# Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization

> Symantec and Carbon Black Threat Hunter Team report an Anubis ransomware attack on a U.S. organization in October 2026 that used a new custom backdoor (Backdoor.Lindnor), five publicly known vulnerable signed drivers (BYOVD) and 13 security-disabling executables deployed within about an hour. AnyDesk was configured to run in Safe Mode; the encryption payload was blocked and no file encryption was found.

- **Published:** 2026-11-05T11:25:22Z
- **Last reviewed:** 2026-11-05T11:25:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5318
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5318.png
- **ID:** TL-2026-5318
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Hawkmoth
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Symantec and Carbon Black's Threat Hunter Team investigated an intrusion at a U.S. organization in October 2026 attributed to the Hawkmoth group, the operators of the Anubis ransomware-as-a-service (RaaS). Anubis first appeared in December 2024 as a work-in-progress sample named Sphinx and was analyzed by Trend Micro in June 2025; the two are essentially the same malware, differing mainly in the ransom note. Symantec reports Hawkmoth has about 96 victims over 12 months, 52% of them in the U.S. The initial access vector was not identified.

The attackers installed a previously undocumented custom backdoor, Backdoor.Lindnor, on two SQL Server machines. It was masqueraded as a Chrome component unpacker (healthcontroller64.exe) and as a VMware file (svchelper.exe) and ran as a service. On execution it sent the process ID, OS version, its own file path, computer name, user name, domain and logon server to a command-and-control server; a primary and a fallback C&C were both reached over port 443 (HTTPS). Lindnor variants were also seen on the networks of two other unrelated organizations, where no ransomware activity was observed.

Within roughly one hour the attackers deployed 13 security-disabling executables (11 previously unpublished): bdr.exe, hwaudioch.exe, gibformin.exe, test.exe, xs.scr, gibfor.exe, g.exe, backup.exe, rustr.exe, plus gbbsym.exe and symgooq.exe, which are masqueraded as Symantec files and use the -l and -d switches to list and remove kernel callbacks via a vulnerable driver. Two further tools, huntreagent.exe and s1.exe, were not blocked and their exact purpose is unknown; they may be driver executors. Five publicly known signed vulnerable drivers were used for BYOVD kernel access: havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys and fly.sys.

For remote access and persistence the attackers installed AnyDesk, created a new local user account and added it to a local group, and deployed safemode.exe to configure AnyDesk for Safe Mode with Networking by running: reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /t REG_SZ /d Service /f. The Anubis payload (iservice.exe) appends the .anubis extension, drops restore files.txt and restore files.html ransom notes, threatens publication of stolen data, and has an optional wiper mode that empties file contents. Per Trend Micro's earlier analysis, the payload uses ECIES encryption, deletes shadow copies with vssadmin and supports /KEY and /WIPEMODE parameters. In this intrusion the payload was blocked and no encryption was observed.

## MITRE ATT&CK

- T1543.003 Windows Service
- T1136.001 Local Account
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1688 Safe Mode Boot
- T1112 Modify Registry
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols
- T1008 Fallback Channels
- T1219.002 Remote Desktop Software
- T1485 Data Destruction
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Anubis Ransomware Impact — Shadow Copy Deletion, iservice.exe Switches and .anubis Artifacts** (`TL-2026-5318-SPL-002`)

Detects Anubis ransomware (Hawkmoth RaaS, formerly Sphinx) impact-stage behaviour from TL-2026-5318: vssadmin shadow copy deletion, execution of the iservice.exe payload with /KEY or /WIPEMODE switches or its known SHA-256, and creation of .anubis files or the restore files.txt / restore files.html ransom notes. Signals are rolled up per host so multiple distinct signals raise confidence. In the reported intrusion the payload was blocked, so early execution alerts matter most.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1485, T1486
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*iservice.exe" (CommandLine="*/WIPEMODE*" OR CommandLine="*/KEY*")) OR Hashes="*e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026*")) OR (EventCode=11 (TargetFilename="*.anubis" OR TargetFilename="*restore files.txt" OR TargetFilename="*restore files.html")))
| eval signal=case(EventCode=11,"anubis_artifact_written",like(Image,"%vssadmin.exe"),"shadow_copy_deletion",true(),"anubis_payload_executed")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals dc(signal) as signal_count values(Image) as processes values(CommandLine) as commands dc(TargetFilename) as artifact_files by host, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -signal_count -artifact_files
| table host User signals signal_count processes commands artifact_files first_seen last_seen count
```

### Microsoft KQL

```kql
let impact_process = DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where (FileName =~ 'vssadmin.exe' and ProcessCommandLine has_all ('delete','shadows'))
    or (FileName =~ 'iservice.exe' and ProcessCommandLine has_any ('/WIPEMODE','/KEY'))
    or SHA256 =~ 'e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026'
 | project Timestamp, DeviceName, AccountName, Signal = 'process', FileName, Detail = ProcessCommandLine, InitiatingProcessFileName;
let impact_files = DeviceFileEvents
 | where Timestamp > ago(24h)
 | where ActionType in ('FileCreated','FileRenamed')
 | where FileName endswith '.anubis' or FileName in~ ('restore files.txt','restore files.html')
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = 'file', FileName, Detail = FolderPath, InitiatingProcessFileName;
union impact_process, impact_files
| order by Timestamp desc
```

### Sigma

```yaml
title: Anubis Ransomware Payload Execution or Shadow Copy Deletion
id: 8a2d4e91-5c37-4b6f-a0d8-71e39b2c4f56
status: experimental
description: Detects execution of the Anubis ransomware payload iservice.exe with /KEY or /WIPEMODE switches and shadow copy deletion via vssadmin, as seen in the Hawkmoth intrusion tracked as TL-2026-5318.
references:
    - https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware
    - https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.impact
    - attack.t1490
    - attack.t1485
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_anubis:
        Image|endswith: '\iservice.exe'
        CommandLine|contains:
            - '/WIPEMODE'
            - '/KEY'
    selection_hash:
        Hashes|contains: 'e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026'
    condition: 1 of selection_*
falsepositives:
    - Backup or storage administration scripts that purge shadow copies with vssadmin
    - Legitimate software that happens to be named iservice.exe
level: critical
```

**Known false positives:**

- Backup or disk-management scripts that run vssadmin delete shadows during maintenance
- Legitimate applications that use a file named iservice.exe or the /KEY switch

**Tuning notes:** Exclude known backup service accounts and maintenance windows for vssadmin deletion. Treat any host with signal_count >= 2 or a .anubis / restore files artifact as an active ransomware incident. The /KEY and /WIPEMODE switches come from Trend Micro analysis of earlier Anubis builds; confirm against current samples.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Hawkmoth Security Killers — Known Hashes, Names and Fake Symantec Kernel Callback Removal (gbbsym.exe / symgooq.exe) (locked: unlock with TL Creds)
- AnyDesk Safe Mode Persistence and Local Account Creation (Hawkmoth) (locked: unlock with TL Creds)
- Backdoor.Lindnor Service Binaries Masquerading as Chrome and VMware Components (locked: unlock with TL Creds)
- Vulnerable Driver Registered as Kernel Service (BYOVD, Hawkmoth Anubis) (locked: unlock with TL Creds)
- reg.exe or safemode.exe Registering AnyDesk Under SafeBoot\Network (locked: unlock with TL Creds)
- Backdoor.Lindnor C2 — DNS Resolution of Primary and Fallback Domains (locked: unlock with TL Creds)
- Hawkmoth Anubis BYOVD — Known Vulnerable Driver Loaded or Dropped (havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys, fly.sys) (locked: unlock with TL Creds)
- Backdoor.Lindnor C2 — Network Connections to [indicator] and [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `msrcontrib[.]com`
- File hash: `fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8`
- Domain: `cfgsync-relay[.]eastus[.]cloudapp[.]azure[.]com`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org](https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware)
- [Anubis: A Closer Look at an Emerging Ransomware (Trend Micro)](https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html)
- [Anubis Ransomware Encrypts and Wipes Files, Making Recovery Impossible Even After Payment (The Hacker News)](https://thehackernews.com/2025/06/anubis-ransomware-encrypts-and-wipes.html)
- [Wipe, leak, extort: The crazy hybrid playbook of Anubis ransomware (Barracuda)](https://blog.barracuda.com/2025/07/11/wipe--leak--extort--the-crazy-hybrid-playbook-of-anubis-ransomwa)
- [New Anubis ransomware can encrypt and destroy data, making file recovery impossible (TechSpot)](https://www.techspot.com/news/108332-anubis-ransomware-can-encrypt-destroy-data-making-file.html)
- [New Anubis RaaS includes a wiper module (Security Affairs)](https://securityaffairs.com/?p=179044)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5318