Citrus Ransomware, a previously undocumented group, has been identified using a hybrid approach that combines traditional and modern techniques. The group employs VLESS tunnels to disguise their traffic as regular HTTPS, making detection challenging.
The group utilizes a ransomware Trojan from the Sn00py family and gains initial access to victims' infrastructure through compromised contractors. They use stolen credentials from contractors' employees to connect to corporate VPNs or internet-facing terminal servers over RDP.
Citrus Ransomware attempts to exploit the authentication bypass vulnerability CVE-2026-54121, also known as Certighost. The attackers create scheduled tasks to automatically launch their malicious tools, targeting 1C:Enterprise servers with insecure configurations.
To hinder incident response, the attackers delete their tools and output files. They also use legitimate-looking names for their tools to avoid detection.