Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Anubis is a new ransomware-as-a-service (RaaS) group that combines file encryption with file destruction capabilities. Active since December 2024, it features a 'wipe mode' that permanently erases files, making recovery impossible even if ransom is paid. The group operates a flexible affiliate program, offering negotiable revenue splits and supporting additional monetization paths like data extortion and access sales. Anubis has claimed victims in multiple sectors including healthcare and construction, across regions such as Australia, Canada, Peru, and the U.S. The ransomware uses spear-phishing for initial access, employs command-line execution, privilege escalation, and shadow copy deletion. Its encryption algorithm is similar to EvilByte/Prince ransomware, using Elliptic Curve Integrated Encryption Scheme (ECIES).

Anubis is a recently identified ransomware-as-a-service (RaaS) campaign active since December 2024. It distinguishes itself by combining traditional ransomware encryption with a destructive 'wipe mode' that irreversibly deletes files, preventing recovery even if victims pay the ransom. The ransomware employs spear-phishing emails as the primary initial access vector, targeting users with tailored messages to deliver malicious payloads. Once inside a system, Anubis executes commands via command-line interfaces, escalates privileges to gain higher system control, and deletes shadow copies to hinder recovery efforts. Its encryption mechanism uses the Elliptic Curve Integrated Encryption Scheme (ECIES), similar to the EvilByte/Prince ransomware family, providing strong cryptographic protection of victim files. The group operates a flexible affiliate program with negotiable revenue splits and supports multiple monetization strategies, including data extortion and selling access to compromised networks. Anubis has targeted multiple sectors such as healthcare and construction, with known victims primarily in Australia, Canada, Peru, and the United States. The ransomware’s tactics, techniques, and procedures (TTPs) include spear-phishing (T1566), command-line execution (T1059), privilege escalation (T1134.002), shadow copy deletion (T1490), and file encryption (T1486), reflecting a sophisticated and multi-faceted attack chain designed to maximize impact and complicate remediation.

Detailed information about Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper. Get real-time updates, technical details, and mitigation strateg

Title	Severity	Type	Source	Date

Threats Tagged 'ransomware-as-a-service'

Filter Threats

Threats Tagged 'ransomware-as-a-service'