Anubis ransomware affiliate deploys new Lindnor backdoor, 13 security killers and BYOVD drivers against U.S. organization
In October 2026, an affiliate of the Anubis ransomware-as-a-service operation attacked a United States organization using a previously undocumented custom backdoor tracked by Symantec as Backdoor.Lindnor, together with at least 13 security-disabling executables (11 of them previously unpublished) and five signed, publicly known vulnerable drivers abused in a BYOVD chain. The earliest signs of compromise were on the environment's only two Microsoft SQL Server hosts, where Lindnor ran as a Windows service named healthcontroller64.exe in a folder mimicking a Chrome component unpacker directory and as svchelper.exe in a VMware folder (security.com). The initial access vector was not identified. The attackers created a local account, installed AnyDesk and registered it under the SafeBoot registry key for Safe Mode with Networking, but endpoint controls blocked 11 of the 13 killer binaries and the final encryption payload iservice.exe before any files were encrypted. Anubis is operated by a group Symantec tracks as Hawkmoth, which launched it in December 2024 as a rebrand of the Sphinx ransomware and runs an affiliate programme, so attribution of this specific intrusion to a named affiliate crew remains suspected rather than confirmed (security.com). Over the past year the operation has claimed roughly 96 victims, 52 percent of them in the United States.
Detalhes técnicos
- Lindnor beacons to a primary and a fallback command server over TCP/443, sending process ID, OS version, file path, computer name, username, domain name and logon server. Symantec notes the same backdoor was seen on two unrelated organizations' networks with no ransomware stage following.
- Two killer tools, gbbsym.exe and symgooq.exe, masqueraded as Symantec software and accepted switches to enumerate and strip kernel callbacks through a loaded vulnerable driver; command logs confirm the removal switch was executed.
- Only huntreagent.exe and s1.exe, two identically sized files, were not blocked; a utility named safemode.exe was also run.
- The Anubis payload appends the .anubis extension, drops restore files.txt and restore files.html ransom notes threatening data publication, and supports an optional wiper mode that empties file contents.
- A July 2026 Anubis incident saw four file-transfer utilities — Megasync, WinSCP, FileZilla and S3Browser — used in a single intrusion.
- Symantec published two Lindnor SHA-256 hashes, including a second sample set with the filenames powerhost.exe and eventwatcher.exe (security.com).
Remediação
Prioritise hunting on Microsoft SQL Server hosts; audit Windows event IDs 7045 and 4697 for services launched from Chrome or VMware directories; enforce Microsoft's vulnerable driver blocklist; alert on burst deployments of unsigned executables; and monitor the SafeBoot registry hive for unauthorised AnyDesk entries. Brandefense advises isolating a suspected host from the network without rebooting into Safe Mode, which the attackers prepared for persistent access.
Linha do tempo
-
Anubis ransomware affiliate deploys new Lindnor backdoor, 13 security killers and BYOVD drivers against U.S. organization
ler a análise desta fonte ocultar
In October 2026, an affiliate of the Anubis ransomware-as-a-service operation attacked a United States organization using a previously undocumented custom backdoor tracked by Symantec as Backdoor.Lindnor, together with at least 13 security-disabling executables (11 of them previously unpublished) and five signed, publicly known vulnerable drivers abused in a BYOVD chain. The earliest signs of compromise were on the environment's only two Microsoft SQL Server hosts, where Lindnor ran as a Windows service named healthcontroller64.exe in a folder mimicking a Chrome component unpacker directory and as svchelper.exe in a VMware folder (security.com). The initial access vector was not identified. The attackers created a local account, installed AnyDesk and registered it under the SafeBoot registry key for Safe Mode with Networking, but endpoint controls blocked 11 of the 13 killer binaries and the final encryption payload iservice.exe before any files were encrypted. Anubis is operated by a group Symantec tracks as Hawkmoth, which launched it in December 2024 as a rebrand of the Sphinx ransomware and runs an affiliate programme, so attribution of this specific intrusion to a named affiliate crew remains suspected rather than confirmed (security.com). Over the past year the operation has claimed roughly 96 victims, 52 percent of them in the United States.
Technical Details
- Lindnor beacons to a primary and a fallback command server over TCP/443, sending process ID, OS version, file path, computer name, username, domain name and logon server. Symantec notes the same backdoor was seen on two unrelated organizations' networks with no ransomware stage following.
- Two killer tools, gbbsym.exe and symgooq.exe, masqueraded as Symantec software and accepted switches to enumerate and strip kernel callbacks through a loaded vulnerable driver; command logs confirm the removal switch was executed.
- Only huntreagent.exe and s1.exe, two identically sized files, were not blocked; a utility named safemode.exe was also run.
- The Anubis payload appends the .anubis extension, drops restore files.txt and restore files.html ransom notes threatening data publication, and supports an optional wiper mode that empties file contents.
- A July 2026 Anubis incident saw four file-transfer utilities — Megasync, WinSCP, FileZilla and S3Browser — used in a single intrusion.
- Symantec published two Lindnor SHA-256 hashes, including a second sample set with the filenames powerhost.exe and eventwatcher.exe (security.com).
Remediation
Prioritise hunting on Microsoft SQL Server hosts; audit Windows event IDs 7045 and 4697 for services launched from Chrome or VMware directories; enforce Microsoft's vulnerable driver blocklist; alert on burst deployments of unsigned executables; and monitor the SafeBoot registry hive for unauthorised AnyDesk entries. Brandefense advises isolating a suspected host from the network without rebooting into Safe Mode, which the attackers prepared for persistent access.