A ransomware gang called Citrus is using a trusted Windows admin feature, Group Policy, to infect every computer on a company network in one go. The same policy turns off Microsoft Defender first, so the antivirus stays silent when the encryption starts.
Kaspersky’s researchers documented the group after seeing it in several incidents. They say it is new, and that its targets so far are Russian companies only, so this is a description of how the attacks work rather than a warning aimed at Pakistan.
The way in is a contractor. Citrus steals the login details of a contractor’s staff, then uses them to connect to the victim’s corporate VPN or straight to an exposed terminal server over RDP. Those accounts have few rights, so the gang tried to climb higher, including with an exploit for CVE-2026-54121, an authentication bypass flaw that abuses the Active Directory certificate service. It also hunts for passwords with mimikatz, a keylogger and a tool that searches network shares for saved credentials.
To hide its traffic, the group builds VLESS tunnels on port 443 that are set up to look like ordinary requests to Yandex websites. It also installs AnyDesk for remote control. Kaspersky found comments inside the attackers’ scripts that read like the output of a large language model, and says they very likely point to the gang using AI to write commands and helper scripts.
The final step is the Group Policy object. Citrus creates one that copies the ransomware to each machine, schedules it to run, enables the WinRM service, disables Volume Shadow Copy (which holds Windows’ restore copies) and turns off Defender. Servers that distribute the policy are exempt from encryption, so the spread is never interrupted. Files end up with a .citrus extension and a CITRUS_README.txt ransom note appears. The encryptor belongs to the Sn00py family and is built in Go. Kaspersky says it locks user files with RSA-2048 and ChaCha20, and that nothing can unlock them without the attackers’ private key.
The gang names its files after Kaspersky itself, for example KasperskyGPO_Deploy_64.exe and a scheduled task called KasperskyAgentInstallTask. Kaspersky says its own products still detect and block those files.
Citrus shares tools and habits with another Russian-speaking group, Toy Ghouls, and in several incidents both were found inside the same network at once. The advice from the researchers is plain: limit what contractor accounts can reach, and watch for unexpected new Group Policy objects and Defender being switched off by policy.
