{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/1c/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-54121"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Active Directory Certificate Services","1C:Enterprise"],"_cs_severities":["high"],"_cs_tags":["ransomware","initial-access","privilege-escalation","windows","active-directory"],"_cs_type":"advisory","_cs_vendors":["Microsoft","1C"],"content_html":"\u003cp\u003eCitrus Ransomware is a previously undocumented threat actor that utilizes a combination of traditional credential theft and modern automation tools. The group gains initial access through compromised contractor VPN or RDP accounts. Once inside, they use LLM-generated PowerShell scripts to perform internal reconnaissance and system administration. The group actively exploits Active Directory Certificate Services via CVE-2026-54121 (Certighost) to achieve privilege escalation and also targets 1C:Enterprise server configurations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: Compromised contractor credentials used to access corporate VPNs or RDP.\u003c/li\u003e\n\u003cli\u003eExecution: LLM-generated PowerShell and CMD scripts executed to perform reconnaissance and manage internal tasks.\u003c/li\u003e\n\u003cli\u003eExecution: Usage of Impacket atexec to create scheduled tasks and run commands (e.g., gpupdate).\u003c/li\u003e\n\u003cli\u003ePersistence: Manual creation of scheduled tasks using PowerShell commands.\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation: Exploitation of CVE-2026-54121 (Certighost) via Active Directory Certificate Services to request certificates and authenticate as domain controllers.\u003c/li\u003e\n\u003cli\u003eLateral Movement: Leveraging insecure configurations in 1C:Enterprise servers to move deeper into the environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eObserved impact includes unauthorized access to domain controllers via certificate forgery, execution of arbitrary commands via Impacket, and deployment of Sn00py family ransomware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54121 on all AD CS servers immediately.\u003c/li\u003e\n\u003cli\u003eAudit Active Directory for machine accounts matching the naming convention \u0026quot;GHOST*\u0026quot; followed by random characters.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for RDP and VPN access, specifically auditing contractor account activity.\u003c/li\u003e\n\u003cli\u003eMonitor PowerShell activity for scripts containing LLM-style comments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T10:50:22Z","date_published":"2026-11-11T10:50:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-citrus-ransomware/","summary":"Citrus Ransomware leverages compromised contractor credentials, VLESS tunnels, and LLM-generated scripts to escalate privileges and deploy ransomware, notably exploiting CVE-2026-54121 (Certighost).","title":"Citrus Ransomware: Contractor exploitation and LLM-assisted post-exploitation","url":"https://feed.craftedsignal.io/briefs/2026-11-citrus-ransomware/"}],"language":"en","title":"CraftedSignal Threat Feed - 1C","version":"https://jsonfeed.org/version/1.1"}