Threats tagged 'sn00py'

Citrus Ransomware is a hybrid malware threat that combines traditional infrastructure compromise techniques with AI-driven automation and evasion methods. It gains initial access through compromised contractor accounts using stolen VPN or RDP credentials. The attackers exploit vulnerabilities such as CVE-2026-54121 for privilege escalation and use tools like mimikatz and Snaffler for credential theft. The ransomware, deployed via Group Policy Objects, encrypts files using RSA-2048 and ChaCha20 algorithms, appending a .citrus extension. The operation includes disabling security solutions, clearing logs, and harvesting Telegram session data. There are links suggesting connections to the Russian-speaking Toy Ghouls group, targeting Russian organizations exclusively.