Attackers deploying Anubis ransomware hit a U.S. organization in October 2026 with a previously undocumented custom backdoor.
The malware sat on two Microsoft SQL Server machines, disguised as a Chrome component on one and a VMware file on the other. The encryption payload was blocked, and there is no evidence that any files were encrypted.
The payload appears largely unchanged from the Sphinx version. Because affiliates carry out the attacks, tradecraft can vary between intrusions.
Hawkmoth has claimed about 96 victims in the past 12 months, and 52% of them are in the U.S. In a July 2026 Anubis intrusion, Symantec saw four exfiltration tools in a single attack: Megasync, WinSCP, Filezilla and S3browser. Symantec did not determine how the attackers gained initial access in the October case.
Lindnor ran as a service under two filenames. It ran as healthcontroller64.exe in a folder imitating a Chrome component unpacker directory, and as svchelper.exe in a VMware folder.
It sent the process ID, OS version, file path, computer name, user name, domain and logon server to a command-and-control (C&C) server. It was configured with a primary and a fallback C&C server, both reached over port 443.
Custom backdoors are uncommon in ransomware attacks, which usually rely on public, dual-use and living-off-the-land tools. Symantec also saw Lindnor on the networks of two unrelated organizations, though no ransomware activity appeared there.
Within roughly an hour, the operators dropped at least 13 executables meant to terminate security products.
They also dropped five signed but vulnerable drivers, all publicly known, in a Bring Your Own Vulnerable Driver (BYOVD) approach. Two executables, gbbsym.exe and symgooq.exe, masqueraded as Symantec software.
The -l switch lists kernel callbacks through a loaded vulnerable driver, and the -d switch lists and removes them. The observed command lines used -d. Eleven of the 13 executables appear to be previously unpublished.
Symantec attributes Anubis, to a group it tracks as Hawkmoth. The group runs a ransomware-as-a-service (RaaS) operation that emerged in December 2024 as a rebrand of Sphinx ransomware
Anubis Ransomware Attack
Everything was blocked except huntreagent.exe and s1.exe. The two files have the same size but different hashes, which suggests two builds of one tool. The pattern fits attackers cycling through tools until one works.
Symantec’s June 2026 whitepaper, “Lights Out: Defense Evasion in the Age of BYOVD,” explains why this matters. Once a signed driver loads, the Windows kernel trusts it.
A crafted request can then abuse the driver’s flaw to kill protected antivirus or EDR processes. Hundreds of vulnerable drivers are in circulation, and BYOVD tooling is now routinely bundled with RaaS payloads.
Callback removal, as the -d switch does, leaves a security agent running but blind.
The attackers installed AnyDesk and created a new local user added to a local group. They also ran safemode.exe, which configures AnyDesk to survive a Safe Mode boot.
A registry command registered AnyDesk as a service under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk.
Security software generally does not fully run in Safe Mode. That gives attackers a window to use the vulnerable drivers and switch off protections. The technique is not new but is rarely seen.
The encryptor, iservice.exe, appends the .anubis extension and drops ransom notes named restore files.txt and restore files.html.
The notes claim data theft and threaten to publish it if negotiations fail. An optional wiper mode empties file contents. In this case, the payload was blocked before the encryption phase.
Few ransomware operators build their own backdoors. The volume of security-disabling tools in one hour is also unusual. Together with the Safe Mode access route, this suggests the attackers expected security software to interfere.
The preparation still failed at the last step. Defenders should monitor new service creation, driver loading, Safe Mode registry changes and unexpected AnyDesk installs, especially on SQL Servers.
Indicators of Compromise
SHA-256File namesMalwarefc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8healthcontroller64.exe, svchelper.exeBackdoor.Lindnor5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415bpowerhost.exe, eventwatcher.exeBackdoor.Lindnorad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43volumeproxy.exeBackdoor.Lindnor
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
——————————————————–
Click Here For The Original Source.
