# City of Coweta, Oklahoma Hit by Anubis Ransomware Attack

> On Wednesday, August 5, 2026, the City of Coweta, Oklahoma suffered a system-wide ransomware attack that encrypted city computer systems and files, taking most municipal services offline. One local outlet (KTUL) attributes the intrusion to the Anubis Ransomware-as-a-Service operation; the city refused to negotiate or pay and is restoring from an offsite backup.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1948
- **ID:** TL-2026-1948
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Anubis
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On Wednesday, August 5, 2026, the City of Coweta, Oklahoma suffered a system-wide ransomware attack that encrypted local files, Word documents, Excel spreadsheets, and municipal financial systems across City Hall, taking most computer-based city services offline. The City's own website and its third-party online billing portal (Xpress Bill Pay) were unaffected because they are hosted off-site, and the Coweta Police and Fire Departments continued normal operations, including 911 dispatch, because they run on separate off-site systems (e.g., LexisNexis) that were not touched. Credit card and other payment data were not stored on City servers and were confirmed not accessed. The City immediately engaged its contracted IT provider and additional third-party cybersecurity professionals, placed protective holds on municipal bank accounts, reset usernames and passwords, and reported the incident to local and state authorities with federal (FBI) reporting in process. City Manager Julie Casteen publicly confirmed the attackers demanded a ransom but that the City refused to open any line of communication with them, citing her own past experience at another municipality where paying a ransom failed to resolve the intrusion. The City confirmed it holds an offsite backup and targeted the Monday after disclosure (2026-08-10) to begin restoring systems once they are cleared of the ransomware, and separately announced plans to upgrade authentication from multi-factor authentication (MFA) to passkeys.

Only one of the outlets that broke the story, KTUL, names the ransomware strain as 'Anubis'; the DataBreaches.net, Fox23, KJRH, and NewsOn6 write-ups of the same incident do not disclose a group/strain name, and none of the five articles reviewed publish a ransom note, extension, hash, or other technical artifact tying the intrusion to a specific family. Attribution here is therefore held at MEDIUM confidence, corroborated only by KTUL's single sourcing (echoed verbatim in a Fox23 sister-outlet republish) rather than independent forensic confirmation from the City, FBI, or a named incident-response firm. Notably, open-source reporting on the Anubis operation states its operators have publicly claimed to exclude government, education, and non-profit targets from their program rules — a policy commonly violated by RaaS affiliates in practice (mirroring similar unenforced 'no hospitals/no government' pledges by groups like Conti and LockBit), but a discrepancy worth flagging rather than silently resolving.

Anubis is a Ransomware-as-a-Service (RaaS) operation first observed publicly in December 2024, evolved from an earlier prototype tracked as 'Sphinx.' Affiliates most commonly gain initial access via spear-phishing emails carrying malicious attachments or links impersonating trusted senders, and separately via abuse of exposed internet-facing remote-access services — particularly RDP — using compromised, brute-forced, or previously obtained credentials. As of mid-2026, security researchers (TechTimes, Red Secure Tech, Techzine) documented Anubis affiliates also exploiting CVE-2025-5777 ('CitrixBleed 2', a Citrix NetScaler ADC/Gateway session-token disclosure flaw) to bypass MFA and gain initial footholds at scale, and using RMM tools and the Cloudflare Tunnel client ('cloudflared') for stealthy remote access/tunneling during intrusions. None of the Coweta-specific reporting discloses which of these vectors, if any, was used against the City — the CitrixBleed 2 and cloudflared details below describe the actor's documented 2026 playbook generally, not a confirmed technical finding for this incident. Once deployed, the Anubis binary (Go-language) supports command-line flags (`/KEY=`, `/elevated`, `/PATH=`, `/PFAD=`, `/WIPEMODE`) controlling encryption scope and an optional destructive wipe mode; it checks for administrative privileges via raw disk-handle access to `\\.\PHYSICALDRIVE0` and can clone an elevated token via `CreateProcessWithTokenW`, enumerates and excludes core OS/application directories before encrypting eligible files with an Elliptic Curve Integrated Encryption Scheme (ECIES) implementation drawn from the public `github.com/ecies/go` library, deletes Volume Shadow Copies (`vssadmin delete shadows /for=norealvolume /all /quiet`), terminates 50+ processes and disables 40+ services spanning SQL Server, backup agents (Veeam, Acronis), and security software (Sophos, Norton), drops a ransom note (`RESTORE FILES.html`) plus branding assets (`icon.ico`, `wall.jpg`) to `C:\ProgramData`, and appends a `.anubis` extension to encrypted files. Anubis's wipe mode is notable industry-wide for permanently overwriting file contents even where a decryption key is later provided, distinguishing it from encryption-only ransomware. The operation runs a Tor-hosted victim communication/leak-site portal and a double-extortion model, with affiliate revenue splits reported around 80/20 (encryption), 40% to Anubis for data-theft-only engagements, and 50/50 for fully managed extortion.

Remediation at Coweta to date has focused on containment and continuity: engaging outside IT/cybersecurity professionals and (per one outlet) outside cybersecurity attorneys, resetting credentials, safeguarding bank accounts, notifying law enforcement, suspending late fees and water-service disconnections during the outage, accepting in-person check payments as a workaround for disabled card processing at City Hall, and restoring from an offsite backup only after the environment is confirmed clear of the ransomware. The planned MFA-to-passkey migration is a proactive hardening step announced alongside recovery.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1134.002 Create Process with Token
- T1078 Valid Accounts
- T1112 Modify Registry
- T1110 Brute Force
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [City of Coweta hit with system-wide ransomware attack, has backup](https://databreaches.net/2026/08/07/city-of-coweta-hit-with-system-wide-ransomware-attack-has-backup/)
- [City of Coweta hit with system-wide ransomware attack](https://ktul.com/news/local/city-of-coweta-hit-with-system-wide-ransomware-attack-08-07-2026)
- [City of Coweta refuses to pay ransom after system-wide cyberattack](https://ktul.com/news/local/city-of-coweta-refuses-to-pay-ransom-after-system-wide-cyberattack-08-08-2026)
- [Coweta city leaders hope to recover some documents after ransomware attack](https://www.newson6.com/tulsa-oklahoma-news/coweta-officials-share-details-into-ransomware-attack)
- [Ransomware attack targets Coweta](https://www.kjrh.com/news/local-news/ransomware-attack-targets-coweta)
- [City of Coweta hit with system-wide ransomware attack](https://fox23.com/news/local/city-of-coweta-hit-with-system-wide-ransomware-attack)
- [News Flash - City of Coweta, OK official site](https://www.cityofcoweta-ok.gov/m/newsflash)
- [Anubis Ransomware Targets Global Victims with Wiper Functionality](https://www.picussecurity.com/resource/blog/anubis-ransomware-targets-global-victims-with-wiper-functionality)
- [Anubis: A Deep Dive into the Emerging Ransomware](https://www.bitsight.com/blog/anubis-ransomware-group-overview-and-evolution)
- [Anubis Ransomware Group: A Global Threat](https://areteir.com/resources/anubis-ransomware-group-global-threat)
- [Anubis Ransomware Hits 91 Victims: Citrix Bleed 2 Bypasses MFA Before Encryption](https://www.techtimes.com/articles/319688/20260704/anubis-ransomware-hits-91-victims-citrix-bleed-2-bypasses-mfa-before-encryption.htm)
- [From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks](https://arcticwolf.com/resources/blog/citrixbleed-2-to-cloudflared-the-tools-and-techniques-behind-anubis-ransomware-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1948