Attackers using Anubis ransomware broke into a U.S. organization in October 2026. They used a new custom backdoor called Lindnor and dropped at least 13 tools built to switch off security software.
Symantec’s Protection Bulletin says the encryption payload was blocked before it could run.
Anubis ransomware Lindnor backdoor
Symantec tracks the developer of Anubis as Hawkmoth. The group runs a ransomware-as-a-service (RaaS) operation that appeared in December 2024 as a rebrand of the Sphinx ransomware. The payload looks mostly unchanged from Sphinx, and only the branding is new.
Because Hawkmoth lets affiliates carry out the attacks, the methods can change from one break-in to the next. Researchers at Barracuda have described the group’s mix of wiping, leaking and extortion. The group has claimed about 96 victims in the past 12 months, and 52% of them are in the United States.
The group is also persistent. In a July 2026 case, Symantec saw the attackers use four different tools to steal data: Megasync, WinSCP, Filezilla and S3browser. Using that many tools of one type in a single attack is unusual.
According to technical research published by Symantec, investigators did not learn how the attackers first got in. The first warning sign was the Lindnor backdoor, which sat on two machines. Those were the only two Microsoft SQL Servers among the affected systems.
The attackers named the backdoor healthcontroller64.exe on one machine and placed it in a folder made to look like a Chrome component directory. On the other machine it was svchelper.exe in a VMware folder. Both copies ran as a service.
Lindnor sends the process ID, Windows version, file path, computer name, user name, domain and logon server to its command-and-control server. It has a main server and a backup, and both use port 443, which blends in with normal web traffic.
Custom backdoors are rare in ransomware cases, since most crews use public or built-in tools. Symantec also saw Lindnor on two other unrelated networks, but no ransomware appeared there.
Within about an hour, the attackers dropped at least 13 executables meant to shut down security products. They leaned on a method called Bring Your Own Vulnerable Driver (BYOVD) and brought five signed but flawed drivers to get kernel-level control.
Two of the tools, gbbsym.exe and symgooq.exe, pretended to be Symantec software. Eleven of the 13 had not been published before, though all the drivers were already known.
Symantec blocked every dropped file except huntreagent.exe and s1.exe. Those two have the same size but different hashes, so they may be two builds of one tool. The pattern looks like trial and error, with the attackers trying one tool after another until something worked.
BYOVD works because Windows trusts signed drivers. Symantec’s Lights Out whitepaper says hundreds of vulnerable drivers are in circulation and that BYOVD tools now come bundled with RaaS kits.
Our earlier report on EDR killer tactics beyond vulnerable drivers shows how common these tools have become.
The attackers installed the real AnyDesk remote tool, then created a new local user and added it to a local group. They also ran safemode.exe, which sets AnyDesk to keep working when Windows starts in Safe Mode with Networking.
This matters because most security software does not fully run in Safe Mode. That gives attackers a quiet window to load drivers and turn off protection. The trick is not new, but it is rarely seen.
The Anubis encryptor was named iservice.exe. It adds the .anubis extension to files and leaves ransom notes called restore files.txt and restore files.html. The notes say data was stolen and will be published if talks fail.
Anubis also has an optional wiper mode that empties file contents. Our earlier coverage of Anubis wipe mode explains why paying may not bring files back. In this case, Symantec blocked the payload before encryption began.
The attackers came ready for security tools to get in their way, but the last step still failed. Symantec says few ransomware crews build their own backdoors.
Defenders should watch for the file names and hashes Symantec listed, including the domains msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com. The key Lindnor hash is fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8.
Teams should also block known vulnerable drivers, limit admin rights and alert on new services that mimic Chrome or VMware files.
Watch SQL Servers closely, because both Lindnor infections were found there. Finally, review any AnyDesk install and any odd Safe Mode registry change.
Click Here For The Original Source.
——————————————————–
