Anubis Ransomware Attack Used Lindnor Backdoor and BYOVD Tools, but Encryption Was Blocked
Summary
In an October 2026 intrusion, Anubis operators used the newly identified Backdoor.Lindnor, 13 security-disabling executables, five vulnerable drivers and AnyDesk configured for Safe Mode. The encryption payload was blocked; no files were reported encrypted.
Key points
- Attackers using Anubis targeted a U.S. organization in October 2026; the initial access method was not identified.
- Backdoor.Lindnor was found on two affected Microsoft SQL Server machines, disguised as Chrome- and VMware-related files.
- The backdoor sent host and user details to configured C2 servers over port 443.
- Attackers dropped at least 13 executables intended to terminate security products and five signed, publicly known vulnerable drivers for BYOVD activity.
- The attackers installed AnyDesk and configured it to run in Safe Mode, where security software may not fully operate.
- The Anubis encryption payload was blocked, and investigators found no evidence that files were encrypted.
- Backdoor.Lindnor was also seen on two unrelated organizations' networks, where no ransomware activity was identified.
Article Details
- Attack Vectors
- Attackers using Anubis deployed the Backdoor.Lindnor backdoor on two Microsoft SQL Server machines; the initial access method was not identified.
- The attackers dropped multiple executables and five publicly known vulnerable drivers, apparently using the drivers to gain kernel-level access and terminate security products.
- The attackers installed AnyDesk and configured it to run in Safe Mode with Networking, including registering it as a service through a Windows registry command.
- The attackers created a local user account and added it to a local group.
- The Anubis encryption payload was blocked before it could execute; the article reports no evidence that files were encrypted.
- Defensive Notes
- The Anubis encryption payload was blocked from execution in this incident.
- Symantec stated that Symantec Endpoint products detect and block an IOC when the malicious file is available to them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cfgsync-relay[.]eastus[.]cloudapp[.]azure[.]com | Specific Azure-hosted hostname listed in the article's network indicators of compromise. |
| DOMAIN | msrcontrib[.]com | Domain listed in the article's network indicators of compromise. |
| SHA256 | 28357d9666a9be36b2ea9ac6007bb8bfbe7e2438e095c1ec40720c4001f47c62 | Hash of rustr.exe, listed among executables dropped during the attack. |
| SHA256 | 2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a | Hash of fly.sys, one of five publicly known vulnerable drivers dropped for BYOVD activity. |
| SHA256 | 467d1395b61d4b886329571b564fb21db01639acd2799439646c85b9aeaec175 | Hash of the AnyDesk executable that the attackers installed for remote access. |
| SHA256 | 47a864736764112d7897c76e56d51111ce75b3e46fdbac6933df8a5b29507d17 | Hash of safemode.exe, the tool the attackers used to configure AnyDesk to run in Safe Mode. |
| SHA256 | 588887e709459f1d1a8109b089cb3462c6f796d30b6297a1a0fdb3419a3ccbce | Hash of huntreagent.exe, an attacker-dropped executable that was not available for analysis; its exact purpose is unknown. |
| SHA256 | 5a2082162852984ffe7e7c501faa6cf473129fcba29406ffb98d55198de4b3a5 | Hash of xs.scr, listed among executables dropped during the attack. |
| SHA256 | 5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db | Hash of havoc.sys, one of five publicly known vulnerable drivers dropped for BYOVD activity. |
| SHA256 | 5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b | Hash of additional Backdoor.Lindnor files identified as powerhost.exe and eventwatcher.exe. |
| SHA256 | 5fcd2c954764ac0888c8ba72fc1cf54db64e8f23f83aeb0786ae5b80438ba926 | Hash of gibfor.exe, listed among executables dropped during the attack. |
| SHA256 | 6543ee9f89d80b2bcf08e98fb8e9e73a4b144a93c7b2a3f28e35de8f7e7a8a80 | Hash of bdr.exe, listed among executables dropped during the attack. |
| SHA256 | 67dee1d52189460b88f8ce5ffa76a5c22f86ffd67f8e689118019fce0863c321 | Hash of g.exe, listed among executables dropped during the attack. |
| SHA256 | 72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258 | Hash of monprocessex.sys, one of five publicly known vulnerable drivers dropped for BYOVD activity. |
| SHA256 | 83eff3e51b69968a4ddd503b0b1dccfa8829d638f2dc00cc69640a29aea814f1 | Hash of hwaudioch.exe, listed among executables dropped during the attack. |
| SHA256 | 854c3e76beb200243ccf6af260e9a2089c2fc545f8f1b34d34c6fe86f2d056c3 | Hash of symgooq.exe, an executable that masqueraded as Symantec software and was used to list and remove kernel callbacks. |
| SHA256 | 9058388d05d984ca691a23ee70fcdbd3266c5cdc68ebc5aed95c67f1c502bc75 | Hash of bdapiutil64.sys, one of five publicly known vulnerable drivers dropped for BYOVD activity. |
| SHA256 | 962be6983f3ed4f1dc4ce117e135cc0a5ab8fc6b5f5aa0284eff8a9def66e338 | Hash of s1.exe, an attacker-dropped executable that was not available for analysis; its exact purpose is unknown. |
| SHA256 | aa779d811e00a30dfb56b994bdd63424cbf97617af737a218b6aff9f7c3a50f5 | Hash of gbbsym.exe, an executable that masqueraded as Symantec software and was used to list and remove kernel callbacks. |
| SHA256 | ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43 | Hash of a Backdoor.Lindnor file identified as volumeproxy.exe. |
| SHA256 | cd1e68583b8b984a9bb5b9f7067077c0e0d8f79da4455c326319e5e5fc6e9c5f | Hash of test.exe, listed among executables dropped during the attack. |
| SHA256 | cde8dbeaf15250337a03e07a7e257b12b03e5e951885cc69a578545f44425bdd | Hash of backup.exe, listed among executables dropped during the attack. |
| SHA256 | e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026 | Hash of the Anubis ransomware encryption payload, named iservice.exe; execution was blocked in the reported attack. |
| SHA256 | e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e | Hash of xhunter1.sys, one of five publicly known vulnerable drivers dropped for BYOVD activity. |
| SHA256 | f8d4142a94269b4258f370ef2292d22a49cd6dee8266a7122f4531e9cc5d9a2f | Hash of gibformin.exe, listed among executables dropped during the attack. |
| SHA256 | fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8 | Hash of the Backdoor.Lindnor file identified as healthcontroller64.exe and svchelper.exe. |
MITRE ATT&CK
T1033 · System Owner/User DiscoveryBackdoor.Lindnor sent the user name associated with the infected system to its command-and-control server.T1036 · MasqueradingBackdoor.Lindnor used filenames and folders resembling Chrome components and VMware files; gbbsym.exe and symgooq.exe masqueraded as Symantec software.T1068 · Exploitation for Privilege EscalationThe attackers dropped signed but vulnerable drivers for BYOVD activity to gain kernel-level access.T1082 · System Information DiscoveryBackdoor.Lindnor sent the operating system version and computer name to its command-and-control server.T1098.007 · Additional Local or Domain GroupsThe attackers added the new local user account to a local group.T1112 · Modify RegistryThe attackers used reg.exe to modify the registry so AnyDesk could run as a service in Safe Mode with Networking.T1136.001 · Local AccountThe attackers created a new local user account.T1219 · Remote Access ToolsThe attackers installed AnyDesk as a remote access tool.T1486 · Data Encrypted for ImpactThe Anubis payload was designed to encrypt files and append .anubis, but execution was blocked and the article reports no evidence of encryption.T1543.003 · Windows ServiceBackdoor.Lindnor appears to have run as a service, and the attackers registered AnyDesk as a service permitted to run in Safe Mode.T1562.001 · Disable or Modify ToolsThe attackers dropped executables to terminate security products and used vulnerable drivers to help stop security software.
Threat Actors
Malware
AnubisAttackers using the Anubis ransomware deployed a new custom backdoor and a large set of Bring Your Own Vulnerable Driver (BYOVD) tools, but attack was thwarted before encryption phase could begin.Backdoor.LindnorAttackers using the Anubis ransomware targeted a U.S. organization in October 2026 using a new custom backdoor that Symantec has called Backdoor.Lindnor.SphinxHawkmoth runs a ransomware-as-a-service (RaaS) operation that emerged in December 2024 as a rebrand of the Sphinx ransomware. Its payload appears to be largely unchanged from the Sphinx version, with only the branding
Vendors
Products
AnyDeskThe attackers also installed the legitimate remote access tool AnyDesk and a separate tool to run it in Safe Mode, likely to maintain access when security software was not fully running.Google ChromeThe backdoor masqueraded as a Chrome component and as a VMware file, and was found on two Microsoft SQL Server machines.Microsoft SQL ServerThe backdoor masqueraded as a Chrome component and as a VMware file, and was found on two Microsoft SQL Server machines.Microsoft Windowsattack, the threat actors also ran a tool, safemode.exe, that configures AnyDesk to keep working when Windows boots into Safe Mode. They ran a registry command that registered AnyDesk as a service permitted to runSymantec EndpointIf an IOC is malicious and the file is available to us, Symantec Endpoint products will detect and block that file.VMwareThe backdoor masqueraded as a Chrome component and as a VMware file, and was found on two Microsoft SQL Server machines.
Tools
AnyDeskThe attackers also installed the legitimate remote access tool AnyDesk and a separate tool to run it in Safe Mode, likely to maintain access when security software was not fully running.safemode.exeby ransomware attackers for remote access. However, in this attack, the threat actors also ran a tool, safemode.exe, that configures AnyDesk to keep working when Windows boots into Safe Mode. They ran a registry