Citrus ransomware operators entered corporate networks with stolen contractor credentials, then disguised the rollout of their encryptor as a security-software deployment. A November 11 investigation by Kaspersky describes how a low-privilege remote login could become a domain-wide attack—and why some of the most important servers were deliberately spared.
The newly published analysis concerns incidents at Russian organizations. It documents an attack workflow, not a newly discovered flaw in Kaspersky software or evidence that the company’s installer was compromised. The attackers borrowed the security vendor’s name for their own files and policies.[1]
A contractor login opens the first door
The starting point was access through a contractor’s account, using a corporate VPN or an internet-facing Remote Desktop server. The initial domain accounts had limited privileges in the cases the researchers examined. That distinction matters: getting a valid login and gaining authority to change the entire network were separate steps.
The report describes subsequent privilege-escalation attempts, credential collection and movement between machines. For defenders, the useful question is therefore broader than whether a contractor account belongs to a real person. An authorized account can still be used from an unauthorized device or for a task outside its intended scope.
Citrus also used Xray reverse VLESS tunnels to blend its connections into traffic on port 443. Neither that port nor a legitimate tunneling tool identifies an intrusion on its own. The stronger signal is the relationship between the remote login, newly introduced tools and later administrative changes.
The installation policy becomes the delivery system
After obtaining sufficient control, the attackers packaged Sn00py ransomware in self-extracting archives with names such as KasperskyAgent.exe. A malicious Group Policy Object, named Kaspersky GPO, distributed the package and arranged its execution through a scheduled task. Related policy changes disabled protection and the Volume Shadow Copy service.
Group Policy is a way for administrators to apply settings across Windows domain computers. Here, the attackers turned that shared administrative trust into a distribution channel. A reassuring filename and centrally delivered installation could describe the attack itself, rather than a security response.
The telling detail was an exclusion inside the encryptor’s configuration: DC01 through DC04 were listed as hosts to skip. Kaspersky identified these as domain controllers distributing the malicious policy. Encrypting every reachable machine immediately would have risked disabling the mechanism that was spreading the payload.
A failed command does not mean a failed attack
The source’s console capture shows the encryptor trying to run bcedit, apparently a misspelling of Windows’ bcdedit. Those commands failed. The same capture reports a successful backup-catalog deletion, while the investigation separately documents file encryption.
This is a useful limit on incident interpretation: one visible error does not establish that the surrounding operation stopped. Review each action’s result separately. An error in boot-configuration manipulation says nothing by itself about whether user files, recovery data or other machines remained intact.
What the report changes for a response
The investigation also found archives consistent with collection of Telegram session data before encryption. Recovery therefore needs to address both stolen access and damaged files. Restoring a workstation alone would not settle whether account or messaging sessions were exposed.
For an affected organization, correlate contractor access records with policy changes, scheduled tasks and security exclusions. Preserve the relevant logs and suspicious files, contain compromised systems, and establish control of the policy-distribution infrastructure before reconnecting restored machines. The related PAYLOAD investigation explains another abuse of Group Policy; its different mechanics should not be treated as proof that the campaigns are related.
A suspicious installer can be checked with the Gridinsoft file scanner, subject to your organization’s rules for sharing files. A scan result cannot undo stolen access, decrypt data or certify that a domain is clean.
Kaspersky inferred LLM assistance from script comments and structure. That is an attribution of how supporting code may have been produced, not evidence of an autonomous AI attack. The central lesson is the evidenced trust failure: a contractor account became a route to administrative authority, and a purported protection rollout became ransomware delivery.
References
- Larinsky, S.; Vlasov, V.; Trefilov, B. Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. Securelist, November 11, 2026. Accessed November 11, 2026.
