New Citrus Ransomware Gang Logs In With Contractor Passwords, Then Uses a Fake ‘Kaspersky’ Group Policy to Switch Off Defender Across Entire Networks

A ransomware crew nobody had publicly documented before this week has found an efficient way to hit an entire company at once. It doesn’t need an exotic zero-day. It borrows the same Windows management tool IT teams use every day. According to a report published November 11 by Kaspersky’s Securelist research team, the group, which Kaspersky calls Citrus, logs in with stolen contractor credentials and works its way up to a domain controller. From there it pushes a malicious Group Policy Object, dressed up as a “Kaspersky” deployment, that turns off Microsoft Defender and encrypts user files on every machine in the domain.

For business leaders, the takeaway isn’t really about one new gang. Two of the most trusted things in a corporate network, outside vendor access and Active Directory’s central management, are now being chained together into a single ransomware delivery pipeline.

How Citrus Gets In: Your Contractor’s Login

Securelist says Citrus usually starts with credentials stolen from employees of the victim’s contractors. It uses them to sign in through corporate VPNs or RDP servers exposed to the internet. Those accounts tend to have low privileges, so the attackers then try to escalate. Cyber Security News, summarizing the research, reports that the group tried an Active Directory Certificate Services flaw tracked as CVE-2026-54121, along with the older CVE-2020-1337, and also went after poorly configured 1C:Enterprise servers.

Once inside, the toolkit is familiar to any incident responder. Researchers describe mimikatz pulling passwords from memory, a modified keylogger, Snaffler hunting for secrets on file shares, and fscan, ADRecon and SharpHound mapping the network. The group moves between machines over SSH, RDP and WinRM.

Hiding in Plain Sight

Citrus stands out for how it hides its traffic. The attackers install the Xray proxy tool and open reverse VLESS tunnels on port 443, so their command traffic looks like ordinary HTTPS. Securelist adds that the tunnel settings were tuned to look like visits to Yandex domains. For hands-on access they quietly install AnyDesk. Before encrypting anything, a script packs up Telegram Desktop data for theft, so victims face data loss and possible exposure at the same time.

The group also works hard to look legitimate. Its tools carry names like KasperskyGPO_Deploy_64.exe and Deploy-KasperskyGPO.ps1, and the malicious policy itself is named “Kaspersky GPO.” Kaspersky points out that borrowing its name doesn’t help the attackers get past its own products, which detect and block the files. On a network running other security tools, though, a policy with a familiar security vendor’s name is exactly the kind of change a busy admin might wave through.

One Policy, Every Machine

The final stage is what makes Citrus dangerous at scale. Securelist describes a self-extracting archive that runs a PowerShell script. The script copies the ransomware into the domain controller’s SYSVOL share, then imports and links the new GPO to the whole domain using the standard Import-GPO and New-GPLink commands. Every computer that picks up the policy drops the payload, creates a scheduled task to run it silently, enables WinRM, disables the Volume Shadow Copy service that Windows uses to restore earlier file versions, and turns off Windows Defender. It also sets a desktop wallpaper showing the ransom note.

The encryptor belongs to the Sn00py family. It is written in Go and uses RSA-2048 and ChaCha20 to encrypt user files while leaving system files alone, so machines keep booting and victims can read the demand. Encrypted files get a .citrus extension. Securelist says decryption isn’t currently possible without the attackers’ private key, and Cyber Security News reports that the ransom note gives victims 72 hours to make contact.

AI Is Now Part of the Attacker’s Workflow

Researchers also found signs that Citrus used large language models during its intrusions. In a press release, Kaspersky said some PowerShell scripts, batch files and individual commands carried neat, explanatory comments typical of AI-generated output, which suggests the attackers were building and adjusting tools in real time mid-attack. Securelist also notes overlaps in tools and targeting with another Russian-speaking group it tracks as Toy Ghouls. Both have gone after Russian companies.

Using AI here doesn’t make the techniques new. It makes them faster and cheaper to adapt. Even a mid-tier crew can now troubleshoot a failed deployment script on the spot, which is likely why Securelist found two versions of the GPO deployment archive, one of them labeled “FIXED.”

Why It Matters for Business

Third-party access is the front door. Citrus didn’t need to breach the victim directly. It only needed a contractor’s password. Every vendor with a VPN account, an RDP login or a remote-support tool widens your attack surface, and those accounts are often the least monitored.

Domain controllers are the crown jewels. Once an attacker can write Group Policy, a single change reaches every joined machine within minutes. That turns a contained intrusion into a company-wide outage, and it’s why Active Directory hardening belongs on the board-level risk register, not just the IT backlog.

“Endpoint protection is on” isn’t a control if attackers can switch it off centrally. Citrus disables Defender and shadow copies through policy before encryption starts. Recovery plans that count on local snapshots or a single security agent are fragile.

What Defenders Should Do Now

• Review and tighten contractor access: enforce MFA on every VPN and RDP entry point, expire unused vendor accounts, and limit what each one can reach.
• Alert on new GPOs and on changes to the gPLink attribute, especially policies that touch Defender, Volume Shadow Copy or scheduled tasks.
• Patch Active Directory Certificate Services and audit for unexpected new accounts.
• Flag unusual tunneling tools like Xray, unauthorized AnyDesk installs, and outbound “HTTPS” traffic from servers that shouldn’t be browsing.
• Keep offline or immutable backups that a domain-wide policy change can’t touch.

Securelist’s own conclusion is somewhat reassuring: apart from the tunneling and the AI-assisted scripting, Citrus relies mostly on well-known tools and techniques, which makes early detection possible for teams that are actually watching.

The Bottom Line

Citrus shows where ransomware is heading. Attackers log in instead of breaking in, use your own management tools against you, and lean on AI to fix their mistakes in real time. Companies that treat vendor credentials and Group Policy changes as high-risk events will catch this kind of attack early. Companies that don’t may first hear about it from a ransom note on every desktop.

Sources: Securelist (Kaspersky), Kaspersky press release, Cyber Security News.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous