[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:citrus-ransomware-abuses-group-policy-to-push-sn00py-and":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","rapid-alert","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","Marcus Lenngren","2026-11-12T08:02:16.435+00:00","![Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nSecurelist, the research arm of Kaspersky, published a report on 11 Nov 2026 on a previously undocumented group it calls Citrus. The crew pairs the Sn00py ransomware family with hidden VLESS tunnels and scripts that show signs of large language model use.\n\nThe method is the dangerous part. Once the attackers control a domain controller, they run a self-extracting archive that builds a malicious Group Policy Object. A PowerShell script copies the ransomware to the SYSVOL folder, then links the policy to the domain with the Import-GPO and New-GPLink commands. Every computer in the domain then receives the policy.\n\nThat policy drops the ransomware archive, creates a scheduled task to run it quietly with no restart, turns on WinRM, disables the Volume Shadow Copy service, and changes registry settings to turn off Windows Defender. Securelist says Defender simply did not react when the ransomware started.\n\nThe files are named to look safe. The policy is called Kaspersky GPO, and files include KasperskyAgent.exe and Deploy-KasperskyGPO.ps1. Kaspersky notes the disguise does not help against its own products, which detect and block these files.\n\n## Timeline\n\n- Earlier: initial access with stolen contractor credentials over VPN or RDP.\n- Then: privilege escalation attempts using CVE-2026-54121 (Certighost), CVE-2020-1337, and misconfigured 1C:Enterprise servers.\n- Then: credential dumping with mimikatz, discovery with fscan, ADRecon and SharpHound.\n- Then: malicious GPO built and copied to SYSVOL, linked to the domain.\n- Then: Defender disabled by registry, VSS disabled, Sn00py runs.\n- 11 Nov 2026: Securelist publishes its Citrus report.\n\n## Am I affected?\n\nYou are exposed if contractor or low-privilege domain accounts can reach your network through a VPN or internet-facing RDP, and if those accounts can be escalated to domain admin. The attackers raise privileges through CVE-2026-54121, which creates Active Directory machine accounts with names starting with GHOST.\n\nSigns of a hit include a GPO named Kaspersky GPO, files named KasperskyAgent.exe or build_64.exe in SYSVOL, files encrypted with the .citrus extension, and a CITRUS_README.txt note giving 72 hours to make contact.\n\n## What to do now\n\n1. Hunt for GHOST-prefixed machine accounts in Active Directory and disable any you find.\n2. Check SYSVOL for build_64.exe and KasperskyAgent.exe, and your GPO list for a policy called Kaspersky GPO. Remove unauthorised GPOs and their gPLink entries.\n3. Alert on new GPO creation and changes to the gPLink attribute going forward.\n4. Confirm Microsoft Defender tamper protection is on and that registry settings have not disabled it.\n5. Confirm the Volume Shadow Copy service has not been disabled.\n6. Review and restrict contractor access. Treat these accounts as a likely entry point.\n7. Protect security tool consoles and restrict who can change AV policy.\n8. Block and hunt for the published IoCs: IPs 91.210.109.118 and 91.210.108.180, and the listed file hashes.\n\n## How to hunt\n\nLook for the scheduled tasks named KasperskyAgentInstallTask and Sysvc, which run the ransomware archive, and a Java rpchost persistence task.\n\nCheck these paths: C:\\ProgramData\\xray.exe, C:\\ProgramData\\fscan.exe, C:\\ProgramData\\x64\\mimikatz.exe, C:\\ProgramData\\oracle\\java\\jhost.exe, and C:\\ProgramData\\steal_tgs.ps1.\n\nWatch for reverse VLESS tunnels on port 443 made to look like traffic to mirror.yandex.ru and yastatic.net. Look for silent AnyDesk installs for remote control. Check for the Deploy archives named KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe on user desktops.\n\nSecurelist notes the group mostly uses well-known methods, which makes early detection easier if you are watching policy changes.\n\n## What does not help\n\nTrusting the Kaspersky name on files. The policy and executables use that branding to look safe, but Kaspersky products detect and block them. The disguise is meant to fool human responders, not software.\n\nRelying on Defender status alone. Because a GPO can switch Defender off by registry, a green status after the policy applies is not proof you are clean. Watch for the Defender change itself, not just the result.\n\n## Sources\n\n- [Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender](https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-abuse-windows-group-policy\u002F), Cyber Security News, 12 Nov\n- [Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand](https:\u002F\u002Fsecurelist.com\u002Fcitrus-ransomware\u002F121879\u002F), Securelist (Kaspersky), 11 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"sparrow-framework-china-linked-clusters-use-fake-chrome-cert","Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds","Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsparrow-framework-china-linked-clusters-use-fake-chrome-cert-54104957-cover.png","Sparrow \u002F SquadC rapid alert: Got a 'Certificate Fix' prompt? That installer is a backdoor.","2026-11-11T14:07:03.811+00:00"]