Three pulses published to AlienVault OTX on 2026-11-11 paint a converging picture: ransomware crews are adopting AI-assisted tradecraft, ideologically motivated actors are physically damaging European cold-chain infrastructure, and a Central Asia-focused espionage cluster had its entire operational playbook leaked via an exposed server. Each pulse is TLP:WHITE and operationally actionable today.
Threat Summary
Citrus Ransomware (linked to the "Toy Ghouls" cluster per Securelist research) is a hybrid operation blending classic intrusion tradecraft with modern evasion and LLM-powered automation. Initial access comes through compromised contractor accounts — stolen VPN/RDP credentials — followed by deployment of a full reconnaissance and credential-theft toolkit: Mimikatz, SharpHound, ADRecon, Snaffler, fscan, and the Sn00py implant. Command-and-control rides inside VLESS tunnels masquerading as HTTPS, and operators are reportedly using large language models to generate commands and automate attack stages in real time. The CVEs attached (CVE-2020-1337, a Windows Print Spooler privilege escalation, and the fictional-forward-dated CVE-2026-54121) indicate a mix of legacy and emerging exploit use for elevation.
CyberAveng3rs (Iran-nexus) conducted mass exploitation of unpatched Danfoss refrigeration controllers (CVE-2025-41450, authentication bypass) directly exposed to the internet. Between October and November 2026, hundreds of supermarkets across France and over a dozen European countries — Belgium, Germany, Netherlands, Sweden — had temperature settings and defrost cycles maliciously altered, causing food spoilage in the tens of millions of euros. This is not espionage or extortion; it is kinetic-effect ICS sabotage against civilian retail and healthcare cold chains.
Silent Lynx (tracked alongside YoroTrooper) suffered a self-inflicted exposure: an open directory on its infrastructure revealed active intrusion data, tooling (Laplas clipper/stealer, Chvost, PickleShell), and an operator AI agent used to assist targeting. Victimology is consistent with its historic Central Asia focus: government, transportation, defense, and telecommunications in Armenia, Kyrgyzstan, Pakistan, Tajikistan, Turkmenistan, and Uzbekistan — with persistent access to transport networks and bulk collection of government correspondence.
Collective signal: AI-assisted operator workflows are now appearing across both crimeware (Citrus) and espionage (Silent Lynx) tradecraft in the same reporting window, while ideologically driven actors are shifting from DDoS/defacement to physical-damage ICS operations. Third-party/contractor identity compromise remains the cheapest initial access vector in the set.
Threat Actor / Malware Profiles
Citrus Ransomware (Toy Ghouls nexus)
- Distribution / Initial Access: Compromised contractor VPN and RDP credentials; no phishing dependency. Valid accounts (T1078) are the primary door.
- Payload Behavior: Staged tooling — fscan for internal port/service sweeps, SharpHound and ADRecon for Active Directory mapping, Snaffler for credential/file hunting on shares, Mimikatz and peeping-tom for credential theft, Meterpreter for interactive control, Sn00py as the persistence-capable implant, Xray for proxy tunneling.
- C2 Communication: VLESS (V2Ray/Xray) tunnels wrapped to look like ordinary HTTPS/TLS 443 traffic. Expect long-lived TLS sessions to non-CDN IPs with unusual JA3/JA4 fingerprints and low-entropy SNI values.
- Persistence: Stolen valid accounts re-used for re-entry; implant-level persistence via services/scheduled tasks; LSASS credential access enables lateral movement (T1003).
- Anti-Analysis / Evasion: LLM-generated commands reduce signature-stable tooling artifacts; TLS-tunneled C2 defeats payload-inspection; living-off-the-land abuse of legitimate admin tooling (fscan, Snaffler are dual-use).
CyberAveng3rs (Danfoss ICS Campaign)
- Distribution: Internet-wide scanning for exposed Danfoss AK-series/AK-CC controllers; exploitation of CVE-2025-41450 authentication bypass on outdated firmware.
- Payload Behavior: Direct manipulation of setpoints — temperature, defrost cycle timing, alarm thresholds. No traditional malware; the HMI/protocol itself is the weapon (T0855, T0831).
- C2 Communication: Direct session to controller IPs from scanning/exploitation infrastructure (37.16.75.128 observed).
- Persistence: Firmware-level access persists until patched; default/unchanged credentials re-expose units.
- Anti-Analysis: Minimal footprint — attacks live in protocol traffic, not on endpoints, so EDR sees nothing.
Silent Lynx / YoroTrooper
- Distribution: Targeted phishing and infrastructure compromise against government and telecom entities in Central/South Asia; exposed opendir suggests hastily stood-up VPS staging.
- Payload Behavior: Laplas (clipper/stealer family) harvests credentials and clipboard crypto addresses; Chvost and PickleShell provide loader/shell functionality for hands-on espionage.
- C2 Communication: Infrastructure on low-reputation VPS ranges (e.g., 89.125.213.123, 134.17.14.24) and Russian-registered domains (foreverpeace.ru) inconsistent with victim geography — a strong detection asymmetry.
- Persistence: Long-dwell access to transport and government mail systems; collection-at-scale of official correspondence.
- Anti-Analysis: Operator AI agent for task automation; compartmented tooling per victim; exposed server suggests OPSEC failures under operational tempo rather than deliberate deception.
IOC Analysis
The pulses provide three indicator classes, each requiring different operationalization:
IPv4 addresses (Silent Lynx & CyberAveng3rs): 89.125.213.123, 134.17.14.24, 37.16.75.128, 178.83.226.215. Note the enrichment: AS25106 (MTS Belarus) and AS25441 (Ireland) for espionage staging versus AS6830 (Liberty Global) for the ICS actor's connectivity. Feed these to firewalls, proxies, and EDR network blocklists immediately; also hunt historical NetFlow/proxy logs for 90 days — Silent Lynx dwell time suggests connections may predate the pulse.
Domains: foreverpeace.ru — geopolitically mismatched with Central Asia victimology. Sinkhole at DNS and alert on any resolution; check DNS query logs for subdomain patterns.
File hashes (MD5/SHA1/SHA256): Eight hashes across the Citrus and Silent Lynx pulses. Prioritize the SHA256 values (7b9efc7e...2480e9 for Citrus tooling; efc1bbb8...bae9fab1 for Silent Lynx samples) — MD5/SHA1 are included for legacy platform matching but SHA256 is collision-safe for blocking. Push to EDR blocklists and run retro-hunts in your EDR/audit stores.
CVEs: CVE-2025-41450 (Danfoss auth bypass) demands asset inventory first — you cannot hunt exploitation of a device you don't know you own. CVE-2020-1337 requires Print Spooler patch verification on all Windows print servers.
Tooling: VLESS tunnel detection requires JA3/JA4 fingerprinting (Zeek + JA3 plugin, or commercial NDR). Hash and IP lookups: VirusTotal, OTX DirectConnect, AbuseIPDB. ICS exposure check: Shodan/Censys query for Danfoss on your public ranges — and assume any hit is already scanned by the adversary.
Detection Engineering
---
title: Citrus Ransomware - AD Recon and Credential Theft Tooling Execution
id: a1b2c3d4-1111-4a11-8a11-c1trusadrecon
status: experimental
description: Detects execution of SharpHound, ADRecon, Snaffler, fscan, or Mimikatz consistent with Citrus Ransomware post-compromise tradecraft following contractor VPN/RDP account compromise.
author: Security Arsenal Threat Intel
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\SharpHound.exe'
- '\Snaffler.exe'
- '\fscan.exe'
- '\mimikatz.exe'
selection_cli:
CommandLine|contains:
- 'Invoke-SharpHound'
- 'Invoke-ADRecon'
- 'sekurlsa::'
- 'lsadump::'
- '-CollectionMethod All'
condition: selection_img or selection_cli
falsepositives:
- Authorized penetration testing
- IT administration with documented change tickets
level: high
tags:
- attack.credential_access
- attack.discovery
- attack.t1003
- attack.t1482
- attack.t1552
---
title: VLESS / Xray TLS Tunnel C2 Beaconing
description: Identifies long-lived TLS sessions on port 443 to non-CDN IP addresses with low-volume periodic byte patterns consistent with VLESS/V2Ray tunnel C2 used by Citrus Ransomware operators.
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 443
Initiated: 'true'
filter_cdn:
DestinationIp|startswith:
- '13.32.' # CloudFront example ranges
- '151.101.' # Fastly
filter_browser:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate proxy/VPN software in sanctioned use
- Development tooling using V2Ray for testing
level: medium
tags:
- attack.command_and_control
- attack.t1573
- attack.t1090
---
title: Silent Lynx Infrastructure Communication
id: a1b2c3d4-3333-4a33-8a33-silentlynxc2
status: experimental
description: Detects network communication or DNS resolution to known Silent Lynx / YoroTrooper staging infrastructure from the November 2026 OTX pulse, including Laplas, Chvost, and PickleShell C2.
author: Security Arsenal Threat Intel
logsource:
category: network_connection
detection:
selection_ip:
DestinationIp:
- '89.125.213.123'
- '134.17.14.24'
selection_domain:
DestinationHostname|contains:
- 'foreverpeace.ru'
condition: 1 of selection_*
falsepositives:
- Threat research sandbox detonation
level: critical
tags:
- attack.command_and_control
- attack.t1071
// Hunt: Citrus + Silent Lynx cross-campaign indicators and behaviors (90-day retro)
let KnownBadIPs = dynamic(["89.125.213.123", "134.17.14.24", "37.16.75.128", "178.83.226.215"]);
let KnownBadHashes = dynamic(["7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9", "efc1bbb873e9b691657a66e987b0ea87c454bb16e89126d1a41bcaa9bae9fab1", "cf903e4a1629aa0582fd0363b5786676", "d631627131b90d576d77f4bf530e1abe", "7107fb029e7c63523e3aca5fc8e56b38", "e251df2d0b7c3682965efb4d2009a2f4", "d3e3d99b077a4193b1d93b604b096456"]);
let ReconTools = dynamic(["sharphound", "snaffler", "fscan", "mimikatz", "adrecon", "peeping-tom", "xray"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in (KnownBadIPs)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, HitType="IOC_IP"),
(DeviceEvents
| where TimeGenerated > ago(90d)
| where SHA256 in~ (KnownBadHashes) or MD5 in~ (KnownBadHashes)
| project TimeGenerated, DeviceName, FileName, SHA256, MD5, HitType="IOC_Hash"),
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where FileName has_any (ReconTools) or ProcessCommandLine has_any (ReconTools)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, HitType="ReconTool"),
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemotePort == 443 and InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "svchost.exe")
| summarize ConnCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, InitiatingProcessFileName
| where ConnCount > 200
| project FirstSeen, LastSeen, DeviceName, RemoteIP, InitiatingProcessFileName, ConnCount, HitType="SuspectedTunnelBeacon")
| sort by TimeGenerated desc
# Security Arsenal IOC Hunt - Citrus Ransomware / Silent Lynx artifacts
# Run elevated on endpoints; outputs CSV findings to C:\Temp\OTX_Hunt_<hostname>.csv
$findings = @()
$now = Get-Date
# 1. Check for known malicious file hashes across common staging paths
$badHashes = @(
"7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9",
"efc1bbb873e9b691657a66e987b0ea87c454bb16e89126d1a41bcaa9bae9fab1"
)
$searchPaths = @("C:\Users\Public", "C:\ProgramData", "C:\Windows\Temp", "$env:TEMP")
foreach ($path in $searchPaths) {
if (Test-Path $path) {
Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.Length -lt 100MB } |
ForEach-Object {
try {
$h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
if ($badHashes -contains $h) {
$findings += [pscustomobject]@{Type="MALICIOUS_FILE"; Path=$_.FullName; Hash=$h; Time=$now}
}
} catch {}
}
}
}
# 2. Suspicious persistence: scheduled tasks & services referencing recon/tunnel tooling
$susTerms = "sharphound","snaffler","fscan","mimikatz","xray","vless","sn00py","laplas","pickleshell"
Get-ScheduledTask | ForEach-Object {
$taskText = ($_ | Out-String)
foreach ($t in $susTerms) {
if ($taskText -match $t) {
$findings += [pscustomobject]@{Type="SUS_SCHEDULED_TASK"; Path=$_.TaskName; Hash=$t; Time=$now}
}
}
}
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" -ErrorAction SilentlyContinue | ForEach-Object {
$imgPath = (Get-ItemProperty $_.PSPath -Name ImagePath -ErrorAction SilentlyContinue).ImagePath
foreach ($t in $susTerms) {
if ($imgPath -match $t) {
$findings += [pscustomobject]@{Type="SUS_SERVICE"; Path=$_.PSChildName; Hash=$imgPath; Time=$now}
}
}
}
# 3. Active/recent network connections to adversary infrastructure
$badIPs = @("89.125.213.123","134.17.14.24","37.16.75.128","178.83.226.215")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
if ($badIPs -contains $_.RemoteAddress) {
$proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
$findings += [pscustomobject]@{Type="ACTIVE_C2_CONNECTION"; Path=$_.RemoteAddress; Hash=$proc; Time=$now}
}
}
# 4. Print Spooler exploit surface check (CVE-2020-1337 - Citrus elevation vector)
$spooler = Get-Service -Name Spooler -ErrorAction SilentlyContinue
if ($spooler -and $spooler.Status -eq "Running") {
$hotfix = Get-HotFix -Id KB4570000 -ErrorAction SilentlyContinue
if (-not $hotfix) {
$findings += [pscustomobject]@{Type="SPOOLER_EXPOSURE"; Path="Print Spooler running, CVE-2020-1337 patch unverified"; Hash="N/A"; Time=$now}
}
}
$findings | Export-Csv -Path "C:\Temp\OTX_Hunt_$env:COMPUTERNAME.csv" -NoTypeInformation -Force
Write-Host "[+] Hunt complete: $($findings.Count) finding(s) written to C:\Temp\OTX_Hunt_$env:COMPUTERNAME.csv"
$findings | Format-Table -AutoSize
Response Priorities
Immediate (0–4 hours)
- Block all four IPv4 indicators, the
foreverpeace.rudomain, and all eight file hashes at the perimeter, DNS, and EDR layers. - Run retro-hunts (90 days) using the KQL query above; Silent Lynx dwell time means historical hits are likely in environments within its targeting footprint.
- Audit external-facing assets for Danfoss refrigeration/HVAC controllers via Shodan/Censys on your public ranges. Any exposed unit: assume scanned, pull it off the internet or place it behind a VPN/firewall allowlist immediately.
- Review VPN/RDP logs for contractor account anomalies — logins outside business hours, impossible travel, or source IPs inconsistent with the contractor's organization (Citrus initial access vector).
24 Hours
- Force credential resets for all contractor and third-party accounts with VPN/RDP access; enforce phishing-resistant MFA (FIDO2) — credential theft tooling (Mimikatz, Snaffler, Laplas) appears in two of the three pulses, so treat identity as breached until proven otherwise.
- Hunt LSASS access events (Sysmon Event ID 10) on domain controllers and jump boxes for the past 30 days.
- Verify CVE-2020-1337 patching on all print servers and check Spooler service exposure.
- For retail/healthcare entities: physically verify refrigeration setpoints and defrost schedules against baselines; review controller logs for unauthorized parameter changes.
1 Week
- Contractor access architecture: migrate third-party VPN/RDP to zero-trust brokered access with device posture checks, session recording, and just-in-time provisioning. Contractor accounts are the Citrus entry point — eliminate standing credentials.
- ICS segmentation: place all building-automation/refrigeration controllers on isolated VLANs with no direct internet path; deploy an ICS-aware NDR sensor; establish firmware patch SLAs for OT devices (CVE-2025-41450).
- TLS tunnel detection: deploy JA3/JA4 fingerprinting (Zeek or NDR) and alert on non-browser processes holding long-lived 443 sessions to non-CDN IPs — this is the only reliable surface for VLESS-wrapped C2.
- Central Asia-facing organizations: brief executive leadership on Silent Lynx/YoroTrooper victimology; tighten mail gateway rules for government correspondence and monitor for Laplas-family clipboard/credential theft on executive endpoints.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.