In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family.
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
About this summary. This is a short excerpt from the description that Kaspersky Securelist published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securelist.com/citrus-ransomware/121879/
Source attribution: headline and facts are from Kaspersky Securelist (securelist.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Sage: AI for Assumed-Breach Operations, Built Into Mythic
TL;DR: Sage is an open-source AI assistant that lives inside Mythic. You tell it what you’re trying to accomplish, it works out the commands across whichever Mythic…
Virtualization security: attack layers and misconfiguration impact
Introduction Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The…
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can…
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the…
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access…
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The…