A new ransomware group, Citrus, targeting corporate networks primarily in the financial sector, agriculture, and retail, has been identified in Russia. According to Kaspersky Lab, the attackers infiltrate corporate infrastructure using stolen credentials of contractor employees. A distinctive feature of the attacks is the use of artificial intelligence directly during the intrusion.
To access corporate systems, the hackers use remote connections and the RDP protocol. Once entrenched in the network, they utilize native Windows tools and PowerShell, as well as generate commands and entire scripts using large language models. In particular, AI helps create scripts to disable administrator accounts.
To conceal their presence, Citrus deletes working files and tools, clears command history and event logs, and disguises malicious programs as legitimate software.
Before encryption, the attackers collect data from messaging apps, archive it using 7-Zip, and exfiltrate it to external resources. Then, the Go-based Sn00py ransomware is launched, which locks user files and appends the .citrus extension to them. The malware is presumably distributed under the Ransomware-as-a-Service model.
Researchers also noted similarities between Citrus’s tactics and those of the Toy Ghouls group, previously spotted in attacks on Russian organizations. Experts recommend that companies limit contractor privileges, monitor remote access, and regularly back up their data.