Anubis

Anubis is a ransomware-as-a-service operation that emerged in late 2024 as a rebrand of Sphinx. It is a double-extortion ransomware family whose affiliates steal data prior to encryption and threaten public release to coerce payment. Reporting from 2026 also attributes to Anubis an optional destructive wipe capability that can reduce victim files to zero bytes, increasing pressure by impeding recovery even after incident response actions. The malware has been observed appending an Anubis-specific encrypted-file extension and deploying ransom notes after encryption.

Anubis intrusions in 2026 showed affiliate-driven tradecraft rather than a single uniform playbook. Initial access has been associated with spearphishing, use of valid VPN credentials, and exploitation of internet-facing systems, including CitrixBleed 2 (CVE-2025-5777). Post-compromise activity commonly includes credential access, abuse of legitimate remote monitoring and management tools, lateral movement over RDP and SMB, PsExec-based remote execution, tunneling, cloud-transfer tooling, and attempts to weaken security visibility before the final encryption stage. The operation has also been linked to exploitation of exposed VPN and public-facing enterprise services.

Victimology spans multiple sectors worldwide, including healthcare, manufacturing, construction, engineering, legal, financial services, and maritime infrastructure, with a large share of claimed victims in the United States. Publicly reported incidents tied to Anubis have included disruptive attacks against healthcare providers, manufacturing operations, and port infrastructure, demonstrating both data-theft extortion and operational disruption. Anubis is unrelated to the older Android banking trojan of the same name.