Anubis Ransomware Attackers Deploy Custom Lindnor Backdoor and 13 Security Killers Against US Target
Do Son 
At a Glance
| Malware Family | Backdoor.Lindnor, Anubis ransomware (iservice.exe), and 13 security-killer executables with 5 vulnerable drivers |
| Threat Actor | Confirmed link to Anubis RaaS (developed by Hawkmoth, a December 2024 rebrand of Sphinx); specific affiliate operator unattributed |
| Target / Victims | 1 targeted U.S. organization ( plus 2 unrelated networks with Lindnor only); Anubis claimed ~96 victims over 12 months (52% in the U.S.) |
| Delivery Vector | Initial access vector unknown; Lindnor backdoor first detected on 2 Microsoft SQL Server hosts |
| Key Capabilities | Custom Windows service backdoor, BYOVD kernel callback removal, AnyDesk Safe Mode persistence, double-extortion encryption, optional file wiping |
TL;DR
In October 2026, attackers targeted a United States organization using the newly discovered Lindnor backdoor alongside 13 security-disabling executables and five vulnerable drivers. During the intrusion, the Anubis ransomware Lindnor backdoor deployment also registered AnyDesk to run in Windows Safe Mode before endpoint defenses blocked the final encryption binary. Over the past 12 months, the wider Anubis operation has claimed roughly 96 victims, with 52 percent located in the United States.
Delivery and Attribution
Researchers did not identify how the intruders initially breached the targeted U.S. network in October 2026. Instead, the earliest sign of compromise appeared on two machines that served as the environment’s only Microsoft SQL Server hosts. On one server, the Lindnor backdoor ran as a Windows service named healthcontroller64.exe inside a directory mimicking a Google Chrome component unpacker. On the second server, the implant ran as svchelper.exe inside a VMware folder. Analysts also spotted the same backdoor on the networks of two unrelated organizations where no ransomware stage followed.
Confirmed Versus Suspected Attribution
Confirmed tool attribution connects the blocked encryption payload to Anubis, a ransomware-as-a-service platform operated by a group Symantec tracks as Hawkmoth. Hawkmoth launched Anubis in December 2024 as a rebrand of the Sphinx ransomware, keeping the core code largely intact. However, because Hawkmoth recruits external affiliates to conduct intrusions, suspected attribution applies to the specific affiliate crew behind this attack. In an earlier July 2026 Anubis incident, operators used four separate file-transfer utilities – Megasync, WinSCP, FileZilla, and S3Browser – during a single intrusion. Across the past year, Anubis claimed approximately 96 victims, with 52 percent based in the United States.
Infection Chain
Once active on the SQL Server machines, the attackers moved to blind endpoint security sensors within roughly one hour. They dropped at least 13 security-killing executables, 11 of which were previously unpublished, alongside five signed, publicly known vulnerable drivers. By using a Bring Your Own Vulnerable Driver (BYOVD) approach, the attackers sought kernel-level privileges to shut down protection agents.
Kernel Callback Removal and Safe Mode Setup
Two of the dropped utilities, named gbbsym.exe and symgooq.exe, disguised themselves as Symantec software. Both binaries accepted a command-line switch to list kernel callbacks via a loaded vulnerable driver and a second switch to strip those callbacks from memory. Observed command logs confirmed that the attackers executed the callback removal switch. Endpoint defenses blocked 11 of the 13 binaries, leaving only two identically sized files named huntreagent.exe and s1.exe unblocked.
Next, the operators created a local user account, installed the remote desktop tool AnyDesk, and ran a utility named safemode.exe. They also executed a registry command under the SafeBoot Network key to register AnyDesk as an allowed service in Safe Mode with Networking. According to the Symantec and Carbon Black research report, “Security software generally does not fully operate in Safe Mode, which gives attackers a window to use the vulnerable drivers and switch off protections.”
Command-and-Control and Payload Behavior
To maintain remote control, the Lindnor backdoor connects to a primary command server and a fallback address over TCP port 443. Upon check-in, the service transmits the host process ID, operating system version, file path, computer name, username, domain name, and logon server. As the researchers noted, “The presence of this backdoor is notable as custom backdoors remain relatively uncommon in ransomware attacks.”
In the final stage, the attackers attempted to launch the Anubis encryption binary, named iservice.exe. When executed, Anubis appends the .anubis extension to files, drops ransom notes titled restore files.txt and restore files.html threatening data publication, and supports an optional wiper mode that empties file contents completely. However, endpoint security controls blocked iservice.exe before it could encrypt any files.
Defense and Detection Guidance
Defenders hunting for the Anubis ransomware Lindnor backdoor chain should prioritize Microsoft SQL Server hosts and audit Windows event logs (IDs 7045 and 4697) for unauthorized services running from Chrome or VMware folders. Security teams should also block known vulnerable drivers using Microsoft’s vulnerable driver blocklist and alert on burst deployments of unsigned executables. Furthermore, administrators must monitor the SafeBoot registry hive for unauthorized AnyDesk entries. As Brandefense researchers advise, responders investigating a matching alert should isolate the server from the network without rebooting into Safe Mode, since the attackers specifically prepared Safe Mode for persistent access.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
