Anubis Ransomware
A ransomware-as-a-service operation that appeared in late 2024 and offers an optional wipe mode, which destroys file contents so recovery is impossible even after payment. Other malware also uses the name Anubis.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
This profile covers only the ransomware operation. FIN7 has used a Python backdoor called Anubis, and a separate Android banking trojan also has that name.4 We found no source that credibly connects them to this group, so we do not merge them.
The wipe mode changes how to think about payment. Trend Micro reports that an optional parameter erases file contents, leaving names in place at 0 KB, so a victim may not be able to recover even if they pay.1 Good backups matter more here than the promise of a decryptor.
KELA reports three affiliate programmes: ransomware, data ransom and access monetisation. It says access brokers were told to target the US, Europe, Canada or Australia, and that the group threatens to contact clients and data authorities, listing the UK's ICO among others.3 The sources reviewed name no UK victims. Healthcare appears often in reporting, though GovInfoSecurity says other sectors are also targeted.1,2
The threat to tell a regulator is designed to add pressure, so we would agree in advance who handles any ICO notification. We would also plan as if a decryptor may not work.
How It Attacks
Based on Trend Micro's analysis1 and KELA's review of the group's forum posts.3
- 1
Get In
Uses spear-phishing emails with malicious links or attachments, or access provided by affiliates and brokers.
- 2
Raise Privileges
Checks for administrative rights and relaunches itself with higher privileges.
- 3
Damage Recovery
Deletes volume shadow copies and stops services.
- 4
Encrypt or Wipe
Encrypts files and, where selected, erases their contents.
- 5
Publish and Pressure
Threatens release of stolen data and tells affected parties, clients and authorities.
Key Techniques
ATT&CK v20 has no group entry for Anubis. This mapping comes from Trend Micro.1
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566 | Phishing | Initial Access | Spear-phishing emails with links or attachments. |
| T1134.002 | Create Process with Token | Privilege Escalation | Manipulates access tokens to gain privileges. |
| T1083 | File and Directory Discovery | Discovery | Finds files to encrypt. |
| T1489 | Service Stop | Impact | Stops services before encrypting. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files. |
| T1485 | Data Destruction | Impact | Wipe mode erases file contents. |
Vulnerabilities
The sources reviewed tie no specific CVE to Anubis.1
Key Events
Warning Signs
Inferred from Trend Micro's analysis.1 None of these proves an attack alone.
- Mass deletion of volume shadow copies
- Files showing 0 KB with names unchanged
- Sudden stopping of backup and database services
Defences That Matter
Reduce Phishing Risk
- Filter links and attachments in email.
- Train staff to report suspicious messages.
Assume Wiping Is Possible
- Keep offline, immutable backups and test restores.
- Do not plan on payment for recovery, given the wipe mode.1
Close the Broker Route
- Review exposed remote access and stolen credential risk, as brokers supply access.3
Plan Regulator and Client Contact
- Agree who deals with regulators and clients, as the group threatens to contact them.3
Could You Recover if Paying Would Not Help?
We can test your backups and response plans against the methods in this profile and help you close the gaps.
Sources
- Trend Micro: Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper, 13 June 2025
- GovInfoSecurity: report on a data theft claim by RaaS gang Anubis, 10 April 2026
- KELA: Anubis: A New Ransomware Threat, updated 25 February 2025
- The Hacker News: FIN7 Deploys Anubis Backdoor to Hijack Windows Systems via Compromised SharePoint Sites, 2 April 2025
- HIPAA Journal: report on a US hospital cyber attack claimed by Anubis, April 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.