anubis
ransomware group · aka Anubis, Anubis ransomware (Phobos/Dharma-linked per some researchers) · unknown; researchers have noted code and artifact similarities to the long-running Phobos/Dharma (CrySiS) ransomware family, but no confirmed operator background or country · active since Late 2024 (per vendor research; exact date varies by source). Leak-site coverage on this dashboard begins 2026-09-09.
Victims · 7d
2▲1 vs prev. week
Victims · 30d
6active targets
Victims · 90d
28
All-time (tracked)
110since 2025-02-25
Last post
09-15 02:30UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Anubis is a Windows ransomware and data-extortion operation first documented by researchers in late 2024, with several vendors noting similarities to the Phobos/Dharma (CrySiS) family, though formal attribution remains unknown. The group practices double extortion, encrypting files and publishing victim names on a Tor-based leak blog when negotiations or payments do not occur. Publicly reported victim volume and ransom activity have been modest compared with major ransomware-as-a-service brands, and no law-enforcement action or takedown has been announced. This dashboard's leak-site feed shows low-volume activity, with a single listing (Gellibrand Support Services) since tracking began on 2026-09-09. This group is distinct from the unrelated 'Anubis' Android banking trojan that shares the name.
Tactics & tooling
- Windows file encryptor that appends an extension to encrypted files and drops ransom notes (per vendor write-ups)
- Code and artifact similarities to Phobos/Dharma (CrySiS) ransomware noted by researchers
- Initial access typically linked to exposed RDP or remote-access services; no specific CVE publicly attributed (unknown)
- Double extortion: data exfiltration before encryption, followed by leak-site listing on non-payment
- Victim shaming via Tor-based leak blog; historically low posting volume
- Broad sector targeting with no clear industry concentration in public reporting (unknown)
- Cryptocurrency ransom demands; demand amounts not publicly disclosed (unknown)
Targeted sectors
Nonprofit / social servicesVarious (limited public data; no confirmed concentration)
Notable public victims
Gellibrand Support Services - Australian community/disability support not-for-profit (listed on leak site 2026-09-09)
Estimated earnings
No public figure.
Leak-site victims110 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Better Accounting Solutions | · 18h ago | Wall Street accountants data breach. |
| Gellibrand Support Services | · 6d ago | A data breach at a company full of smiling patients. |
| Marlborough Partners | · 13d ago | Major data breach at a capital solutions advisory firm. |
| Caduceus Medical Group | · 18d ago | Predictable but dangerous data exposed in a healthcare company breach. |
| Interim HealthCare [Head office] | · 25d ago | Data breach at a major healthcare franchise headquarters. |
| Scholle IPN / SIG | · 28d ago | Data breach at a global leader in packaging manufacturing. |
| Interim HealthCare | · Aug 15, 2026 | Home Healthcare Agency & Medical Staffing. |
| Cleaver-Brooks | · Aug 11, 2026 | Major data breach at a leading industrial manufacturer. |
| Winn-Dixie | · Aug 3, 2026 | Inside a multibillion-dollar retail giant. |
| BLACKBURN'S | · Aug 3, 2026 | Major home healthcare provider data breach. |
| Cameron Regional Medical Center | · Aug 3, 2026 | Patient and employee data breach at a healthcare provider. |
| Prelys Courtage | · Jul 28, 2026 | Client data breach at a major mortgage brokerage franchise. |
| Coca-Cola / Fairlife | · Jul 27, 2026 | Major data breach at company owned by Coca Cola. |
| Eagle Crest Communities | · Jul 23, 2026 | Patient and employee data breach at elderly care service. |
| Bath Fitter | · Jul 20, 2026 | Employee data breach at a major manufacturing company. |
| Fairlife / Coca-Cola | · Jul 20, 2026 | www.fairlife.com |
| Boston Orthotics, Inc. | · Jul 13, 2026 | Patient data breach at yet another negligent clinic. |
| Casper Orthopedics | · Jul 13, 2026 | Orthopedic clinic patients' data and medical records exposed. |
| Surtifamiliar | · Jul 13, 2026 | Passports of supermarket chain employees. |
| Community Advocates | · Jul 13, 2026 | Law firm clients' personal data exposed. |
| Ferrum AG | · Jul 3, 2026 | Data breach at one of the largest family-owned manufacturing businesses in Switzerland. |
| Quest Healthcare Solutions | · Jul 2, 2026 | Employee data, internal files, and a few unexpected discoveries. |
| Northeast Pediatrics & Adolescent Medicine | · Jul 2, 2026 | Data breach exposes employees and patients of a pediatric clinic. |
| ESMS Global Limited | · Jun 29, 2026 | Medical information services data breach. |
| Boston Orthotics & Prosthetics | · Jun 29, 2026 | Patient data breach at yet another negligent clinic. |
| Nachlass Nord | · Jun 25, 2026 | Inheritance lawyers expose IDs, estate records, and client data. |
| Quest Health Solutions | · Jun 25, 2026 | Employee data, internal files, and a few unexpected discoveries. |
| KTR Real Estate Advisors | · Jun 19, 2026 | Real estate client database exposed. |
| KoMiCo | · Jun 15, 2026 | Inside the internal data of a publicly traded company. |
| Power & Tel | · Jun 14, 2026 | Data breach exposes ecommerce platforms’ dirty laundry. |
| EXCEED Energy | · Jun 14, 2026 | Data breach at an international well management specialist. |
| Singing River Health System | · Jun 14, 2026 | New data breach at a large health system provider. |
| D&M Contractors | · Jun 14, 2026 | A small breach, real employee data. |
| FÉTIS Group & SECOM Engineering | · Jun 14, 2026 | Data breach at an engineering company. Financial records, project details, and personal information. |
| Colorado Dental Wellness Center | · May 19, 2026 | Clients’ medical data breach. |
| A.R.Ge.Co | · May 19, 2026 | Accounting firm data breach. |
| Tractial | · Apr 23, 2026 | A small but substantial data breach at a fintech company. |
| Marnell Financial Services | · Apr 23, 2026 | Data breach at financial company. |
| Samuel I. White, PC | · Apr 21, 2026 | Significant breach at a law firm. |
| ViaQuest | · Apr 21, 2026 | Large-scale data breach at a care provider for seriously ill patients. |
| Signature Healthcare | · Apr 9, 2026 | Will there be a release? Keep an eye on the timer. |
| Star Fuels | · Apr 7, 2026 | Data breach at a small fuel company. |
| Tesla Systems | · Apr 6, 2026 | Careless IT contractor jeopardizes client security. |
| Shine Aviation | · Apr 4, 2026 | Aviation firm data breach. |
| Publishers Clearing House | · Apr 1, 2026 | The fall of a sweepstakes giant. |
| Schlam Stone & Dolan LLP | · Mar 27, 2026 | Data breach at a law firm representing clients ranging from government institutions to Fortune 500 companies. |
| Scalian | · Mar 27, 2026 | Data breach at a major french IT company. |
| KLA Laboratories | · Mar 13, 2026 | How a single data breach exposed contracts, credentials, and critical infrastructure details. |
| L. S. King and Associates | · Mar 10, 2026 | www.cpageorgia.com - accounting firm data breach. Small dataset, big consequences. |
| A J Taylor Electrical | · Mar 10, 2026 | Data breach at electrical installation company: drawings, tenders, and other data on the healthcare and education sectors. |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .