A newly identified ransomware group called Citrus is leveraging legitimate Windows tools—specifically Group Policy—to roll out its Sn00py malware across corporate networks and neutralize Microsoft Defender defenses. A report published November 11, 2026 by Securelist exposed how this strategy allows Citrus to expand its hold within compromised environments once it attains domain-level privileges.
How Citrus Pulls Off the Attack
Attackers begin by using credentials stolen from contractor accounts, often through compromised VPNs or exposed Remote Desktop Protocol (RDP) servers. Those initial access points typically come with limited privileges, which Citrus escalates by exploiting vulnerabilities like CVE-2026-54121 (Certighost), CVE-2020-1337, and misconfigured 1C:Enterprise systems. From there, the group relies on tools such as mimikatz, a keylogger variation, and Snaffler for credential harvesting and secret discovery. Domain reconnaissance is powered by utilities like fscan, ADRecon, and SharpHound, and lateral movement occurs over SSH, RDP, and WinRM. To hide malicious traffic, Citrus establishes reverse VLESS tunnels over port 443 that mimic HTTPS access, often camouflaged under endpoints like mirror.yandex.ru and yastatic.net. It also employs AnyDesk discreetly and steals Telegram data via bespoke scripts.
Weaponizing Group Policy: Deployment & Defender Disabling
With domain controller control, Citrus deploys its ransomware through a crafted Group Policy Object (GPO). A self-extracting archive installs malicious files in the SYSVOL directory, links the GPO at the domain root using PowerShell commands like Import-GPO and New-GPLink, and then propagates the malware to every machine attached to the domain. Scheduled tasks are created to execute the ransomware with options that skip restarts, the Volume Shadow Copy Service is disabled, and registry settings are manipulated to deactivate Microsoft Defender. Files and policy names imitate trusted Microsoft security software to avoid detection, though those names do not fool defensive tools—which reportedly still flag the threat.
The payload uses the Sn00py malware, encoded in Go, which encrypts user files with RSA-2048 and ChaCha20 while leaving system files intact. Encrypted items are given a “.citrus” extension, and victims find a “CITRUS_README.txt” message demanding contact within 72 hours—decryption requires possession of the attackers’ private key. Interestingly, domain controllers are excluded from encryption, allowing Citrus to preserve its distribution mechanisms unimpeded.
Indicators & Mitigations
Among the IoCs disclosed: multiple MD5 hashes associated with Sn00py, auxiliary tools like Xray and fscan, and compromised files placed in SYSVOL and elsewhere. Malicious scheduled tasks and files named to resemble components of legitimate security products are part of the footprint. Citrus has also established IP-based indicators connected with its infrastructure.
To defend against this multifaceted threat, security teams are advised to strictly regulate contractor access, especially via VPN or remote connections. Monitoring for sudden GPO creations or changes to the GPLink attribute is essential. Security consoles need extra protection, and any unexpected modifications to Microsoft Defender or similar tools should trigger investigations. Though many of the methods Citrus uses are well-known, early detection hinges on watching for unusual behavior rather than assuming trusted tools are immune.
Why This Matters: Citrus’s use of Group Policy abuse underscores a rising trend in ransomware operations that co-opt native administrative frameworks instead of relying solely on custom malware or zero-days. For organizations, this means the perimeter isn’t just the network edge—it’s also administrative channels long considered secure. The most effective defense will be enforcing least privilege access, maintaining vigilant change monitoring, and ensuring that security tools themselves remain under tight guard. As threat actors continue to refine their operations with tools like AI-scripted helpers and traffic obfuscation, defenders must sharpen visibility into administrative policies and domain-wide changes.
