Compromised contractor accounts are the entry point in Citrus ransomware incidents analyzed by Kaspersky, putting third-party remote access at the center of the defensive response.
In its November 11 report, the company describes attackers using stolen contractor credentials to reach corporate VPNs or internet-facing RDP servers. It characterizes Citrus as a Russian-speaking group targeting Russian companies.
After gaining access, the attackers use Xray to establish VLESS tunnels that blend with HTTPS traffic. They distribute Sn00py ransomware through malicious Group Policy Objects to encrypt files across Windows systems. Encrypted files receive the .citrus extension.
Kaspersky also assesses that some commands and scripts were produced or edited with large language models, citing their comments. Those characteristics support the researchers’ assessment; they do not independently establish AI involvement or autonomous operation.
The practical priority is to restrict contractor access, monitor unusual remote logins and tunneling tools, and investigate unexpected Group Policy changes. The report includes indicators defenders can use during those checks.
