Anubis is a financially motivated ransomware-as-a-service (RaaS) operation that first emerged in November 2024, initially under the codename Sphinx, before rebranding to Anubis by February 2025. Assessed to be of Russian origin based on forum activity and language use, the group distinguishes itself by incorporating a destructive wipe mode that permanently deletes data, rendering recovery impossible even after a ransom payment, a capability that sets it apart from traditional ransomware variants. The group operates an affiliate model and offers additional monetization schemes including data extortion and access sales. It is distinct from the older Anubis Android banking trojan (first seen in 2016) and the Anubis backdoor associated with the FIN7 group (first seen in 2020).

Aliases del actor

superSonicAnubis__mediaSphinx

Actores similares

arcus-mediaactor · 5arcusmediaransomware · 4Data from Removable Mediaactor · 1Social Media Accountsactor · 1Sphinxapt · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker