Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-07

Anubis

Also known as:The GentlemenVECTTeamPCP

As of 2026-08-09, Anubis is a threat actor tracked by Threadlinqs Intelligence across 3 threats spanning ransomware. Also known as The Gentlemen, VECT, TeamPCP. ATT&CK coverage spans 48 techniques across 15 tactics in 3 of 3 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1078 (Valid Accounts), T1133 (External Remote Services).

Tracked threats
31 critical · 2 high
First seen
2026-07-02
Last seen
2026-08-09
ATT&CK techniques
48across 3 of 3 threats
Related CVEs
1Referenced by its activity
3 tracked threat(s) · Categories: RANSOMWARE

Activity timeline

Anubis appears in 3 tracked threats between and ; the busiest month was 2026-07 with 2 reports.

ATT&CK techniques observed

48 techniques observed across 3 of 3 tracked threats · Impact (6), Discovery (5), Command and Control (4), Credential Access (4), Defense Impairment (4), Execution (4)
  • T1005 Data from Local System — Collectionobserved in 3 of 3 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 3 of 3 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 3 of 3 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 3 of 3 tracked threats
  • T1485 Data Destruction — Impactobserved in 3 of 3 tracked threats
  • T1489 Service Stop — Impactobserved in 3 of 3 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 3 of 3 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 2 of 3 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 2 of 3 tracked threats
  • T1112 Modify Registry — Defense Impairmentobserved in 2 of 3 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 2 of 3 tracked threats
  • T1566.001 Phishing: Spearphishing Attachment — Initial Accessobserved in 2 of 3 tracked threats
  • T1572 Protocol Tunneling — Command and Controlobserved in 2 of 3 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 2 of 3 tracked threats
  • T1685.005 Clear Windows Event Logs — Defense Impairmentobserved in 2 of 3 tracked threats

Tracked threats

Related CVEs

1 CVE referenced by tracked Anubis activity