In October 2026, cybercriminals associated with Anubis ransomware infiltrated a U.S.-based organization, deploying a custom backdoor named Lindnor. This breach involved the release of at least 13 tools designed to disable security mechanisms.
Details of the Anubis Ransomware Attack
According to Symantec’s Protection Bulletin, the encryption payload was successfully blocked before execution. The Anubis ransomware, operated by a group known as Hawkmoth, functions as a ransomware-as-a-service (RaaS) platform that emerged in December 2024 as a rebranding of the Sphinx ransomware.
Hawkmoth permits affiliates to orchestrate attacks, leading to varied methodologies across different incidents. Barracuda researchers have documented the group’s tactics, which include data wiping, leaking, and extortion. Over the past year, the group has targeted approximately 96 victims, with more than half located in the United States.
Technical Aspects and Observations
The persistent nature of this group was evident in a July 2026 incident where multiple tools like Megasync, WinSCP, Filezilla, and S3browser were used for data exfiltration. Symantec’s technical analysis failed to determine the initial access method, but the presence of the Lindnor backdoor on two Microsoft SQL Servers was a significant indicator.
The backdoor was disguised as legitimate files, such as healthcontroller64.exe and svchelper.exe, and communicated with its command-and-control server using port 443, blending in with regular web traffic. This custom backdoor is a rarity in ransomware cases, typically reliant on publicly available tools.
Security Implications and Recommendations
The attackers deployed at least 13 executables to dismantle security protections, utilizing a method called Bring Your Own Vulnerable Driver (BYOVD). This involved five signed but vulnerable drivers to gain kernel-level access. Tools like gbbsym.exe and symgooq.exe masqueraded as Symantec software, with 11 of the 13 tools being previously unpublished.
Despite Symantec’s efforts, two files, huntreagent.exe and s1.exe, were not blocked, highlighting the attackers’ trial-and-error approach. The BYOVD technique exploits Windows’ trust in signed drivers, emphasizing the need for vigilant defense measures.
The attackers also installed legitimate remote access software AnyDesk, enabling persistence even in Safe Mode, where most security software is disabled. This tactic, while not new, remains infrequent and underscores the need for robust security protocols.
Conclusions and Future Outlook
The Anubis ransomware’s use of the Lindnor backdoor represents a sophisticated threat to organizational security. While the encryption was thwarted, the attacker’s preparations reveal the evolving landscape of cybersecurity threats. Organizations are advised to monitor for specific file names and hashes identified by Symantec, including domain names like msrcontrib[.]com.
Defensive strategies should involve blocking vulnerable drivers, restricting administrative privileges, and alerting on suspicious services. Close monitoring of SQL Servers is crucial, as Lindnor infections were found there. Additionally, any anomalies in AnyDesk installations and registry changes related to Safe Mode should be promptly investigated.
