Loading story…
The Anubis ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring "Anubis Media" persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including XSS, BreachForums, ReHub, and RAMP, as well as X. The group reportedly listed 83 victims between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for Windows, Linux, NAS, and ESXi environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes.
Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, and mRemoteNG, then moved laterally with RDP, SMB, and PsExec. They also harvested credentials with Mimikatz, browser password exports, and ntds.dit theft, used tools such as S3 Browser, rclone, s5cmd, WinSCP, and PuTTY for exfiltration staging, and in some cases established fallback access through cloudflared, authenticated proxies, and SSH SOCKS tunnels, including activity involving Synology NAS devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The Anubis ransomware-as-a-service operation was formally announced on the RAMP cybercrime forum in February 2025 following its emergence from the late-2024 Sphinx rebrand.
Arctic Wolf observed some Anubis-linked intrusions attempting to establish alternate outbound access using cloudflared, authenticated proxies, and SSH SOCKS tunneling, including activity involving Synology NAS devices.
Across the 2026 cases, Arctic Wolf observed Anubis affiliates abusing legitimate remote administration tools for lateral movement and blending into IT activity, then using credential theft and cloud-transfer tools such as Mimikatz, rclone, WinSCP, and S3 Browser before encryption.
Arctic Wolf reported that multiple 2026 intrusions tied to the Anubis ecosystem used two main initial access paths: valid VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777) on Citrix NetScaler appliances.
Arctic Wolf reported that the Anubis ransomware-as-a-service operation emerged from a late-2024 rebrand of Sphinx and subsequently operated through affiliates.
StealthMole reported that by June 2026, Anubis had publicly listed 83 victims and maintained a unified ecosystem of leak infrastructure, communication channels, and forum identities centered on the Anubis brand.
StealthMole found that the recurring persona "Anubis Media" was used to promote the operation’s brand, services, and recruitment efforts across XSS, BreachForums, ReHub, RAMP, and X. The group advertised ransomware and data-extortion services and sought corporate access in the United States, Canada, Europe, and Australia.
StealthMole reported that Anubis publicly listed 83 victims over the period from February 2025 through June 2026, marking the start of its visible leak-site activity in the source material.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcearcticwolf.com
Open sourcestealthmole-intelligence-hub.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jun 29, 2026
Dutch paint manufacturer **AkzoNobel** confirmed a network breach at one of its U.S. sites, with the **Anubis** ransomware operation claiming responsibility and alleging theft of ~**170GB** (about **170,000 files**) of data. Reported stolen materials include confidential client agreements, employee contact details, private emails, passport scans, and technical documents; AkzoNobel said the incident was contained and impact was limited, and it did not disclose whether negotiations are underway. Reporting also noted Anubis’ evolution as a **ransomware-as-a-service (RaaS)** operation and prior use of a **data-wiper** capability intended to destroy files beyond recovery. Separately, the **University of Mississippi Medical Center (UMMC)** reported it restored normal clinic operations after a ransomware attack disrupted electronic medical records, phone lines, and multiple IT systems for nine days; no group had publicly claimed the intrusion, though officials said they were in contact with the attackers and working with authorities and specialists. Additional context on the broader ransomware landscape included a February tally of publicly disclosed incidents across sectors and geographies, and technical reporting showing how a successful brute-force login against exposed **RDP** can lead to domain enumeration, credential-hunting, and identification of geo-distributed infrastructure tied to a **RaaS ecosystem** and **initial access brokers**—highlighting continued risk from internet-exposed remote access services and credential-based intrusion paths.
Jun 29, 2026
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Jun 29, 2026