Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
We break down the Citrus Ransomware group's attacks: the attackers' TTPs and tooling, including VLESS traffic tunneling and LLM use, plus their links to Toy Ghouls.
Summary from Kaspersky Securelist.
Explained
The technology and terms in this story. Learn more