Threat video1:00
Citrus Ransomware Sn00py VLESS Tunnels: Detection & IOCs
Citrus pushes Sn00py ransomware through malicious Group Policy Objects after VLESS tunneling. 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for Citrus Ransomware Sn00py VLESS Tunnels: Detection & IOCs →
Chapters
- 0:00The hookCitrus attacks only Russian companies.
- 0:04The storyIt starts with stolen credentials.
- 0:11Attack pathEntry comes via VPN or RDP.
- 0:25AttributionAttributed to Citrus.
- 0:29Indicators of compromise17 indicators to hunt: 2 IPs, 6 MD5 hashes and 4 file names, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Restrict and monitor contractor access, including VPN and RDP.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Citrus attacks only Russian companies.
0:05It starts with stolen credentials.
0:07Then ransomware encrypts user files.
0:11Entry comes via VPN or RDP.
0:14Traffic hides in a Yandex-like tunnel.
0:16Next, they reach domain controllers.
0:19Defender is switched off.
0:20Files end in .citrus.
0:25Attributed to Citrus. Confidence: medium.
0:3017 indicators to hunt: 2 IPs, 6 MD5 hashes and 4 file names, and more.
0:3818 ATT&CK techniques, from initial access to impact.
0:435 steps now: Restrict and monitor contractor access, including VPN and RDP.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.