Loading malware…
Anubis is a name used for multiple distinct malware families, most prominently an Android banking trojan and a separate ransomware-as-a-service operation. The Android Anubis family is a banking trojan and spyware platform that targets financial applications at scale and has also exhibited ransomware functionality in some variants. It has been distributed through malicious Android applications, including droppers published on official app stores, and relies heavily on accessibility abuse and extensive device permissions to steal credentials and other sensitive data. Reported capabilities include keylogging, screenshot capture, collection of device identifiers, theft of contact lists, SMS interception and deletion, file and external storage access, and exfiltration of data from infected devices. It has targeted hundreds of financial application variants across dozens of countries and has been associated with fake update prompts used to trick victims into installing a secondary malicious package.
The Anubis ransomware operation is a separate criminal enterprise that emerged in late 2024 and has been described as a spinoff or rebrand of Sphinx. It operates as a multi-affiliate ransomware-as-a-service program targeting enterprise environments across sectors including business services, technology, financial services, and healthcare, with a large share of victims in the United States and additional activity in the United Kingdom, Australia, France, and Canada. Observed intrusions in 2026 used valid VPN credentials and exploitation of CVE-2025-5777 against Citrix NetScaler infrastructure for initial access, followed by hands-on-keyboard activity, credential theft, lateral movement over RDP and SMB, abuse of PsExec, deployment of legitimate remote management tools, tunneling utilities, and cloud-transfer tools before encryption. The ransomware supports Windows, Linux, and ESXi environments, and reporting has also described optional destructive wipe functionality that can reduce files to zero length to increase extortion pressure. The operation is characterized by blending into normal administrative activity and delaying encryption until after credential access, staging, and data theft.
A third, separate use of the name refers to a Python-based backdoor associated with FIN7. That malware has been described as providing full system control through in-memory execution and using encoded command-and-control communications. Because these are distinct malware families sharing the same name, the label Anubis is ambiguous without platform or campaign context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Exploitation de CitrixBleed 2 (CVE-2025-5777) : une vulnérabilité ciblant l’infrastructure VPN Citrix, utilisée comme vecteur d’accès initial
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In its most recent campaigns, FIN7 has been observed deploying the Python-based Anubis backdoor, which provides full system control via in-memory execution and communicates with its command-and-control infrastructure using Base64-encoded data.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Arctic Wolf observed intrusions involving valid VPN credentials and CitrixBleed 2 exploitation against NetScaler ADC and Gateway systems.
Abus d’infrastructure VPN : thème récurrent à travers les intrusions documentées
Exploitation de CitrixBleed 2 (CVE-2025-5777) : une vulnérabilité ciblant l’infrastructure VPN Citrix, utilisée comme vecteur d’accès initial
It highlights something particularly relevant to packing/unpacking: the use of DexClassLoader, an Android class used to load DEX executables, and, in the case of unpacking, to load the unpacked DEX.
In the Android manifest, we quickly notice: 1. Names are obfuscated. That’s frequent with malware... notice the first line creates a variable which is not used: this is junk code, to make reversing complicated.
That path is not in the DEX. This typically indicates the sample is packed, and the manifest references names of an unpacked DEX that we need to recover.
On May 1, 2020, a new version of Android BankBot (aka Anubis, Nautilus Bot) was spotted. The malware poses as an COVID-19 alert application.
In at least one intrusion, an Anubis encryptor was deleted after execution, reducing the availability of on-disk payload artifacts for later analysis.
Arctic Wolf observed intrusions involving valid VPN credentials and CitrixBleed 2 exploitation against NetScaler ADC and Gateway systems.
We search in the APK and quickly spot a Pa.json among the assets. Unfortunately, it is not a DEX, nor a ZIP, but encrypted content. So, at some point the asset Pa.json is read, then decrypted, then loaded with DexClassLoader.
Living-off-the-land : usage de binaires légitimes présents sur les systèmes victimes pour éviter la détection
From there, attackers moved through RDP and SMB, used PsExec service creation, deployed RMM tools, looked for credentials, weakened security visibility, and used cloud-transfer tooling before the final ransomware stage.
Our data shows that the latest version of Anubis has been distributed to 93 different countries and targets the users of 377 variations of financial apps to farm account details. We can also see that, if Anubis successfully runs, an attacker would gain access to contact lists as well as location.
a copy of the Anubis banker Trojan ... intercepts and forwards the credentials for online financial transactions to criminals.
It has a built-in keylogger that can simply steal a users’ account credentials by logging the keystrokes.
In its most recent campaigns, FIN7 has been observed deploying the Python-based Anubis backdoor, which provides full system control via in-memory execution and communicates with its command-and-control infrastructure using Base64-encoded data.
Tunnels and cloud transfer New or unexplained cloudflared , authenticated proxy, SSH SOCKS tunnel... activity on servers.
If the malicious code runs, then the app will try to trick the users into downloading and installing its payload APK with a fake system update.
SpyNote RAT can copy files from the device to the C2 server. ViceLeaker can copy arbitrary files from the device to the C2 server, can exfiltrate browsing history, can exfiltrate the SD card structure, and can exfiltrate pictures as the user takes them. TriangleDB has collected and exfiltrated files.
The post also referenced multiple encryption modes, including a "Lite Locker" option and a destructive wipe mode.
Anubis is not only a final encryptor that leaves .anubis files behind.
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware group cited as a customer of 1VPNS infrastructure services.
Ransomware operated under a Ransomware-as-a-Service model, with multiple affiliates involved in separate intrusions. The report highlights its use of VPN infrastructure abuse for initial access, including exploitation of CitrixBleed 2 (CVE-2025-5777), along with post-compromise use of legitimate RMM tools, living-off-the-land binaries, and defense evasion techniques.
Ransomware-as-a-service malware/operation used by affiliates to gain initial access, blend into normal IT activity using legitimate remote administration tools, encrypt/extort victims, and optionally invoke a /WIPEMODE capability that reduces files to 0 KB to increase pressure to pay.
Mentioned only as another example of modern ransomware intrusion behavior involving abuse of remote-management tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.