Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
Citrus Ransomware uses VLESS tunnels, LLMs for commands, and Sn00py ransomware.
The previously undocumented Citrus Ransomware group employs a hybrid approach combining VLESS traffic tunneling, LLM-generated commands, and the Sn00py ransomware Trojan. They gain initial access through compromised contractors, escalate privileges using vulnerabilities like CVE-2026-54121, and use tools such as Impacket and AnyDesk for execution and command and control. The group also shows links to the Toy Ghouls threat actor.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Citrus Ransomware group gained initial access through compromised contractors, highlighting the persistent risk of third-party supply chain weaknesses where external parties become trusted entry points into an organization's network. Once inside, attackers escalated privileges by exploiting CVE-2026-54121, demonstrating that unpatched vulnerabilities remain a critical enabler of ransomware campaigns even after initial access is achieved. The use of LLM-generated commands and covert tunneling via VLESS shows attackers are actively lowering the skill barrier and obfuscating malicious traffic, making detection harder. Organizations that fail to enforce strict contractor access controls and timely patching create compounding risks that sophisticated threat actors are eager to exploit.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-54121