Home › Threat Actors › Anubis
← All Threat Actors
Cybercrime critical Russia/CIS (assessed by Barracuda: Moscow-hours activity, Russian strings and a rule against attacking former Soviet states)

Anubis

Ransomware-as-a-Service (RaaS) operation · Financial — ransomware and regulatory-pressure extortion

Reports 1
Active Since December 2024 (per UltraViolet Cyber and Barracuda)
Last Reported 1 Jul 2026
Sectors Targeted healthcare, government, finance, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Regulatory-notification extortion: reported to threaten notification of HIPAA OCR (US), ICO (UK) and other national regulators if the ransom is not paid (single-vendor reporting; not described in UltraViolet Cyber's advisory)
  • Data-theft-only affiliate tier: exfiltration without encryption; Barracuda reports an 80/20 split for RaaS, 60% to the affiliate for data extortion and 50% for access brokers
  • Encryptor uses ECIES per UltraViolet Cyber and Barracuda; the site's earlier AES-256-CTR/RSA-4096 claim has no source and was removed
  • Wiper mode via the /WIPEMODE parameter zero-byte-overwrites files, alongside /KEY= and /elevated; uses vssadmin and raw \\.\PHYSICALDRIVE0 access; ransom note RESTORE FILES.html, extension .anubis
  • Initial access reported via RDP exploitation, credential stuffing and trojanized installers (Barracuda)
  • Tor-based leak site with staged victim listing
  • Rules reportedly bar attacks on former Soviet states (Barracuda)

Known Targets

Fairlife (Coca-Cola subsidiary): Coca-Cola disclosed the incident on 16 July 2026; Anubis claimed about 1 TB, leaked it after the deadline, and Coca-Cola confirmed data theftEarlier claimed victims include Disneyland Paris, Catawba Two Kings Casino, Parkway Construction & Architecture, Pound Road Medical Centre and Comercializadora S&E (Peru)Organisations in the US, UK, Australia, Canada, France, the Netherlands, New Zealand and PeruHealthcare, construction, hospitality and professional services (the earlier "17 confirmed US healthcare victims" and "35+ victims" figures are unverified)

Analyst Notes

Anubis surfaced in December 2024 per UltraViolet Cyber and Barracuda (this site previously said November 2024), after a precursor test build named Sphinx. Barracuda states it is unrelated to the Android banker, FIN7's Anubis backdoor or BlackCat's "Sphynx". The July 2026 Fairlife incident is the most prominent confirmed victim; most other victim counts come from leak-site claims and are unverified. The earlier profile's encryption scheme and tooling claims (AES-256-CTR/RSA-4096, Fortinet/Ivanti/Cisco ASA exploitation, BloodHound, Rclone) were not found in the sources checked and were removed. Standard ransomware IR is insufficient where regulatory pressure is threatened: legal counsel should assess notification obligations independently of payment decisions.

Also Known As

Sphinx (precursor test name; near-identical binaries suggest a rebrand)"supersonic" (RAMP forum handle)"Anubis_Media" (XSS forum handle)

MITRE ATT&CK Techniques

T1486 Data Encrypted for Impact T1485 Data Destruction T1490 Inhibit System Recovery T1657 Financial Theft

Intelligence Reports

Analysis healthcaregovernment

Anubis Ransomware: The RaaS Platform Weaponising Healthcare Regulators Against Its Own Victims

Anubis is a Go-based ransomware-as-a-service operation that emerged in late 2024 and has rapidly focused on healthcare organisations, deploying a novel pressure tactic: threatening to notify data protection regulators and HIPAA enforcement bodies unless victims pay. This deep dive covers Anubis's affiliate model, technical profile, targeting patterns, and the regulatory weaponisation that distinguishes its extortion approach.

1 Jul 2026 · 13 min read