Attackers using Anubis ransomware targeted an unnamed U.S. organization in October 2026, but the encryption payload was blocked, according to Symantec’s November 5 report. Researchers found no evidence of encrypted files; initial access remains unknown.
Backdoor.Lindnor appeared on two Microsoft SQL Server machines, impersonating Chrome or VMware components. It apparently ran as a service and transmitted system information to command-and-control servers.
Within roughly an hour, attackers dropped at least 13 security-disabling executables and five signed vulnerable drivers. They also configured AnyDesk for Safe Mode operation. Two unblocked executables were unavailable for analysis, leaving their purpose uncertain.
Symantec tracks Anubis’s developer as Hawkmoth. However, its affiliate model means the ransomware name alone does not identify this intrusion’s operator. The report documents an encryption attempt stopped after attackers had already established access.
