS_README.txt (72-hour contact demand via ProtonMail and Telegram, data-leak threat). Its console banner reads 'Made with RaaS platform Sn00py', suggesting a RaaS model. Deployment is through a malicious 'Kaspersky GPO' created with Import-GPO/New-GPLink from SYSVOL, which creates a scheduled task, enables WinRM, disables VSS and Defender and sets a ransom wallpaper; a host_blacklist exempts DC01-DC04 so the GPO keeps propagating. Kaspersky reports shared TTPs and tooling with Toy Ghouls (1C-Shell, mimikatz, PsExec, ADRecon, shared tool directories, simultaneous compromise of the same infrastructure) though infrastructures do not directly overlap. No nation-state attribution is claimed.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.006 Windows Remote Management

Defense Evasion

T1036 Masquerading

Discovery

T1046 Network Service Discovery

Persistence

T1053.005 Scheduled Task

Credential Access

T1056.001 Keylogging; T1649 Steal or Forge Authentication Certificates

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

defense-impairment

T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Impact

T1490 Inhibit System Recovery

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Patches

• Apply Microsoft July 2026 security updates on all AD CS/CA hosts (CVE-2026-54121)
• Apply Microsoft August 2020 Print Spooler update (CVE-2020-1337)

Immediate actions

• Restrict and monitor contractor access, including VPN and RDP; reset credentials of contractor and privileged support/admin accounts
• Hunt for Xray/VLESS/REALITY tunnels on port 443, unexpected AnyDesk installs, and BITS/certutil/curl tool downloads
• Block 91.210.109.118 and 91.210.108.180 and search for the listed hashes, file paths and scheduled task names
• Review GPOs for unexpected changes (e.g. 'Kaspersky GPO') and SYSVOL for build_64.exe/KasperskyAgent.exe
• Alert on event log clearing, Defender/VSS being disabled and new AV exclusions

Workarounds

• Temporary for CVE-2026-54121 per Kudelski: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC then restart CertSvc (test first)
• Restrict certificate template enrollment permissions for low-privileged users; reduce ms-DS-MachineAccountQuota

Longer-term hardening

• Enforce MFA and least privilege for contractor access and 1C:Enterprise administration
• Monitor AD CS certificate requests from machine accounts with unusual names and suspicious template use
• Harden 1C:Enterprise configurations and restrict external data processors
• Maintain offline, tested backups

Affected and fixed versions

• Microsoft — Active Directory Certificate Services (Windows Server)
  Vulnerable versions: Windows Server with AD CS prior to the July 2026 security updates
  Fixed in: July 14, 2026 security updates
• Microsoft — Windows Print Spooler
  Vulnerable versions: Windows versions prior to the August 2020 security updates
  Fixed in: August 11, 2020 security updates
• 1C — 1C:Enterprise (insecure configurations abused)
  Vulnerable versions: Misconfigured deployments allowing external data processors

Timeline

• 2020-08-11 Microsoft patches CVE-2020-1337 (Print Spooler EoP, bypass of the PrintDemon CVE-2020-1048 fix), later used by Citrus.
• 2026-05-22 Microsoft confirms the AD CS Certighost flaw (CVE-2026-54121) reported by H0j3n and Aniq Fakhrul in May 2026.
• 2026-07-14 Microsoft ships the fix for CVE-2026-54121 in its July 2026 security updates.
• 2026-07-24 Public proof-of-concept exploit for Certighost is released.
• 2026-07-30 Kudelski Security publishes its Certighost advisory and mitigation (disable chase fallback via EDITF_ENABLECHASECLIENTDC).
• 2026-11-11 Kaspersky Securelist publishes the first public analysis of the Citrus group, its VLESS/REALITY tunnels, Sn00py ransomware, GPO deployment and LLM-assisted scripting.

Sources cited

• CVE-2020-1337 - GCVE/CIRCL record vulnerability.circl.lu · Advisory · 2020-08-11
• Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand Kaspersky Securelist · Research · 2026-11-11
• Certighost (CVE-2026-54121) - Kudelski Security kudelskisecurity.com · Research · 2026-07-30
• Dataminr Intel Brief: Certighost CVE-2026-54121 dataminr.com · Vendor report · 2026-07-27
• CVE-2020-1337 - AttackerKB attackerkb.com · Research · 2020-08-11
• CVE-2020-1337 Windows Print Spooler EoP - FortiGuard FortiGuard Labs · Vendor report · 2020-08-11
• PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121) Help Net Security · News · 2026-07-27

More in ransomware

• MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)
• Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%
• Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team
• Vortex ransomware group claims Scripps (US healthcare) on leak site
• Vanderbilt University hit in BYOD ransomware attack, data theft claimed

Other reports on CVE-2026-54121

• Simulating legitimate Active Directory services (SMB/LDAP) on the network: GPO exploitation research (Synacktiv)
• CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonation