# Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)

> Kaspersky Securelist documents Citrus, a previously undocumented Russian-speaking group that targets only Russian companies. It gains access with credentials stolen from contractor employees, tunnels traffic with Xray reverse VLESS over port 443 with REALITY, and deploys Sn00py ransomware through malicious Group Policy Objects.

- **Published:** 2026-11-11T10:34:58Z
- **Last reviewed:** 2026-11-11T10:34:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5752
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5752.png
- **ID:** TL-2026-5752
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Citrus
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)
- **CVEs:** CVE-2026-54121, CVE-2020-1337

## Description

Citrus is a Russian-speaking ransomware group, first documented by Kaspersky (Securelist, 2026-11-11), that attacks only Russian companies. Initial access is obtained with valid credentials stolen from contractor employees, used against corporate VPNs or internet-facing RDP terminal servers. Operators work with cmd, PowerShell and batch scripts; Kaspersky notes that some scripts and commands appear LLM-generated based on comments typical of model output. Impacket atexec is used to create scheduled tasks (sIErKswD, PpMBCCSR, QwZtLmNp), and external data processors (1C-Shell) are used on 1C:Enterprise servers.

Privilege escalation relies on CVE-2026-54121 (Certighost), an AD CS authentication bypass in the CA 'chase' fallback lookup: the operators created machine accounts named GHOST plus random letters, pointed the cdc attribute of forged certificate requests at 91.210.109.118 and set the SAN to a domain controller, allowing impersonation of the DC account. CVE-2020-1337 (Windows Print Spooler EoP, a bypass of the PrintDemon CVE-2020-1048 fix) is also used via a Metasploit-style component, alongside insecure 1C:Enterprise configurations and privileged support/admin accounts. Credential access uses a modified peeping-tom keylogger (jhost.exe, log ErrorLog.txt, data sent to 91.210.109.118), mimikatz, Snaffler and KeePass databases on admin workstations. Discovery uses fscan (ports 135, 139, 1433, 8006), ADRecon, SharpHound and net commands. Lateral movement uses SSH, WinRM and RDP.

C2 and tunneling use Xray reverse VLESS tunnels on port 443 with REALITY configured to mimic mirror.yandex.ru and yastatic.net, plus silently installed AnyDesk. Tools are disguised under legitimate-looking names (including Kaspersky, WebEx, Java names), event logs are cleared with wevtutil, Defender is disabled via GPO and tools are added to AV exclusions. On domain controllers, steal_tgs.ps1 collects Telegram Desktop tdata, packed with 7-Zip into <system>_<date>_<user>_tdata.zip archives and uploaded to an external web service via Chrome.

Impact is delivered by Sn00py, a Go ransomware (RSA-2048 + ChaCha20) appending .citrus to user files and dropping CITRUS_README.txt (72-hour contact demand via ProtonMail and Telegram, data-leak threat). Its console banner reads 'Made with RaaS platform Sn00py', suggesting a RaaS model. Deployment is through a malicious 'Kaspersky GPO' created with Import-GPO/New-GPLink from SYSVOL, which creates a scheduled task, enables WinRM, disables VSS and Defender and sets a ransom wallpaper; a host_blacklist exempts DC01-DC04 so the GPO keeps propagating. Kaspersky reports shared TTPs and tooling with Toy Ghouls (1C-Shell, mimikatz, PsExec, ADRecon, shared tool directories, simultaneous compromise of the same infrastructure) though infrastructures do not directly overlap. No nation-state attribution is claimed.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1649 Steal or Forge Authentication Certificates
- T1484.001 Group Policy Modification
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1036 Masquerading
- T1056.001 Keylogging
- T1046 Network Service Discovery
- T1021.001 Remote Desktop Protocol
- T1021.006 Windows Remote Management
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Citrus Certighost (CVE-2026-54121) AD CS Exploitation - GHOST Machine Account and CDC Certificate Request** (`TL-2026-5752-SPL-001`)

Detects the Certighost (CVE-2026-54121) privilege-escalation chain used by Citrus: creation of machine accounts named GHOST plus random letters (Event 4741) and AD CS certificate requests (Events 4886/4887) carrying a cdc attribute or the attacker server 91.210.109.118. Chain completion on the same host means a forged certificate request impersonating a domain controller account is likely.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1649, T1068, T1078
- **Data sources:** windows_security, active_directory_certificate_services, wineventlog:WinEventLog:Security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h ((EventCode=4741 SAM_Account_Name="GHOST*") OR (EventCode IN (4886,4887) (Attributes="*cdc:*" OR "91.210.109.118")))
| eval phase=if(EventCode=4741,"ghost_machine_account_created","adcs_request_with_cdc_or_attacker_ip")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(phase) as phases values(SAM_Account_Name) as ghost_accounts values(Requester) as requesters values(Attributes) as request_attributes count by host
| eval chain_complete=if(mvcount(phases)>1,"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host phases ghost_accounts requesters request_attributes chain_complete count
```

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where (EventID == 4741 and SamAccountName startswith "GHOST")
    or (EventID in (4886, 4887) and (EventData has "cdc:" or EventData has "91.210.109.118"))
| extend Phase = iff(EventID == 4741, "ghost_machine_account_created", "adcs_request_with_cdc_or_attacker_ip")
| project TimeGenerated, Computer, EventID, Phase, SamAccountName, SubjectAccount, EventData
```

### Sigma

```yaml
title: Certighost CVE-2026-54121 AD CS Exploitation - GHOST Machine Account or CDC Certificate Request
id: 7c1e5a3d-2b4f-4e8a-9a61-3f0d5b7e1a01
status: experimental
description: Detects creation of machine accounts named GHOST plus random letters and AD CS certificate requests carrying a cdc attribute or the Citrus server 91.210.109.118, as used to exploit Certighost (CVE-2026-54121).
references:
  - https://securelist.com/citrus-ransomware/121879/
  - https://kudelskisecurity.com/research/certighost
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.credential_access
  - attack.t1649
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.54121
logsource:
  product: windows
  service: security
detection:
  selection_ghost_account:
    EventID: 4741
    SamAccountName|startswith: 'GHOST'
  selection_cdc_request:
    EventID:
      - 4886
      - 4887
    Attributes|contains:
      - 'cdc:'
      - '91.210.109.118'
  condition: 1 of selection_*
falsepositives:
  - Legitimate computers whose names start with GHOST (for example imaging or Ghost-based tooling)
  - Legitimate certificate requests using a chase client DC attribute
level: critical
```

**Known false positives:**

- Legitimate computers or imaging tools using a GHOST-prefixed machine account name
- Authorized certificate requests that legitimately specify a cdc attribute

**Tuning notes:** Enable Certification Services auditing (Issued/Denied requests, Events 4886/4887) on all CAs and Computer Account Management auditing on DCs. Allow-list known GHOST-named assets. Apply the July 2026 AD CS updates and reduce ms-DS-MachineAccountQuota; treat chain_complete=yes as critical.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Citrus Initial Access - External RDP/VPN Logon Followed by Tool Download (locked: unlock with TL Creds)
- Citrus Credential Access and Collection - peeping-tom Keylogger, mimikatz, Snaffler, Telegram tdata Theft (locked: unlock with TL Creds)
- Citrus Discovery and Lateral Movement - fscan, SharpHound, ADRecon, WinRM Enablement and Management-Port Fan-out (locked: unlock with TL Creds)
- Citrus Print Spooler Privilege Escalation (CVE-2020-1337) - Spooler Child Shells and mimispool.dll (locked: unlock with TL Creds)
- Citrus Defense Evasion - Event Log Clearing, Defender Tampering and VSS Inhibition (locked: unlock with TL Creds)
- Citrus Sn00py Ransomware GPO Deployment and Impact (Kaspersky GPO, build_64.exe, [indicator]) (locked: unlock with TL Creds)
- Citrus Impacket atexec and Malicious Scheduled Tasks (sIErKswD, PpMBCCSR, QwZtLmNp, KasperskyAgentInstallTask) (locked: unlock with TL Creds)
- Citrus Xray Reverse VLESS/REALITY Tunnel and Silent AnyDesk Install (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `91.210.109[.]118`
- Domain: `mirror[.]yandex[.]ru`
- File hash: `d631627131b90d576d77f4bf530e1abe`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand](https://securelist.com/citrus-ransomware/121879/)
- [Certighost (CVE-2026-54121) - Kudelski Security](https://kudelskisecurity.com/research/certighost)
- [PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121)](https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/)
- [Dataminr Intel Brief: Certighost CVE-2026-54121](https://www.dataminr.com/resources/intel-brief/certighost-cve-2026-54121/)
- [CVE-2020-1337 - AttackerKB](https://attackerkb.com/topics/cve-2020-1337)
- [CVE-2020-1337 Windows Print Spooler EoP - FortiGuard](https://www.fortiguard.com/encyclopedia/endpoint-vuln/64675)
- [CVE-2020-1337 - GCVE/CIRCL record](https://vulnerability.circl.lu/vuln/cve-2020-1337)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5752