Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender
Citrus ransomware group uses Windows Group Policy to deploy malware and disable Microsoft Defender.
A new ransomware group named Citrus is leveraging Windows Group Policy to distribute its malware and disable Microsoft Defender across company networks. The group gains initial access through stolen contractor credentials, then escalates privileges to control a domain controller, from which they can deploy malicious Group Policy Objects. The ransomware, belonging to the Sn00py family, encrypts user files with the .citrus extension and demands payment within 72 hours.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Citrus ransomware group gained initial access using stolen contractor credentials, highlighting how third-party and privileged account hygiene directly impacts organizational resilience. Once inside, attackers escalated privileges to control a domain controller and weaponized Windows Group Policy Objects (GPOs) to distribute ransomware and disable Microsoft Defender across the entire network — a devastating force-multiplier available only because security controls were not sufficiently hardened. This attack demonstrates that a single compromised credential, combined with unrestricted GPO modification rights and no secondary authentication layer, can allow adversaries to neutralize defenses and encrypt assets at scale. Organizations must treat domain controller access and GPO modification rights as crown-jewel privileges requiring strict controls and continuous monitoring.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Sn00py
- cve — CVE-2026-54121
- cve — CVE-2020-1337
- domain — mirror.yandex.ru
- domain — yastatic.net