New Citrus Ransomware Gang Logs In With Contractor Passwords, Then Uses a Fake ‘Kaspersky’ Group Policy to Switch Off Defender Across Entire Networks
Kaspersky’s Securelist says a newly documented ransomware group, Citrus, breaks in with stolen contractor credentials, hides in VLESS tunnels, uses AI-written scripts, and pushes Sn00py ransomware domain-wide through a malicious Group Policy that disables Microsoft Defender and shadow copies.





































