Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender

A new ransomware group called Citrus is using Windows Group Policy to push its malware across entire company networks and switch off Microsoft Defender first.

Group Policy is a trusted Windows tool that admins use to manage many computers at once. Here, the attackers turn it into a delivery system.

The group breaks in through stolen contractor logins, then moves slowly through the network until it controls a domain controller. From there, one policy change can reach every connected machine.

This style is not new, and recent cases of attackers abusing Active Directory group policies show why defenders need to watch policy changes closely.

Analysts at Securelist, the research arm of Kaspersky, identified the Citrus group and described its tools in a report published on November 11, 2026.

The team calls Citrus a previously undocumented crew. It pairs the Sn00py ransomware family with hidden network tunnels and, notably, with help from AI chat tools.

Hackers Abuse Windows Group Policy

Once the attackers hold enough privileges, they run a self-extracting archive that builds a malicious Group Policy Object, or GPO.

The archive carries a PowerShell script that copies the ransomware to the SYSVOL folder on the domain controller. It then links the new policy to the domain using the Import-GPO and New-GPLink commands.

Every computer in the domain then receives the policy. It drops the ransomware archive, creates a scheduled task that runs it with the quiet and no-restart options, and turns on the WinRM service.

It also disables the Volume Shadow Copy service, which Windows uses to restore older file versions. Most importantly, it changes registry settings to turn off Windows Defender. Securelist says the antivirus simply did not react when the ransomware started.

The attackers give their files names that look safe. The policy is called Kaspersky GPO, and the files include KasperskyAgent.exe and Deploy-KasperskyGPO.ps1.

Kaspersky notes that this trick does not help, since its products detect and block these files. Similar tactics have been seen elsewhere, including when ransomware tried to disable Defender before encrypting files.

The ransomware itself belongs to the Sn00py family. It is written in Go and uses RSA-2048 and ChaCha20 encryption on user files, but leaves system files alone.

Encrypted files get the .citrus extension, and a CITRUS_README.txt note gives victims 72 hours to make contact. Decryption is not possible without the attackers’ private key. The malware also skips a list of domain controllers, which keeps the policy spreading without interruption.

Contractor Access, Hidden Tunnels, and AI-Written Scripts

Citrus does not rely on exotic entry points. It uses credentials stolen from contractors’ employees to log in through corporate VPNs or exposed RDP servers.

These accounts usually have low privileges, so the attackers try to raise them. They have tried the Certighost flaw, tracked as CVE-2026-54121, which created Active Directory accounts with names starting with GHOST.

They also tried CVE-2020-1337 and went after poorly configured 1C:Enterprise servers. After that, the group uses a standard toolkit. It runs mimikatz to pull passwords from memory, a modified keylogger, and Snaffler to hunt for secrets on network shares.

It uses fscan, ADRecon, and SharpHound to map the network, then moves around with SSH, RDP, and WinRM. Tools arrive through built-in Windows utilities such as certutil and BITS.

The most unusual part is the traffic hiding. The attackers install Xray and open reverse VLESS tunnels on port 443, so the traffic looks like normal HTTPS.

Their settings also make the traffic look like visits to mirror.yandex.ru and yastatic.net. For remote control, they install AnyDesk silently. Before encryption, a script called steal_tgs.ps1 packs Telegram Desktop data into zip files for theft.

Researchers also found signs that the group used large language models. Some commands and full scripts contained neat comments, which attackers rarely write.

Securelist links Citrus to another Russian-speaking group, Toy Ghouls, because both use similar tools and have targeted Russian companies. Attacks like this fit the wider trend of ransomware gangs claiming more victims.

Defenders should limit and review contractor access, alert on new GPOs and changes to the gPLink attribute, protect security tool consoles, and watch for unexpected Defender changes. Securelist notes that the group mostly uses well-known methods, which makes early detection easier.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender appeared first on Cyber Security News.