Why this matters

On 2026-11-11 Kaspersky (Securelist) described Citrus, which it calls a previously undocumented ransomware group. All details below come from that single report unless stated; we have not seen independent confirmation. Per Securelist, the group enters through compromised contractors (stolen credentials used against corporate VPNs or internet-facing RDP terminal servers), then uses mostly built-in and public tooling, and finally distributes a Go-based Sn00py-family ransomware through a malicious Group Policy Object. Securelist also says the attackers used LLM-generated commands and scripts, inferred from the comments in them.

For defenders, the useful part is the long list of pre-encryption behaviors. Most are generic, so they are good hunting material even if you never see this group.

What Securelist observed

  • Privilege escalation attempt: exploitation attempts against CVE-2026-54121 (“Certighost”) that created machine accounts named GHOST plus eight random letters, with a certificate request using the Machine template and a cdc: attribute pointing at an attacker-controlled host. We did not open the Microsoft write-up Securelist links for this CVE, so we do not state affected versions or patch status here.
  • Tooling delivery: certutil and BITS used to download Xray; cURL and PowerShell also appear.
  • Tunnel: Xray reverse VLESS tunnels to the C2 on port 443, with a REALITY block mimicking mirror.yandex.ru (and another legitimate site, yastatic.net). The config.json was sometimes deleted right after the tunnel started.
  • Lateral movement and remote access: SSH, WinRM, RDP, plus a silent AnyDesk install.
  • Defense impairment: wevtutil log clearing, AV disabled or tool paths added to exclusions, and a GPO that switched Defender off in the registry.
  • Impact: a GPO named “Kaspersky GPO” distributing a self-extracting archive via a scheduled task (KasperskyAgentInstallTask or Sysvc). Domain controllers were listed in the ransomware’s host_blacklist, which names systems exempt from encryption (the report does not say why; we assume it keeps the GPO distribution working).

Securelist’s IOC list includes staging paths such as C:\ProgramData\xray.exe, C:\ProgramData\x64\mimikatz.exe, C:\ProgramData\Oracle\Java\jhost.exe and SYSVOL copies such as C:\Windows\SYSVOL\domain\KasperskyAgent.exe, and two C2 IPs (91.210.109[.]118 and 91.210.108[.]180). Take hashes and the full list from the original report rather than from us.

Hunt 1: executables and scripts landing in SYSVOL

A GPO-driven ransomware rollout needs the payload on a share every host can read. Executables in SYSVOL are rare in most estates. This Sigma rule is an untested starting point, not a vendor-supplied detection. Run it on domain controllers.

title: Executable or Script Written to SYSVOL (Possible GPO Payload Staging)
id: 7d1a0c52-5f0e-4a77-9b3e-2f6c1d9e4a10
status: experimental
description: Untested starting point. Flags executables and scripts created under SYSVOL, a staging pattern Securelist reported for Citrus ransomware.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: '\SYSVOL\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.msi'
      - '.bat'
  filter_scripts_dir:
    TargetFilename|contains: '\Policies\{'
    TargetFilename|endswith:
      - '.bat'
  condition: selection and not filter_scripts_dir
falsepositives:
  - Legitimate logon scripts and software deployment packages
level: high
tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1484.001

Expect to tune the filter: many estates keep logon .bat files in SYSVOL legitimately.

Hunt 2: Certighost-style machine accounts

Per Securelist, failed or successful exploitation attempts left machine accounts matching GHOST plus eight letters. Event 4741 (computer account created) on domain controllers is the pivot. This KQL assumes Sentinel SecurityEvent; the regex is our reading of the report’s naming pattern and may miss variants.

SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4741
| extend NewAccount = tostring(TargetUserName)
| where NewAccount matches regex @"^GHOST[A-Z]{8}\$$"
| project TimeGenerated, Computer, NewAccount, SubjectUserName, SubjectLogonId

Follow up with AD CS issuance logs (event 4887) for Machine template certificates whose SAN is a domain controller name but whose requester is a freshly created machine account.

Hunt 3: tool download then a tunnel from ProgramData

let dl = DeviceProcessEvents
| where Timestamp > ago(14d)
| where (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("urlcache", "-split"))
   or (FileName =~ "bitsadmin.exe" and ProcessCommandLine has "/transfer")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Start-BitsTransfer", "bitstransfer"))
| project DlTime = Timestamp, DeviceId, DlCmd = ProcessCommandLine;
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FolderPath startswith @"C:\ProgramData\" and FileName in~ ("xray.exe", "webex.exe", "fscan.exe", "snaffler.exe", "sharphound.exe")
| join kind=inner dl on DeviceId
| where Timestamp between (DlTime .. DlTime + 1h)
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, DlCmd

The file names come from Securelist’s IOC list. Attackers rename; treat this as a seed, then pivot on long-lived outbound connections to port 443 from processes in ProgramData.

Hunt 4: the loud finale

  • New GPOs whose name imitates a security product (event 5137 on the groupPolicyContainer object).
  • Scheduled tasks named KasperskyAgentInstallTask or Sysvc.
  • wevtutil cl followed by Defender registry changes within the same hour.

Response notes (our assessment)

Securelist’s own lesson is that weak access policies on security consoles helped the attackers. Our assessment: restrict who can edit Group Policy and the AV management console, alert on contractor accounts touching domain controllers, and treat SYSVOL as a monitored integrity boundary. All rules above are unvalidated; test against your own telemetry before alerting.

References