Anubis

☆ pin

Also known as Sphinx

Reports

First seen

May 13, 2026

Last seen

Aug 11, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Healthcare ×9 Retail & E-commerce ×3 Other ×2 Financial Services ×1 Energy & Utilities ×1 Manufacturing ×1

Victim regions

×1

×16

United States×16

France×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×3T1567 Exfiltration Over Web Service ×2T1005 Data from Local System ×1T1021.006 Remote Services: Windows Management Instrumentation ×1T1003 OS Credential Dumping ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1190 Exploit Public-Facing Application ×1T1112 Modify Registry ×1T1078 Valid Accounts ×1T1565 Data Destruction ×1T1133 External Remote Services ×1T1041 Exfiltration Over C2 Channel ×1

Indicators

domain ×31filename ×2cve ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-5777 (exploited)

Recent reports

High

Anubis

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Anubis ransomware gang publishes Cleaver-Brooks as victim

Anubis ransomware gang publishes BLACKBURN'S as victim

Anubis ransomware gang claims Cameron Regional Medical Center as victim

Anubis ransomware gang publishes Winn-Dixie as victim

Anubis ransomware gang claims Blackburn's Physicians Pharmacy breach

Anubis ransomware gang publishes Prelys Courtage as victim

Anubis ransomware claims Coca-Cola/Fairlife victim

Coca-Cola confirms data theft in Fairlife ransomware attack

Anubis ransomware gang publishes Eagle Crest Communities as victim

Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak

Anubis ransomware gang claims Bath Fitter as victim

Anubis ransomware gang claims Fairlife/Coca-Cola victim

Anubis ransomware publishes Casper Orthopedics as victim

Anubis ransomware gang publishes Surtifamiliar as new victim

Anubis ransomware gang publishes Community Advocates as victim

Anubis ransomware gang claims Ferrum AG as new victim

Ransomware Groups Exploit Citrix Bleed 2, BYOVD Techniques, and Supply Chain Credentials

Anubis ransomware gang publishes Quest Healthcare Solutions as victim

Anubis ransomware gang publishes Northeast Pediatrics & Adolescent Medicine as victim

Anubis ransomware gang claims ESMS Global Limited as victim

Anubis ransomware gang publishes Boston Orthotics & Prosthetics as victim

Anubis ransomware gang claims Boston Orthotics, Inc. victim

Anubis ransomware gang claims new victim: Nachlass Nord

Anubis ransomware gang publishes Quest Health Solutions as victim

Anubis ransomware gang publishes KTR Real Estate Advisors as victim

Anubis ransomware gang publishes KoMiCo as victim

Anubis ransomware gang publishes FÉTIS Group & SECOM Engineering as victims

Anubis ransomware group publishes Jeffrey Burr as victim

Anubis ransomware gang claims D&M Contractors victim

Anubis ransomware claims Singing River Health System