Security · High impactFan score 20 · Tier C
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
Securelist · By Stanislav Larinsky, Vladislav Vlasov & Boris Trefilov ·
The Brief
- Securelist reports on Citrus ransomware, which combines VLESS for network traffic, Sn00py for file encryption, and large language model assistance.
- The report describes a hybrid approach: established infrastructure techniques, methods for evading network filters, and LLM-powered automation.
- The sources provided contain no details on victims, versions, CVEs, or patches.
Why it matters
Ransomware that uses VLESS to get past network filters and LLMs to automate parts of the attack can be harder for traditional perimeter defences to detect, so developers and operators should review their network monitoring and ransomware defences.
Who’s affected
- Organizations and IT/security teams that could be targeted by ransomware
- #ransomware
- #malware
- #llm
- #threat-intelligence
- #network-security
In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus…
Timeline
Securelist publishes analysis of Citrus ransomware
Securelist
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand