# Anubis Ransomware Encrypts Nutanix Systems and Exfiltrates 1TB from Coca-Cola's Fairlife Dairy Subsidiary, Halting US Production

> The Anubis ransomware-as-a-service (RaaS) group compromised Coca-Cola's dairy subsidiary fairlife around July 9-13, 2026, encrypting Fairlife's Nutanix hyperconverged infrastructure and claiming exfiltration of ~1TB of corporate data. Fairlife suspended US dairy production (Canadian operations unaffected) after Coca-Cola disclosed the incident on July 16, 2026; Anubis listed the victim on its Tor leak site on July 20-21 and threatened to publish the stolen data within one week if a ransom is not paid.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1615
- **ID:** TL-2026-1615
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Anubis
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On or around July 9-13, 2026, the Anubis ransomware-as-a-service operation gained unauthorized access to systems belonging to fairlife, LLC, the ultra-filtered milk and protein-shake dairy subsidiary of The Coca-Cola Company. Anubis claims to have fully encrypted Fairlife's Nutanix hyperconverged infrastructure and to have exfiltrated approximately 1TB of confidential corporate data prior to encryption, consistent with Anubis's standard double-extortion playbook of staging and exfiltrating data before triggering its Go-based encryptor. Coca-Cola disclosed the incident on July 16, 2026, stating a third party gained unauthorized entry to systems related to Fairlife production, that production quality/safety was not impacted, that external cybersecurity experts and law enforcement/authorities were engaged, and that US dairy production was suspended while Canadian fairlife production continued normally. Anubis added fairlife to its dark-web data leak site on July 20-21, 2026, publicly claiming the attack, stating victims did not follow negotiation instructions left on the network, and threatening to publish the stolen 1TB unless a ransom is paid within roughly one week of listing, claiming it can restore encrypted systems "within hours" upon payment.

Anubis (RaaS, first observed December 2024 under the codename 'Sphinx', rebranded to Anubis in February 2025) is a Go-language, cross-platform (Windows/Linux/NAS/ESXi) ransomware family notable for combining conventional ECIES (Elliptic Curve Integrated Encryption Scheme, via the github.com/ecies/go library) hybrid file encryption with an optional destructive '/WIPEMODE' feature that overwrites file contents down to 0 KB, permanently destroying data even if a decryption key is later supplied or paid for. The group operates a tiered affiliate program (80/20 RaaS split, 60/40 data-extortion split, 50/50 access-monetization split), has listed roughly 94 victims as of July 20, 2026, primarily in the US, Australia, Canada, Western Europe, and Latin America, concentrated in healthcare, business services, manufacturing, hospitality, and construction, while explicitly excluding CIS countries, government, education, and non-profits. Attribution assessments point to Russian-speaking, CIS-timezone-aligned operators using aliases including 'superSonic' (RAMP forum) and 'Anubis__media' (XSS forum).

The malware's typical attack chain begins with spear-phishing (malicious attachments/links), exposed RDP, pre-existing malware loaders, or trojanized software updates for initial access. Post-compromise, the encryptor performs stealthy privilege checks by attempting to open a raw disk device handle (\\.\PHYSICALDRIVE0) rather than calling noisy Windows APIs like IsUserAnAdmin(), supports token manipulation/re-execution via an '/elevated' flag, conducts filesystem discovery excluding system and developer-tool directories (Windows, System32, Program Files, ProgramData, AppData, .nuget, .gradle, .vscode, efi, boot), and — where lateral movement has been observed — stages and exfiltrates data prior to encryption. Before encrypting, the payload terminates over 90 processes/services spanning SQL Server, backup software (Veeam, Acronis, BackupExec), and endpoint security products (Sophos, Symantec, Windows Defender components), then deletes Volume Shadow Copies via `vssadmin delete shadows /for=norealvolume /all /quiet`. Encrypted files receive the `.anubis` extension, a `RESTORE FILES.html` ransom note is dropped into affected directories, and the desktop wallpaper is changed via a registry modification referencing dropped icon/wallpaper assets in C:\ProgramData. When the destructive `/WIPEMODE` parameter is invoked, targeted files are irreversibly reduced to 0 KB in place of (or in addition to) encryption, removing any possibility of recovery regardless of ransom payment — a capability directly relevant to the Fairlife incident given the group's claim of full Nutanix-system encryption and its history of using the wipe capability to increase extortion leverage.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1059.003 Windows Command Shell
- T1078 Valid Accounts
- T1134.001 Token Impersonation/Theft
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1685.005 Clear Windows Event Logs
- T1003 OS Credential Dumping
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1069 Permission Groups Discovery
- T1021.001 Remote Desktop Protocol
- T1005 Data from Local System
- T1074 Data Staged
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1485 Data Destruction
- T1491.001 Internal Defacement

## Sources

- [Ransomware Group Threatening to Leak Data Stolen From Coca-Cola's Fairlife](https://www.securityweek.com/ransomware-group-threatening-to-leak-data-stolen-from-coca-colas-fairlife/)
- [Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak](https://www.bleepingcomputer.com/news/security/anubis-ransomware-claims-coca-cola-fairlife-attack-threatens-data-leak/)
- [Coca-Cola says Fairlife ransomware attack halts US dairy production](https://www.bleepingcomputer.com/news/security/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/)
- [Ransomware attack halts Coca-Cola's Fairlife US milk production](https://www.helpnetsecurity.com/2026/07/17/coca-cola-fairlife-ransomware-attack/)
- [Coca-Cola's dairy company fairlife hit with a ransomware attack](https://www.engadget.com/2217258/coca-cola-dairy-company-fairlife-ransomware-attack/)
- [Anubis ransomware claims Coca-Cola's Fairlife data breach](https://cybernews.com/security/coca-cola-fairlife-ransomware-attack/)
- [Fairlife pauses US production after cyberattack breached milk brand's systems](https://abcnews.com/Business/wireStory/fairlife-pauses-us-production-after-cyberattack-breached-milk-134853368)
- [Coca-Cola confirms ransomware attack as Fairlife US production halts](https://www.foodnavigator.com/Article/2026/07/17/coca-cola-confirms-ransomware-attack-as-fairlife-us-production-halts/)
- [Exclusive: Coca-Cola fairlife hack claimed by Anubis ransomware](https://www.cyberdaily.au/security/13934-exclusive-coca-cola-fairlife-hack-claimed-by-anubis-ransomware)
- [Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper](https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html)
- [Anubis Ransomware Targets Global Victims with Wiper Functionality](https://www.picussecurity.com/resource/blog/anubis-ransomware-targets-global-victims-with-wiper-functionality)
- [Anubis Ransomware: Operational Profile, Attack Chain, and Response Priorities](https://www.provendata.com/blog/anubis-ransomware)
- [Anubis Ransomware Adds Destructive Wiper Capability](https://areteir.com/article/anubis-ransomware-group-global-threat/)
- [Wipe, leak, extort: The crazy hybrid playbook of Anubis ransomware](https://blog.barracuda.com/2025/07/11/wipe--leak--extort--the-crazy-hybrid-playbook-of-anubis-ransomwa)
- [Anubis Ransomware Evolves with Integrated Wiper, Leaving Victims No Recovery Path](https://www.intertecsystems.com/threat-report-and-advisories/anubis-ransomware-evolves-with-integrated-wiper-leaving-victims-no-recovery-path)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1615