New Citrus ransomware group gets in through contractors and uses LLMs

Researchers give the first report of Citrus, a ransomware group. It goes into company networks with passwords that were stolen from contractor staff. Its traffic goes through tunnels that look the same as usual web traffic. It also uses large language models (LLMs, AI text tools) to write attack commands. The report gives no count of victims.

How it works

The attackers use stolen contractor passwords to connect to a company VPN (a private network connection) or a remote desktop server. These accounts have small rights, and the attackers try to get more. They try a defect with the name Certighost (CVE-2026-54121). It gives an incorrect certificate for a domain controller account.

The proof

The researchers tell that the commands and scripts have comments. Attackers seldom add comments, and the researchers think LLMs wrote them. The attackers also put Kaspersky in the names of their files. Kaspersky software finds and stops these files.

What is not known

The report gives no name of a victim. It does not tell which LLM the group uses. The researchers did not see the accurate commands in some scheduled tasks. They think the group possibly used a known Windows update command.

Insight: AI speeds attack work, but a weak contractor login is the entry

In October 2026, SOCRadar found that ransomware affiliates use AI agents, and a person checks each step. Citrus also uses LLMs, but only for commands and scripts. Its entry is a stolen contractor password. This reads as attackers that use AI for usual work but must get one weak login, and contractor access is the control to check first. Leaders control this.