Anubis

Anubis is a ransomware-as-a-service operation that emerged in late 2024 after rebranding from Sphinx. It operates through affiliates and has targeted organizations across multiple sectors, including healthcare, manufacturing, construction, legal services, financial services, business services, and technology, with a large share of claimed victims in the United States. The malware supports data-theft-and-encryption extortion and has been reported to include an optional destructive wipe capability that can reduce victim files to zero-byte content, increasing coercive pressure beyond conventional ransomware encryption.

Observed Anubis intrusions in 2026 show a practical, affiliate-driven tradecraft model rather than reliance on a single distinctive malware component. Initial access has been associated with spearphishing, use of valid VPN credentials, and exploitation of CitrixBleed 2 (CVE-2025-5777) against Citrix NetScaler infrastructure. Post-compromise activity has included session hijacking opportunities tied to exposed session material, credential access, lateral movement over RDP and SMB, PsExec-based remote execution, deployment of legitimate remote monitoring and management tools, tunneling utilities, cloud-transfer tools, and other living-off-the-land techniques intended to blend with normal administrative activity. Affiliates have also been observed weakening security visibility and tampering with endpoint protections before encryption.

The ransomware has been described as targeting Windows, Linux, NAS, and ESXi environments, with reported privilege escalation to SYSTEM on Windows and self-propagation of encryption across a domain. Final-stage activity includes file encryption and ransom-note deployment, while pre-encryption phases often involve staging and exfiltration of data. Anubis is therefore best understood as a multi-platform ransomware ecosystem combining initial access, credential abuse, lateral movement, defense evasion, exfiltration, encryption, and optional destructive wiping under an affiliate monetization model.