Kaspersky has detailed a previously undocumented ransomware group it calls Citrus, which breaks into companies through compromised contractor accounts and uses AI-written scripts, disguised network tunnels and Sn00py ransomware to encrypt their files. The Securelist analysis, published on 11 November 2026, describes a multi-stage operation blending familiar hacking tools with large language models.

How Citrus gets in

The group starts with credentials stolen from contractor employees, using them to connect to corporate VPNs or internet-facing remote desktop servers. Once inside, it runs PowerShell scripts and commands generated by large language models — Kaspersky notes the comments are typical of AI output — alongside Impacket, Mimikatz, Snaffler and ADRecon. To escalate privileges, the attackers tried to exploit CVE-2026-54121, an Active Directory Certificate Services authentication bypass known as Certighost, and used an exploit for the older CVE-2020-1337 flaw, as reported by Securelist via Malware News.

Hiding the traffic

Citrus disguises its network traffic with Xray reverse VLESS tunnels on port 443, blending in with HTTPS traffic, and uses the REALITY protocol to make connections look like requests to legitimate sites. It installs AnyDesk for remote control, clears event logs, disables antivirus protection and harvests credentials with a keylogger and Mimikatz. Before encryption, it collects data from messaging apps such as Telegram, packs it with 7-Zip and uploads it elsewhere.

The Sn00py payload

The final payload is Sn00py ransomware, which encrypts Windows user files with RSA-2048 and ChaCha20 and adds the .citrus extension. Kaspersky says decryption is impossible without the attackers’ private key. It spreads through malicious Group Policy Objects and gives victims 72 hours to make contact. Kaspersky also reports tactical similarities with another group, Toy Ghouls, but says the two operations’ infrastructure did not directly overlap. No victim count has been disclosed, as reported by Undercode News.