Anubis ransomware affiliate uses new Lindnor backdoor, 13 security killers and BYOVD drivers against U.S. SQL Servers; encryption blocked

Linha do tempo

1. gbhackers.com ↗ · pub. 09/11/2026 07:54 · coletado 09/11 08:00

   Anubis Ransomware Operators Deploy Lindnor Backdoor and BYOVD Killers Against U.S. SQL Servers

   ler a análise desta fonte ocultar

   Hawkmoth, the group behind the Anubis ransomware-as-a-service, hit a U.S. organization in October 2026 with a previously undocumented backdoor that Symantec calls Backdoor.Lindnor. The implant ran on two Microsoft SQL Server hosts under file names that imitate a Chrome component and a VMware file. Within about an hour the operators dropped at least 13 security-killing executables and five known vulnerable drivers, but the encryption payload was blocked and there is no evidence that files were encrypted. Initial access was not determined. Severity is high rather than critical: the intruders needed prior access to the network, no CVE is involved, and the encryptor never ran.

   Technical Details

   • Backdoor.Lindnor ran as a service under healthcontroller64.exe and svchelper.exe. It reported host and account data to a primary and a fallback C2 server over port 443.
   • The security-killing set included gbbsym.exe and symgooq.exe, which imitate Symantec binaries and accept a -l switch to list kernel callbacks and a -d switch to remove them. The observed runs used -d. Eleven of the 13 executables appear to be unpublished, while all five drivers are publicly known (gbhackers.com).
   • Only huntreagent.exe and s1.exe escaped blocking. Both have the same size and different hashes, which suggests two builds of one tool (gbhackers.com).
   • For Safe Mode persistence, safemode.exe registered AnyDesk under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk, which permits the service to start in Safe Mode with Networking (security.com). The attackers also created a local user and added it to a local group (gbhackers.com).
   • The encryptor iservice.exe appends .anubis and writes restore files.txt and restore files.html. The notes claim data theft and threaten publication. An optional wiper mode empties file contents (gbhackers.com, security.com).
   • Hawkmoth has run Anubis as a RaaS since December 2024, a rebrand of Sphinx whose payload is largely unchanged (security.com). Symantec reports about 96 victims in 12 months, 52% in the U.S. (security.com). In a July 2026 Anubis intrusion Symantec saw four exfiltration tools: Megasync, WinSCP, Filezilla and S3browser (gbhackers.com).
   • Symantec saw the backdoor on two unrelated organizations without ransomware activity (gbhackers.com). Its IOC list gives 24 file hashes and two C2 domains (security.com); these are included in the iocs field.

   Remediation

   • Symantec Endpoint products detect the published IOCs when the files are available to them (security.com). Hunt for the listed hashes and domains.
   • Monitor new service creation, unexpected driver loads, Safe Mode registry changes and unexpected AnyDesk installs, especially on SQL Servers (gbhackers.com).
   • Review recently created local accounts and local group memberships.
2. securityonline.info ↗ · pub. 08/11/2026 11:49 · coletado 08/11 12:54 primeiro registro

   Anubis ransomware affiliate deploys new Lindnor backdoor, 13 security killers and BYOVD drivers against U.S. organization

   ler a análise desta fonte ocultar

   In October 2026, an affiliate of the Anubis ransomware-as-a-service operation attacked a United States organization using a previously undocumented custom backdoor tracked by Symantec as Backdoor.Lindnor, together with at least 13 security-disabling executables (11 of them previously unpublished) and five signed, publicly known vulnerable drivers abused in a BYOVD chain. The earliest signs of compromise were on the environment's only two Microsoft SQL Server hosts, where Lindnor ran as a Windows service named healthcontroller64.exe in a folder mimicking a Chrome component unpacker directory and as svchelper.exe in a VMware folder (security.com). The initial access vector was not identified. The attackers created a local account, installed AnyDesk and registered it under the SafeBoot registry key for Safe Mode with Networking, but endpoint controls blocked 11 of the 13 killer binaries and the final encryption payload iservice.exe before any files were encrypted. Anubis is operated by a group Symantec tracks as Hawkmoth, which launched it in December 2024 as a rebrand of the Sphinx ransomware and runs an affiliate programme, so attribution of this specific intrusion to a named affiliate crew remains suspected rather than confirmed (security.com). Over the past year the operation has claimed roughly 96 victims, 52 percent of them in the United States.

   Technical Details

   • Lindnor beacons to a primary and a fallback command server over TCP/443, sending process ID, OS version, file path, computer name, username, domain name and logon server. Symantec notes the same backdoor was seen on two unrelated organizations' networks with no ransomware stage following.
   • Two killer tools, gbbsym.exe and symgooq.exe, masqueraded as Symantec software and accepted switches to enumerate and strip kernel callbacks through a loaded vulnerable driver; command logs confirm the removal switch was executed.
   • Only huntreagent.exe and s1.exe, two identically sized files, were not blocked; a utility named safemode.exe was also run.
   • The Anubis payload appends the .anubis extension, drops restore files.txt and restore files.html ransom notes threatening data publication, and supports an optional wiper mode that empties file contents.
   • A July 2026 Anubis incident saw four file-transfer utilities — Megasync, WinSCP, FileZilla and S3Browser — used in a single intrusion.
   • Symantec published two Lindnor SHA-256 hashes, including a second sample set with the filenames powerhost.exe and eventwatcher.exe (security.com).

   Remediation

   Prioritise hunting on Microsoft SQL Server hosts; audit Windows event IDs 7045 and 4697 for services launched from Chrome or VMware directories; enforce Microsoft's vulnerable driver blocklist; alert on burst deployments of unsigned executables; and monitor the SafeBoot registry hive for unauthorised AnyDesk entries. Brandefense advises isolating a suspected host from the network without rebooting into Safe Mode, which the attackers prepared for persistent access.