Citrus Ransomware: Contractor exploitation and LLM-assisted post-exploitation

Citrus Ransomware is a previously undocumented threat actor that utilizes a combination of traditional credential theft and modern automation tools. The group gains initial access through compromised contractor VPN or RDP accounts. Once inside, they use LLM-generated PowerShell scripts to perform internal reconnaissance and system administration. The group actively exploits Active Directory Certificate Services via CVE-2026-54121 (Certighost) to achieve privilege escalation and also targets 1C:Enterprise server configurations.

Attack Chain

1. Initial Access: Compromised contractor credentials used to access corporate VPNs or RDP.
2. Execution: LLM-generated PowerShell and CMD scripts executed to perform reconnaissance and manage internal tasks.
3. Execution: Usage of Impacket atexec to create scheduled tasks and run commands (e.g., gpupdate).
4. Persistence: Manual creation of scheduled tasks using PowerShell commands.
5. Privilege Escalation: Exploitation of CVE-2026-54121 (Certighost) via Active Directory Certificate Services to request certificates and authenticate as domain controllers.
6. Lateral Movement: Leveraging insecure configurations in 1C:Enterprise servers to move deeper into the environment.

Impact

Observed impact includes unauthorized access to domain controllers via certificate forgery, execution of arbitrary commands via Impacket, and deployment of Sn00py family ransomware.

Recommendation

• Patch CVE-2026-54121 on all AD CS servers immediately.
• Audit Active Directory for machine accounts matching the naming convention "GHOST*" followed by random characters.
• Implement strict ingress filtering for RDP and VPN access, specifically auditing contractor account activity.
• Monitor PowerShell activity for scripts containing LLM-style comments.