Anubis ransomware operators deployed a previously undocumented backdoor and a large collection of security-disabling tools during an October 2026 intrusion at a U.S. organization, according to a new Symantec investigation. The attack reached two Microsoft SQL Server machines, but the ransomware payload was blocked before any files were encrypted.
Symantec named the malware Backdoor.Lindnor. It appeared under the filenames healthcontroller64.exe in a directory imitating a Chrome component unpacker and svchelper.exe in a VMware folder. The backdoor appeared to run as a Windows service and sent host, user, domain and operating-system details to command-and-control servers over port 443. Symantec said it also found Lindnor on networks at two unrelated organizations, although it did not identify ransomware activity at those locations.
Within roughly an hour, the attackers dropped at least 13 executables intended to terminate security products and five signed but vulnerable drivers that could provide kernel-level access. Two executables disguised themselves as Symantec software. The intruders also installed AnyDesk, created a local account and configured the remote-access tool to start in Safe Mode with Networking, where security products may not fully operate. The use of vulnerable signed drivers echoes earlier ransomware intrusions that abused the bring-your-own-vulnerable-driver technique, including the Robbinhood attacks that abused a Gigabyte driver.
The intrusion’s initial access method remains unknown. Symantec said the Anubis payload, named iservice.exe, was prevented from running, so no files were encrypted in this case. The ransomware includes an optional wiper mode that can erase file contents while leaving names and directory structures intact, a capability detailed in Abijita’s earlier coverage of Anubis’s file-wiping feature. Symantec tracks the Anubis operators as Hawkmoth, a ransomware-as-a-service operation that emerged in December 2024 as a rebrand of Sphinx.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
