Skip to content
Threat Feed
Subscribe

Vendor

1C

1 brief RSS
high advisory

Citrus Ransomware: Contractor exploitation and LLM-assisted post-exploitation

Citrus Ransomware leverages compromised contractor credentials, VLESS tunnels, and LLM-generated scripts to escalate privileges and deploy ransomware, notably exploiting CVE-2026-54121 (Certighost).

Active Directory Certificate Services +1 ransomware initial-access privilege-escalation windows active-directory
3t 1c 1i