Citrus Ransomware Removal Guide: .citrus Files, Ransom Notes and Recovery

A familiar document will not open, and its filename now ends in .citrus. Nearby, a note tells you that your options are running out.

Before trying a repair or contacting anyone, take a breath. The details you preserve now can matter more than the first recovery promise you find.

Overview

The .citrus ending points to an encryption incident

Citrus ransomware locks files and adds the .citrus extension. A photograph previously named photo.jpg may appear as photo.jpg.citrus and stop opening normally.

The reported infection also changes the desktop wallpaper and leaves info_note.txt. The wallpaper references another filename, RECOVERY_SUGAR.txt, which may help identify the demand.

The file list above is an illustration with invented personal filenames. It is not a victim’s directory or proof that both note files were present together.

The ransom demand mixes a deadline with a disclosure threat

The note directs the victim toward Telegram negotiations and gives a 72-hour contact window. It threatens publication of business information if the victim does not cooperate.

That is an extortion claim, not an independent inventory of stolen material. Encryption and data theft need separate investigation, even when the attacker describes them together.

Do not let the deadline determine your response. An attacker’s timer does not establish that paying will restore files or prevent disclosure.

Containment, removal, and recovery are separate jobs

• Containment limits further damage and protects other computers, storage, and backups.
• Investigation establishes what happened and which access routes remain exposed.
• Removal or rebuilding addresses the malicious software and compromised environment.
• Recovery restores usable data from compatible tools or copies that survived.
• A scan does not decrypt documents, and deleting a ransom note does not remove the infection.

No compatible free Citrus decryptor has been verified for this case. Preserve encrypted copies while checking reputable recovery resources rather than trying unrelated decryptors on irreplaceable originals.

Recognize the Incident Without Making the Files Worse

Keep the complete filename and the note

The extension is a useful clue, but it is not a complete diagnosis. Preserve the original directory structure, the full added suffix, and any accompanying instructions.

Do not rename every file to remove .citrus. Changing the label cannot reverse encryption, and it can make later identification harder.

Similarly, opening the damaged file repeatedly in different applications is unlikely to restore it. Stop any repair tool that proposes overwriting your only copy.

A recovered file must contain usable information, not merely regain a familiar icon. Test restored documents carefully before treating the recovery as complete.

Record what you can see, not what you assume

Write down when you discovered the problem, which systems are affected, and whether new files are still changing. Keep any endpoint-security alerts.

A changed wallpaper and matching ransom note help a responder recognize the incident. They do not establish the original entry point or every capability of the malware.

There is no verified initial infection route for the particular computer you are reading this on. An email, remote-access intrusion, or malicious installer requires evidence, not guesswork.

At work, avoid declaring the incident limited to one machine just because that is where the first locked file appeared. Shared storage may require coordinated checks.

How Citrus Ransomware Works

Step 1: Malicious code reaches a system with access to valuable files

Before a ransom message can appear, the attacker needs code to run or access that allows deployment. The visible encryption stage may come after an earlier compromise.

The available Citrus case details do not establish one universal delivery route. Do not assume every infection began with a suspicious email attachment.

Responders should inspect recent downloads, software installations, remote sessions, account activity, and security alerts according to the environment involved.

If a business uses outside technical support, verify its sessions through existing records. A legitimate remote-management product can be abused without its vendor operating the attack.

Finding an entry point matters because a restored computer remains vulnerable if the intruder still controls the account or service used to reach it.

Step 2: Files become unreadable and acquire the added suffix

Citrus processes accessible data and leaves the .citrus filename ending. The practical result is that documents, images, or other affected files no longer function as expected.

The original application cannot repair encryption simply by recognizing its old file type. A spreadsheet remains encrypted even if you change its name back to .xlsx.

Which locations were reachable depends on the system’s access at the time. Examine local storage, relevant network shares, and synchronized folders without reconnecting valuable backups experimentally.

Do not infer that every file on every device has been encrypted. Build an actual affected-data inventory so recovery work targets real damage.

Equally, do not rely on a few files opening successfully as proof the machine is clean. Some data can survive while malicious access remains.

Step 3: The note turns damaged files into a negotiation demand

The ransom note gives instructions for contacting the operator and warns against independent recovery attempts. Its purpose is to make the criminal’s route feel unavoidable.

Warnings about permanent damage contain a manipulative half-truth: careless recovery attempts can damage evidence, but that does not make the attacker your only legitimate source of help.

Preserving originals and using qualified responders is different from randomly experimenting with decryptors. You can reject the criminal’s instructions without taking unnecessary risks with the data.

The wallpaper’s reference to a differently named instruction file is another detail to retain. Do not delete one note because its name differs from the other.

A deadline should prompt organized incident response, not a rushed transfer to an extortionist. Keep communications and payment decisions within the organization’s approved process.

Step 4: The disclosure threat expands pressure beyond file access

The demand threatens business records and sensitive information. That adds concern about employees, customers, contracts, and reputation to the immediate loss of working files.

A note can claim theft without demonstrating it. Responders need logs, forensic findings, credible samples, or other evidence to assess what was actually accessed or removed.

Do not publish confidential material to ask strangers whether the threat is real. Share relevant evidence only with authorized responders and appropriate reporting channels.

If theft is confirmed, restoring files does not resolve the confidentiality issue. Account protection, notifications, and professional advice may be needed alongside technical recovery.

Payment would not create a reliable way to verify deletion of copied data. Treat promises about secrecy and erasure as claims made by the person applying pressure.

What the Leak Threat Changes for a Business

Separate the operational question from the information-security question. One concerns getting systems working; the other concerns what someone may already know or possess.

A clean backup can help restore operations without answering whether customer files were exposed. Conversely, a frightening note does not automatically prove a reportable disclosure occurred.

Bring the relevant decision-makers into a controlled response: IT, incident response, management, and appropriate legal or privacy advisers. Avoid improvising disclosure decisions from a generic online checklist.

Use an unaffected communication channel when necessary. If the attacker may control email, discussing the response inside that same account can reveal your plans.

Keep a decision log with discovery times, containment actions, affected systems, and confirmed findings. It helps responders distinguish what was known from what was only feared.

The CISA ransomware response guide emphasizes coordinated isolation and evidence preservation. A business incident often needs more than running a scanner on the visibly affected computer.

What to Do if Citrus Ransomware Has Affected Your Files

1. Isolate the affected equipment. Disconnect network access and keep backup drives separate. Tell your administrator promptly if work equipment or shared data is involved.

   Do not reconnect just to test another website or download. If isolation is impossible and encryption continues, seek immediate guidance about containment and the evidence consequences of shutdown.

2. Preserve identifying material. Keep the note, wallpaper information, full filenames, and relevant alerts. Record the discovery time and which folders you noticed first.

   Do not send private documents to the Telegram contact as a test. Any sample shared with a legitimate analyst should be selected with confidentiality in mind.

3. Protect copies that may still be usable. Check backup availability from an unaffected environment. Avoid attaching the only good drive to a machine that remains under investigation.

   Cloud version history, an earlier attachment, or another authorized device may hold a usable copy. Confirm the contents before overwriting or discarding anything.

4. Plan cleanup before restoration. Malwarebytes can help identify malicious software, but it cannot turn encrypted Citrus files back into ordinary documents.

   AdGuard is relevant to reducing some future malicious-web exposure, not decrypting data. Businesses should follow their responder’s containment, evidence, cleanup, and rebuilding plan.

5. Assess recovery compatibility. Check reputable decryption resources using the actual variant information. Test any suitable tool on duplicates, with its instructions understood.

   If no verified option fits, keep an untouched encrypted archive. Do not accept a stranger’s guarantee that every file can be recovered for an advance crypto payment.

6. Report the incident and review exposed access. Retain case numbers, receipts, and correspondence. If you already paid, tell the relevant provider and authorities promptly.

   From a trusted system, review accounts the affected device could access. A new password alone may not remove active sessions or an intruder’s separate remote-access route.

Remove the Infection Before Restoring Citrus Files

Use the removal guidance below as a starting point for an isolated personal computer. A managed business system should follow its incident-response team’s instructions first.

The Malwarebytes Windows option is for malicious-software protection and cleanup, not a Citrus decryptor. Preserve evidence before changing an affected system.

Contain the incident before running cleanup tools

Disconnect the affected computer from Wi-Fi and wired networks. Unplug external storage and leave backup drives disconnected while you assess what happened.

Pause synchronization from a clean device where possible. Otherwise, encrypted versions may replace usable cloud copies while you are trying to rescue them.

At work, contact your IT or incident-response team immediately. A ransomware screen on one computer may be the visible part of a larger intrusion.

Keep the ransom note, filenames, discovery time, and any security alerts. A specialist may need disk or memory evidence before cleanup changes the machine.

If you cannot isolate a computer and encryption is visibly continuing, seek immediate assistance about shutting it down. Powering off can lose volatile evidence.

Do not repeatedly restart, reinstall, or experiment with utilities. Those actions can overwrite recovery evidence without addressing the underlying access problem.

Use trusted scanners on an isolated personal computer

For a home computer, arrange cleanup after preserving the evidence you need. Obtain security tools through their official websites using an unaffected system.

Malwarebytes can scan for malicious programs and related unwanted software. It is an infection-removal tool, not a way to decrypt already encrypted documents.

Install a current copy, update its detection data when safely possible, and run the available comprehensive scan. Review detections before applying the recommended quarantine actions.

Keep the scan report. It can help distinguish the ransomware payload from another infection, a suspicious installer, or a remote-access program.

Windows Security also provides scan options. Microsoft Defender Offline restarts into an offline scanning environment, so save your work before starting it.

Follow Microsoft’s ransomware protection guidance rather than instructions in the criminal’s note. A note telling you to disable protection is not trustworthy advice.

If Windows will not start or the scanners cannot operate, stop improvising. Use reputable technical assistance instead of downloading a supposed one-click emergency decryptor.

Do not upload the executable to unfamiliar recovery websites or run it elsewhere for testing. A second execution can create another incident.

Verify the environment before restoring anything

A completed scan is useful, but it cannot establish that every account, remote session, or networked computer is safe.

Check for unauthorized remote-access software, suspicious accounts, changed security settings, and unknown scheduled tasks. Business environments require coordinated investigation beyond this home-computer checklist.

Change exposed passwords from a clean device. Prioritize email, cloud storage, administrator access, and any account whose credentials were saved on the affected system.

Enable multifactor authentication where supported and revoke suspicious sessions. Simply changing the password may leave an existing signed-in session active.

A trusted reinstall may be appropriate when system integrity remains uncertain. Preserve recoverable data first, and reinstall from authentic installation media.

AdGuard can help reduce exposure to malicious advertising during future browsing. It neither cleans an infected system nor reverses file encryption.

Keep backup media offline until cleanup and access checks are complete. Reconnecting your only good copy too early can turn a recovery opportunity into another loss.

Citrus File Recovery Options

The following recovery guidance does not promise a Citrus decryption key. It helps you preserve originals, check compatibility, and find copies that existed before encryption.

Make a recovery copy, not another damaged original

Keep an untouched copy of the encrypted data whenever practical. Include the ransom note and retain the original directory structure.

Use a separate destination for recovery experiments. Never let a utility overwrite your only encrypted copy or replace an intact backup.

Before sharing samples, consider their sensitivity. Choose an ordinary, nonconfidential file and ask the service about handling rules if business or personal information is involved.

The note’s name, complete filename suffix, and contact details can help identify a variant. An extension alone is not enough to establish decryption compatibility.

For example, two infections can use the same suffix while generating different keys. A familiar family name can also hide a newer, unsupported version.

Record the exact error or result from each attempt. Keep a simple checklist so another helper does not repeat risky tests on the same files.

Check recognized decryption projects

Visit the No More Ransom decryption catalog from a clean browser. Look for the actual variant and read the tool’s requirements carefully.

A tool for a related family does not automatically unlock your files. Some decryptors support only older versions, certain keys, or specific encryption mistakes.

Download through the catalog’s trusted vendor link, not a sponsored search result or an unsolicited message offering guaranteed recovery.

Test only a duplicate sample first. Successful decryption should produce a usable document or image, not merely remove the added extension.

If the utility reports an unsupported file or key, stop. Changing the filename to resemble a supported variant does not change its encrypted contents.

When no compatible tool is available, preserve your encrypted archive. Researchers sometimes release new tools later, but future recovery cannot be promised.

Look for copies that existed before encryption

Check disconnected drives, backup software, cloud version history, another computer, and files previously sent to trusted contacts. You may have more copies than you remember.

Cloud synchronization is not automatically a backup. Confirm that an earlier usable version survives and that the account itself has not been compromised.

Restore into a cleaned environment. Open a selection of documents, photos, and project files before assuming the recovered collection is complete.

Compare important dates and contents. An older spreadsheet might open perfectly while still missing the transactions you needed to recover.

Windows Previous Versions or existing snapshots may offer additional copies. Availability depends on prior configuration and whether those snapshots survived the incident.

Do not create new restore points expecting them to contain yesterday’s files. Recovery depends on copies that already existed before the damage.

Deleted-file recovery utilities are a different category. They may locate unencrypted originals in some circumstances, but they do not mathematically decrypt overwritten data.

If you want a specialist to investigate that possibility, minimize writes to the affected storage. Continued installations can overwrite remnants that might otherwise be recoverable.

Evaluate recovery offers without surrendering control

Be wary of anyone who contacts you first, claims exclusive access to a secret decryptor, or requests an advance payment in cryptocurrency.

Ask a recovery provider what method it intends to use, what evidence supports success, and whether it would negotiate with the attacker.

Get the scope, fee, privacy terms, and limitations in writing. A legitimate assessment should distinguish a possibility from a demonstrated recovery result.

Do not provide remote administrator access to an unknown helper. Recovery desperation can make a second scam feel like the only remaining option.

If you already paid, retain receipts, transaction references, wallet addresses, and correspondence. Contact the payment provider promptly and report the extortion.

Recovery is sometimes partial. Prioritize irreplaceable files, verify them individually, and keep your evidence archive until the investigation and restoration decisions are settled.

Decide What to Restore First

Recovery is easier to manage when you prioritize real needs. List essential documents, current financial records, customer work, and irreplaceable personal material before starting large restorations.

For each category, note its best surviving source and how current that source is. A file that opens can still be too old to serve its purpose.

Restore to a trusted destination and verify representative items. Database files, archives, and project folders may require application-specific checks rather than a quick visual inspection.

Keep the encrypted archive separate until recovery decisions are settled. A partial success today should not destroy the evidence or data needed for another assessment later.

After rebuilding, close the access gap that allowed the incident. Otherwise, the same restored business files can be exposed to another intrusion.

Test the new backup process with an actual restore. Knowing where copies are stored is useful; knowing they can be recovered is what makes them dependable.

Keep Recovery Decisions Grounded in What You Know

When several people are helping, keep one agreed inventory of affected systems. Otherwise, a computer cleaned by one person may be reconnected while another is still investigating.

Record which copies are encrypted, which are intact, and which have merely not been tested. Those categories prevent a hopeful assumption from becoming a destructive overwrite.

Do not use an irreplaceable document as the first trial for a repair utility. A duplicate gives you room to assess the result without sacrificing the original.

For a business, tell staff which services are unavailable and which temporary workarounds are approved. Avoid encouraging unofficial file sharing while the normal systems are disrupted.

Be equally precise with customers. Saying that systems are being restored is different from promising that no information was accessed or that every record will return.

If the attacker claims a leak, let the authorized response team evaluate it. Do not circulate confidential samples internally just to establish whether they look familiar.

Home users can apply the same principle on a smaller scale. Keep a simple list of attempted tools, recovered folders, and files still missing.

A good recovery plan makes uncertainty manageable. It does not require believing the ransom note, declaring everything lost, or accepting the first paid guarantee.

Frequently Asked Questions

Will removing .citrus from filenames unlock my documents?

No. Renaming changes the label, not encrypted contents. Keep the original names and work on copies if a qualified recovery process requires any changes.

Does a clean antivirus scan decrypt Citrus files?

No. Malware removal and file decryption are different tasks. A scan can help address malicious software while already encrypted data still requires a suitable recovery source.

Is a free Citrus decryptor available?

No compatible tool has been verified here. Check the No More Ransom catalog for current compatibility, and do not assume a similarly named tool will work.

Does the note prove that employee or customer data was stolen?

No. It establishes what the attacker is claiming. Investigate access and exfiltration evidence separately, especially when business records or sensitive personal information may be involved.

Should I trust the 72-hour deadline?

Treat it as extortion pressure, not a reliable recovery rule. Begin containment and professional assessment promptly without allowing the attacker’s timetable to force payment.

What if I have no complete backup?

Preserve the encrypted data and assess surviving cloud versions, partial backups, earlier shared copies, and qualified recovery options. No legitimate helper should guarantee success without examining compatibility.

The Bottom Line

For Citrus ransomware, isolate first and preserve your data. Do not pay on the strength of a deadline or mistake a renamed extension for decryption.

Remove malicious access before restoring anything. If files are already locked, use verified recovery options and keep untouched encrypted copies when a working solution is not available.