New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org

Attackers leveraging Anubis ransomware targeted a U.S. organization in October 2026, deploying a previously undocumented custom backdoor named Lindnor. The backdoor masqueraded as Chrome and VMware components on Microsoft SQL Server machines. Within approximately one hour, threat actors dropped at least 13 executables designed to terminate security services, utilizing five publicly known vulnerable drivers through Bring Your Own Vulnerable Driver (BYOVD) techniques. The attackers installed AnyDesk remote access tool with Safe Mode persistence capabilities to maintain access when security software was not fully operational. Despite deploying numerous security evasion tools and establishing multiple persistence mechanisms, the file encryption payload was successfully blocked before execution. Anubis ransomware, operated by the Hawkmoth group as a ransomware-as-a-service operation, has claimed approximately 96 victims over the past year, with 52% located in the United States.

• Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization ResearchMalware2026-09-02
• GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable DefensesMalware2026-07-09
• The Gentlemen are knocking: сustom backdoors and evolving tacticsMalware2026-06-29
• EDR killers explained: Beyond the driversMalware2026-03-19
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26