In October 2026, a U.S. organization fell victim to a major intrusion by the Anubis ransomware group, which deployed a previously unseen custom backdoor named “Lindnor” alongside a suite of tools designed to disable security defenses. This fresh operation highlights a significant escalation in both sophistication and impact.
Anubis and the Lindnor Backdoor: Who’s Behind the Attack
The Anubis ransomware group, also known as Hawkmoth, rebranded in December 2024 from the Sphinx operation. While the core payloads have stayed largely consistent, the branding changed. Run as a ransomware-as-a-service (RaaS) model, Hawkmoth allows affiliates to carry out attacks under its umbrella. Over the past year, they’ve claimed about 96 victims globally, with around 52% located in the U.S. News of this recent attack emerged as part of Symantec’s latest threat disclosure where it confirmed the Lindnor backdoor was identified on two Microsoft SQL Server machines within the targeted network.
Inside the Breach: Tools & Tactics
The Lindnor backdoor was present on two separate SQL Server hosts—one copy named healthcontroller64.exe, disguised as part of Chrome components; the other as svchelper.exe placed in a VMware-related folder. Both ran as services and collected system information including user, computer, domain, and file path data. They communicated over HTTPS (port 443) to both primary and fallback command-and-control servers.
After establishing Lindnor, the attackers dropped at least 13 executables intended to disable security protections. Among these were five signed but vulnerable drivers—leveraging a Bring-Your-Own Vulnerable Driver (BYOVD) tactic to gain kernel-level control. Two executables mimicked Symantec names: gbbsym.exe and symgooq.exe. Most of the dropped tools were novel, though the drivers themselves were previously known vulnerabilities.
Further to this, AnyDesk was installed for remote access. The attackers created a new local user account, added it to a privileged group, and deployed a tool called safemode.exe to maintain AnyDesk functionality even when Windows entered Safe Mode with Networking—a configuration that typically disables many security agents.
Payload & Prevention
The final attempt involved deploying Anubis’s encryption component, iservice.exe, which appends files with a .anubis extension and leaves ransom demands via both .txt and .html files. The notes warn of data theft and public release if negotiations fail. An optional wiping mode exists too, one that irreversibly destroys files. Fortunately, in this incident, Symantec intercepted and blocked the encryption stage before any files were locked.
Defenders have actionable indicators: file names and hashes listed by Symantec, domains like msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com, and a key hash tied to Lindnor: fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8. Protective measures include blocking vulnerable drivers, limiting administrative privileges, watching for service binaries masquerading as legitimate components like Chrome or VMware, auditing SQL Server systems closely, and monitoring any unusual AnyDesk installation or Safe Mode registry changes.
Most unusual here is the use of a custom-made backdoor. Ransomware groups often favor off-the-shelf or repurposed tools, making Lindnor’s presence a rare development.
Why this matters: The integration of Lindnor into Anubis’s toolkit, paired with the use of BYOVD drivers and persistent access via remote tools and Safe Mode, signals a new level of threat for organizations. Security teams must stay vigilant to these emerging tactics, especially the blend of custom tools and stealthy persistence methods. Watch for refined indicators, block known weakness vectors, and assume attackers are always innovating.
