[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxBvC4xwQFezGy7ivWEvYHODamPGaf5I3sUcSTTnegSQ":3},{"article":4,"iocs":54,"watch_terms":71,"solutions":72,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"61be8ce2-9b3d-484d-bc15-5b5cb39be870","Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender","hackers-abuse-windows-group-policy-to-deploy-citrus-ransomware-and-disable-micro-c82f42","A new ransomware group called Citrus is using Windows Group Policy to push its malware across entire company networks and switch off Microsoft Defender first. Group Policy is a trusted Windows tool that admins use to manage many computers at once. Here, the attackers turn it into a delivery system. The group breaks in through […] The post Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender appeared first on Cyber Security News.","A new ransomware group named Citrus is leveraging Windows Group Policy to distribute its malware and disable Microsoft Defender across company networks. The group gains initial access through stolen contractor credentials, then escalates privileges to control a domain controller, from which they can deploy malicious Group Policy Objects. The ransomware, belonging to the Sn00py family, encrypts user files with the .citrus extension and demands payment within 72 hours.","Citrus ransomware group uses Windows Group Policy to deploy malware and disable Microsoft Defender.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-abuse-windows-group-policy\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Abuse-Windows-Group-Policy-to-Deploy-Citrus-Ransomware-and-Disable-Microsoft-Defender.webp","2026-11-12T06:46:42+00:00","2026-11-12T07:00:25.06999+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Citrus","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Microsoft Defender","product",{"name":27,"type":28},"Group Policy","technology",{"name":30,"type":28},"Active Directory","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65,69],{"type":48,"value":56,"context":57},"Sn00py","Ransomware family used by Citrus group",{"type":59,"value":60,"context":61},"cve","CVE-2026-54121","Exploited flaw to create Active Directory accounts",{"type":59,"value":63,"context":64},"CVE-2020-1337","Exploited flaw",{"type":66,"value":67,"context":68},"domain","mirror.yandex.ru","Masqueraded traffic destination",{"type":66,"value":70,"context":68},"yastatic.net",[21,24],{"controls":73,"vendors":157},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":133,"name":134,"problem":135,"products":136},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[137,145,152],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":146,"vendor_name":21,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":153,"product_name":154,"url":155,"description":156},"cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",[158],{"slug":146,"name":21,"logo_path":147,"roles":159},[160],"affected",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":171},"citrus-ransomware-exploits-stolen-credentials-and-group-policy-to-cripple-enterprise-defenses","Citrus Ransomware Exploits Stolen Credentials and Group Policy to Cripple Enterprise Defenses","The Citrus ransomware group gained initial access using stolen contractor credentials, highlighting how third-party and privileged account hygiene directly impacts organizational resilience. Once inside, attackers escalated privileges to control a domain controller and weaponized Windows Group Policy Objects (GPOs) to distribute ransomware and disable Microsoft Defender across the entire network — a devastating force-multiplier available only because security controls were not sufficiently hardened. This attack demonstrates that a single compromised credential, combined with unrestricted GPO modification rights and no secondary authentication layer, can allow adversaries to neutralize defenses and encrypt assets at scale. Organizations must treat domain controller access and GPO modification rights as crown-jewel privileges requiring strict controls and continuous monitoring.",[166,167,168,169,170],"MITRE ATT&CK T1484.001: Domain Policy Modification: Group Policy Modification","CIS Control 5: Account Management (v8)","NIST SP 800-53 AC-6: Least Privilege","NIS2 Article 21(2)(i)","NIS2 Article 21(2)(j)",{"NIS2 Article 21(2)(i)":172,"NIS2 Article 21(2)(j)":173,"NIST SP 800-53 AC-6: Least Privilege":174,"CIS Control 5: Account Management (v8)":175,"MITRE ATT&CK T1484.001: Domain Policy Modification: Group Policy Modification":176},"This provision requires human resources security, access control, and asset management practices that would have governed the lifecycle and privilege scope of contractor accounts used in the initial compromise.","This provision requires multi-factor authentication for privileged access, which would have prevented attackers from leveraging stolen contractor credentials to escalate to domain controller control.","AC-6 mandates that users and processes operate with the minimum privileges necessary, which if applied would have prevented the attackers from gaining GPO modification rights after compromising a contractor account.","CIS Control 5 requires managing and controlling user and privileged accounts, which would have limited the blast radius of stolen contractor credentials used for initial access.","This technique directly describes how the attackers modified Windows Group Policy Objects to deploy ransomware and disable Defender across the domain."]