Anubis

☆ pin

Also known as Sphinx

Reports

First seen

May 13, 2026

Last seen

Oct 9, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Healthcare ×12 Retail & E-commerce ×3 Other ×2 Financial Services ×2 Manufacturing ×2 Professional Services ×2 Energy & Utilities ×1

Victim regions

×1

×20

United States×20

France×1

Germany×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×4T1567 Exfiltration Over Web Service ×2T1078 Valid Accounts ×2T1021.001 Remote Services: Remote Desktop Protocol ×2T1005 Data from Local System ×1T1021.006 Remote Services: Windows Management Instrumentation ×1T1003 OS Credential Dumping ×1T1190 Exploit Public-Facing Application ×1T1555 Credentials from Password Stores ×1T1110 Brute Force ×1T1219 Remote Access Software ×1T1490 Inhibit System Recovery ×1

Indicators

domain ×43filename ×2ip_v4 ×1cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-5777 (exploited)

Recent reports

Medium

Anubis

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Anubis ransomware gang publishes Mynd as new victim

Anubis ransomware gang publishes Leadec as victim

Anubis ransomware gang publishes Gaedke & Partner Steuerberatung as victim

Anubis ransomware gang publishes Summa Gold as victim

Anubis ransomware gang publishes Quest Group as victim

Anubis Ransomware Posts Better Accounting Solutions as Victim

Anubis ransomware operators publish Gellibrand Support Services as victim

Anubis ransomware gang claims victim: Marlborough Partners

Anubis ransomware gang publishes Caduceus Medical Group as victim

Anubis ransomware gang claims Interim HealthCare breach

Ransom Busters: Ransomware Affiliate Impersonates Data Recovery Service, Extorting Victims

Anubis ransomware gang publishes Scholle IPN victim

Anubis ransomware gang claims Interim HealthCare breach

Anubis ransomware gang publishes Cleaver-Brooks as victim

Anubis ransomware gang publishes BLACKBURN'S as victim

Anubis ransomware gang claims Cameron Regional Medical Center as victim

Anubis ransomware gang publishes Winn-Dixie as victim

Anubis ransomware gang claims Blackburn's Physicians Pharmacy breach

Anubis ransomware gang publishes Prelys Courtage as victim

Anubis ransomware claims Coca-Cola/Fairlife victim

Coca-Cola confirms data theft in Fairlife ransomware attack

Anubis ransomware gang publishes Eagle Crest Communities as victim

Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak

Anubis ransomware gang claims Bath Fitter as victim

Anubis ransomware gang claims Fairlife/Coca-Cola victim

Anubis ransomware publishes Casper Orthopedics as victim

Anubis ransomware gang publishes Surtifamiliar as new victim

Anubis ransomware gang publishes Community Advocates as victim

Anubis ransomware gang claims Ferrum AG as new victim

Ransomware Groups Exploit Citrix Bleed 2, BYOVD Techniques, and Supply Chain Credentials