[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBUJPURc3wGQOP51EuKecE61yAuyUZ8bjYwpdf5cY4mk":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b4fc6cac-789d-4c38-9ad9-141cac8fdb83","Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand","citrus-ransomware-vless-for-traffic-sn00py-for-encryption-and-llms-lending-a-han-4869c9","We break down the Citrus Ransomware group's attacks: the attackers' TTPs and tooling, including VLESS traffic tunneling and LLM use, plus their links to Toy Ghouls.","The previously undocumented Citrus Ransomware group employs a hybrid approach combining VLESS traffic tunneling, LLM-generated commands, and the Sn00py ransomware Trojan. They gain initial access through compromised contractors, escalate privileges using vulnerabilities like CVE-2026-54121, and use tools such as Impacket and AnyDesk for execution and command and control. The group also shows links to the Toy Ghouls threat actor.","Citrus Ransomware uses VLESS tunnels, LLMs for commands, and Sn00py ransomware.","https:\u002F\u002Fsecurelist.com\u002Fcitrus-ransomware\u002F121879\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F11\u002F10223610\u002Fcitrus1_securelist-featured_1200x600_x2.jpg","2026-11-11T10:00:25+00:00","2026-11-11T11:00:37.170846+00:00",8,[17,20,23],{"name":18,"type":19},"Toy Ghouls","threat_actor",{"name":21,"type":22},"LLM","technology",{"name":24,"type":22},"VLESS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-54121","Vulnerability exploited for privilege escalation (Certighost)",[],{"controls":55,"vendors":139},[56,84,113],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,69,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":57,"product_name":73,"url":74,"description":75},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":114,"name":115,"problem":116,"products":117},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[118,123,131],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":119,"product_name":120,"url":121,"description":122},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[140],{"slug":141,"name":142,"logo_path":143,"roles":144},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"citrus-ransomware-exploits-contractor-access-and-unpatched-cves-to-deploy-llm-assisted-ransomware","Citrus Ransomware Exploits Contractor Access and Unpatched CVEs to Deploy LLM-Assisted Ransomware","The Citrus Ransomware group gained initial access through compromised contractors, highlighting the persistent risk of third-party supply chain weaknesses where external parties become trusted entry points into an organization's network. Once inside, attackers escalated privileges by exploiting CVE-2026-54121, demonstrating that unpatched vulnerabilities remain a critical enabler of ransomware campaigns even after initial access is achieved. The use of LLM-generated commands and covert tunneling via VLESS shows attackers are actively lowering the skill barrier and obfuscating malicious traffic, making detection harder. Organizations that fail to enforce strict contractor access controls and timely patching create compounding risks that sophisticated threat actors are eager to exploit.",[151,152,153,154,155],"MITRE ATT&CK T1078: Valid Accounts","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","NIS2 Article 21(2)(d)","CIS Control 7: Continuous Vulnerability Management (v8)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":157,"MITRE ATT&CK T1078: Valid Accounts":158,"CIS Control 7: Continuous Vulnerability Management (v8)":159,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":160,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":161},"Initial access through a compromised contractor is a supply chain security failure, and this article requires organizations to address security risks arising from supplier and third-party relationships.","Citrus gained initial access via compromised contractor credentials, which is exactly what this technique covers — adversaries leveraging valid accounts to bypass authentication controls.","The exploitation of CVE-2026-54121 would have been prevented or limited by a continuous vulnerability management process that prioritizes patching known critical vulnerabilities.","The group exploited CVE-2026-54121 to escalate privileges, which this technique specifically addresses — using software vulnerabilities to gain higher-level permissions.","Contractor accounts served as the attack's entry point, and this control requires organizations to define and apply security requirements for supplier and contractor access to protect against exactly this type of third-party compromise."]