Skip to navigation

Threat reportRansomwareTL-2026-5318

Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization

highACTIVE

Symantec and Carbon Black Threat Hunter Team report an Anubis ransomware attack on a U.S. organization in October 2026 that used a new custom backdoor (Backdoor.Lindnor), five publicly known vulnerable signed drivers (BYOVD) and 13 security-disabling executables deployed within about an hour. First disclosed .

Key facts for Hawkmoth Anubis Lindnor attack

IdentifiersTL-2026-5318
Also known asBackdoor.Lindnor, Anubis ransomware
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (incl. Windows Server hosting SQL Server)
AttributionHawkmoth (medium confidence)
MalwareAnubis Ransomware, AnyDesk, Backdoor.Lindnor, Sphinx, anubis
ToolsAnyDesk
MITRE ATT&CK techniquesT1008 Fallback Channels, T1033 System Owner/User Discovery, T1036.005 Match Legitimate Resource Name or Location, T1071.001 Web Protocols, T1082 System Information Discovery, T1112 Modify Registry, T1136.001 Local Account, T1219.002 Remote Desktop Software, T1485 Data Destruction, T1490 Inhibit System Recovery, T1543.003 Windows Service, T1685 Disable or Modify Tools and 1 more in the attack flow
MotivationFINANCIAL
Target sectorshealth, hospitality, construction, engineering
Target regionsNorth America, australia, peru
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for Hawkmoth Anubis Lindnor attack

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5318 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Anubis Ransomware Impact — Shadow Copy Deletion, iservice.exe Switches and .anubis Artifacts

Detects Anubis ransomware (Hawkmoth RaaS, formerly Sphinx) impact-stage behaviour from TL-2026-5318: vssadmin shadow copy deletion, execution of the iservice.exe payload with /KEY or /WIPEMODE switches or its known SHA-256, and creation of .anubis files or the restore files.txt / restore files.html ransom notes. Signals are rolled up per host so multiple distinct signals raise confidence. In the reported intrusion the payload was blocked, so early execution alerts matter most.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1485, T1486
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*iservice.exe" (CommandLine="*/WIPEMODE*" OR CommandLine="*/KEY*")) OR Hashes="*e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026*")) OR (EventCode=11 (TargetFilename="*.anubis" OR TargetFilename="*restore files.txt" OR TargetFilename="*restore files.html")))
| eval signal=case(EventCode=11,"anubis_artifact_written",like(Image,"%vssadmin.exe"),"shadow_copy_deletion",true(),"anubis_payload_executed")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals dc(signal) as signal_count values(Image) as processes values(CommandLine) as commands dc(TargetFilename) as artifact_files by host, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -signal_count -artifact_files
| table host User signals signal_count processes commands artifact_files first_seen last_seen count

Microsoft KQL

let impact_process = DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where (FileName =~ 'vssadmin.exe' and ProcessCommandLine has_all ('delete','shadows'))
    or (FileName =~ 'iservice.exe' and ProcessCommandLine has_any ('/WIPEMODE','/KEY'))
    or SHA256 =~ 'e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026'
 | project Timestamp, DeviceName, AccountName, Signal = 'process', FileName, Detail = ProcessCommandLine, InitiatingProcessFileName;
let impact_files = DeviceFileEvents
 | where Timestamp > ago(24h)
 | where ActionType in ('FileCreated','FileRenamed')
 | where FileName endswith '.anubis' or FileName in~ ('restore files.txt','restore files.html')
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = 'file', FileName, Detail = FolderPath, InitiatingProcessFileName;
union impact_process, impact_files
| order by Timestamp desc

Sigma

title: Anubis Ransomware Payload Execution or Shadow Copy Deletion
id: 8a2d4e91-5c37-4b6f-a0d8-71e39b2c4f56
status: experimental
description: Detects execution of the Anubis ransomware payload iservice.exe with /KEY or /WIPEMODE switches and shadow copy deletion via vssadmin, as seen in the Hawkmoth intrusion tracked as TL-2026-5318.
references:
    - https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware
    - https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.impact
    - attack.t1490
    - attack.t1485
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_anubis:
        Image|endswith: '\iservice.exe'
        CommandLine|contains:
            - '/WIPEMODE'
            - '/KEY'
    selection_hash:
        Hashes|contains: 'e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026'
    condition: 1 of selection_*
falsepositives:
    - Backup or storage administration scripts that purge shadow copies with vssadmin
    - Legitimate software that happens to be named iservice.exe
level: critical

Known false positives:

  • Backup or disk-management scripts that run vssadmin delete shadows during maintenance
  • Legitimate applications that use a file named iservice.exe or the /KEY switch

Tuning notes: Exclude known backup service accounts and maintenance windows for vssadmin deletion. Treat any host with signal_count >= 2 or a .anubis / restore files artifact as an active ransomware incident. The /KEY and /WIPEMODE switches come from Trend Micro analysis of earlier Anubis builds; confirm against current samples.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Hawkmoth Security Killers — Known Hashes, Names and Fake Symantec Kernel Callback Removal (gbbsym.exe / symgooq.exe) · unlock with TL Creds
  • AnyDesk Safe Mode Persistence and Local Account Creation (Hawkmoth) · unlock with TL Creds
  • Backdoor.Lindnor Service Binaries Masquerading as Chrome and VMware Components · unlock with TL Creds
  • Vulnerable Driver Registered as Kernel Service (BYOVD, Hawkmoth Anubis) · unlock with TL Creds
  • reg.exe or safemode.exe Registering AnyDesk Under SafeBoot\Network · unlock with TL Creds
  • Backdoor.Lindnor C2 — DNS Resolution of Primary and Fallback Domains · unlock with TL Creds
  • Hawkmoth Anubis BYOVD — Known Vulnerable Driver Loaded or Dropped (havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys, fly.sys) · unlock with TL Creds
  • Backdoor.Lindnor C2 — Network Connections to [indicator] and [indicator] · unlock with TL Creds

Indicators of compromise for Hawkmoth Anubis Lindnor attack

As of 2026-11-05, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5318.

Sample indicators (3 of 29)

  • Domain: msrcontrib[.]com
  • File hash: fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8
  • Domain: cfgsync-relay[.]eastus[.]cloudapp[.]azure[.]com

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

29 indicators of compromise · unlock with TL Creds. Compare plans

How Hawkmoth Anubis Lindnor attack works

AnyDesk was configured to run in Safe Mode; the encryption payload was blocked and no file encryption was found.

Symantec and Carbon Black's Threat Hunter Team investigated an intrusion at a U.S. organization in October 2026 attributed to the Hawkmoth group, the operators of the Anubis ransomware-as-a-service (RaaS). Anubis first appeared in December 2024 as a work-in-progress sample named Sphinx and was analyzed by Trend Micro in June 2025; the two are essentially the same malware, differing mainly in the ransom note. Symantec reports Hawkmoth has about 96 victims over 12 months, 52% of them in the U.S. The initial access vector was not identified.

The attackers installed a previously undocumented custom backdoor, Backdoor.Lindnor, on two SQL Server machines. It was masqueraded as a Chrome component unpacker (healthcontroller64.exe) and as a VMware file (svchelper.exe) and ran as a service. On execution it sent the process ID, OS version, its own file path, computer name, user name, domain and logon server to a command-and-control server; a primary and a fallback C&C were both reached over port 443 (HTTPS). Lindnor variants were also seen on the networks of two other unrelated organizations, where no ransomware activity was observed.

Within roughly one hour the attackers deployed 13 security-disabling executables (11 previously unpublished): bdr.exe, hwaudioch.exe, gibformin.exe, test.exe, xs.scr, gibfor.exe, g.exe, backup.exe, rustr.exe, plus gbbsym.exe and symgooq.exe, which are masqueraded as Symantec files and use the -l and -d switches to list and remove kernel callbacks via a vulnerable driver. Two further tools, huntreagent.exe and s1.exe, were not blocked and their exact purpose is unknown; they may be driver executors. Five publicly known signed vulnerable drivers were used for BYOVD kernel access: havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys and fly.sys.

For remote access and persistence the attackers installed AnyDesk, created a new local user account and added it to a local group, and deployed safemode.exe to configure AnyDesk for Safe Mode with Networking by running: reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /t REG_SZ /d Service /f. The Anubis payload (iservice.exe) appends the .anubis extension, drops restore files.txt and restore files.html ransom notes, threatens publication of stolen data, and has an optional wiper mode that empties file contents. Per Trend Micro's earlier analysis, the payload uses ECIES encryption, deletes shadow copies with vssadmin and supports /KEY and /WIPEMODE parameters. In this intrusion the payload was blocked and no encryption was observed.

MITRE ATT&CK techniques by tactic:

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1219.002 Remote Desktop Software

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1688 Safe Mode Boot

Persistence

T1136.001 Local Account; T1543.003 Windows Service

Impact

T1485 Data Destruction; T1490 Inhibit System Recovery

Remediation for Hawkmoth Anubis Lindnor attack

Immediate actions

  • Block the listed C2 domains msrcontrib.com and cfgsync-relay.eastus.cloudapp.azure.com at DNS and proxy
  • Hunt for Lindnor service binaries (healthcontroller64.exe, svchelper.exe, powerhost.exe, eventwatcher.exe, volumeproxy.exe) and the listed SHA-256 hashes, prioritizing SQL Server hosts
  • Hunt for unauthorized AnyDesk installs and for the SafeBoot\Network\AnyDesk registry key
  • Audit for newly created local accounts and recent additions to local groups

Workarounds

  • Block creation of services from user-writable paths and monitor new service installs on SQL Server hosts
  • Alert on drivers havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys and fly.sys being written or loaded

Longer-term hardening

  • Enable Windows vulnerable driver blocklist / HVCI and block loading of known vulnerable drivers
  • Enable tamper protection on endpoint security products and alert on attempts to stop or unload them
  • Restrict and monitor remote access tools; allowlist approved tools only
  • Maintain offline, tested backups to recover from encryption or wiper activity

Affected and fixed versions

  • Microsoft — Windows (incl. Windows Server hosting SQL Server)
    Vulnerable versions: Systems without vulnerable driver blocklist enforcement or endpoint tamper protection

Timeline of Hawkmoth Anubis Lindnor attack

  • Sphinx, a work-in-progress ransomware sample later rebranded as locked-ioc-29, is first identified and Hawkmoth RaaS activity begins (December 2024; exact day not stated)
  • Trend Micro publishes its analysis of locked-ioc-29, detailing the ECIES encryption, /WIPEMODE wiper and affiliate model
  • The Hacker News reports locked-ioc-29 combines encryption with a file-wiping mode and offers 80/20, 60/40 and 50/50 affiliate splits
  • The locked-ioc-29 payload iservice.exe is blocked; no file encryption is found
  • Within about one hour, attackers deploy 13 security-disabling executables and five vulnerable drivers; locked-ioc-28 is configured for Safe Mode and a local account is created
  • Hawkmoth affiliate intrudes on a U.S. organization (October 2026; exact day not stated), deploys locked-ioc-26 on two SQL Server machines
  • Symantec and Carbon Black Threat Hunter Team publish the Lindnor and security-killer analysis

Sources cited for Hawkmoth Anubis Lindnor attack

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats