A previously undocumented group called Citrus Ransomware is combining VLESS tunnels that mimic ordinary HTTPS, the Sn00py ransomware-as-a-service Trojan, and large language model (LLM) assistance to compromise Russian companies. Citrus gains access through compromised contractors. It uses stolen employee credentials to reach corporate VPNs or internet-facing terminal servers over RDP. Those contractor accounts hold limited […]
This article has been indexed from GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Read the original article:
New Citrus Ransomware Hides Malicious Traffic as HTTPS to Evade Corporate Network Security