Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand

We break down the Citrus Ransomware group's attacks: the attackers' TTPs and tooling, including VLESS traffic tunneling and LLM use, plus their links to Toy Ghouls.
This article has been indexed from Securelist

Read the original article:

Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand