anubis
ransomware group · aka Anubis RaaS · Unknown; public reporting has tied Anubis RaaS advertising to Russian-language cybercrime forums, with no confirmed state affiliation · active since 2024-12
- Victims · 7d2+1 vs prior week
- Victims · 30d6
- Victims · 90d17
- All-time (tracked)121since 2025-02-25
- Last post11-14 04:22UTC
- Estimated earnings—public reporting
Profile · x-ai/grok-4.7 · updated Summaries by Vani AI
Anubis is a ransomware and data-extortion brand tracked as a ransomware-as-a-service operation. Vendor research described affiliate advertising in late 2024, with data theft, file encryption, and a public leak site used to pressure payment; some reporting also described a destructive wipe option as extra leverage. This dashboard shows 17 listed victims since 2026-08-11, with posts continuing through 2026-11-07, so the operation appears active. Named organizations fall mainly in healthcare, manufacturing, professional services, and financial services. Operator nationality, total ransom revenue, and any uniquely associated CVEs are not established in reliable public reporting.
Tactics & tooling
- Ransomware-as-a-service sold or rented to affiliates
- Double extortion: data theft plus file encryption
- Public leak-site listings used to coerce payment
- Vendor research has described an optional file-wiping mode as added pressure
- Initial access not uniquely attributed; similar RaaS affiliates commonly use stolen credentials, phishing, and exposed remote services
- No confirmed state sponsor or single public exploit chain
Targeted sectors
HealthcareManufacturing and industrial servicesProfessional servicesFinancial services
Notable public victims
Kahler Automation, Santiam Hospital & Clinics, Newcomer Cremations, Funerals & Receptions, Leadec, Gaedke & Partner Steuerberatung, Summa Gold, Quest Group, Better Accounting Solutions, Gellibrand Support Services, Marlborough Partners
Estimated earnings
No public figure.
Leak-site victims
121 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| VHV Company | · 8h ago | Building plans exposed in data breach. |
| Cuomo LLC | · 5d ago | Inside a law firm data breach. |
| Kahler Automation | · 7d ago | Fertilizer, grain and exposed data. |
| Santiam Hospital & Clinics | · 16d ago | A major medical data breach. |
| Newcomer Cremations, Funerals & Receptions | · 20d ago | Customers' personal documents and the company's internal documents. |
| Fisher59 | · 25d ago | Beverage distributor data breach. |
| Mynd | · Oct 9, 2026 | Property owners’ personal data. |
| Leadec | · Oct 7, 2026 | Will they allow this leak to happen? |
| Gaedke & Partner Steuerberatung | · Sep 22, 2026 | Data breach exposes accounting firm's client data. |
| Summa Gold | · Sep 21, 2026 | Behind the scenes of a gold mining company. |
| Quest Group | · Sep 18, 2026 | Employee data, internal files, and a few unexpected discoveries. |
| Better Accounting Solutions | · Sep 15, 2026 | Wall Street accountants data breach. |
| Gellibrand Support Services | · Sep 9, 2026 | A data breach at a company full of smiling patients. |
| Marlborough Partners | · Sep 2, 2026 | Major data breach at a capital solutions advisory firm. |
| Caduceus Medical Group | · Aug 28, 2026 | Predictable but dangerous data exposed in a healthcare company breach. |
| Interim HealthCare [Head office] | · Aug 21, 2026 | Data breach at a major healthcare franchise headquarters. |
| Scholle IPN / SIG | · Aug 18, 2026 | Data breach at a global leader in packaging manufacturing. |
| Interim HealthCare | · Aug 15, 2026 | Home Healthcare Agency & Medical Staffing. |
| Cleaver-Brooks | · Aug 11, 2026 | Major data breach at a leading industrial manufacturer. |
| Winn-Dixie | · Aug 3, 2026 | Inside a multibillion-dollar retail giant. |
| BLACKBURN'S | · Aug 3, 2026 | Major home healthcare provider data breach. |
| Cameron Regional Medical Center | · Aug 3, 2026 | Patient and employee data breach at a healthcare provider. |
| Prelys Courtage | · Jul 28, 2026 | Client data breach at a major mortgage brokerage franchise. |
| Coca-Cola / Fairlife | · Jul 27, 2026 | Major data breach at company owned by Coca Cola. |
| Eagle Crest Communities | · Jul 23, 2026 | Patient and employee data breach at elderly care service. |
| Bath Fitter | · Jul 20, 2026 | Employee data breach at a major manufacturing company. |
| Fairlife / Coca-Cola | · Jul 20, 2026 | www.fairlife.com |
| Boston Orthotics, Inc. | · Jul 13, 2026 | Patient data breach at yet another negligent clinic. |
| Casper Orthopedics | · Jul 13, 2026 | Orthopedic clinic patients' data and medical records exposed. |
| Surtifamiliar | · Jul 13, 2026 | Passports of supermarket chain employees. |
| Community Advocates | · Jul 13, 2026 | Law firm clients' personal data exposed. |
| Ferrum AG | · Jul 3, 2026 | Data breach at one of the largest family-owned manufacturing businesses in Switzerland. |
| Quest Healthcare Solutions | · Jul 2, 2026 | Employee data, internal files, and a few unexpected discoveries. |
| Northeast Pediatrics & Adolescent Medicine | · Jul 2, 2026 | Data breach exposes employees and patients of a pediatric clinic. |
| ESMS Global Limited | · Jun 29, 2026 | Medical information services data breach. |
| Boston Orthotics & Prosthetics | · Jun 29, 2026 | Patient data breach at yet another negligent clinic. |
| Nachlass Nord | · Jun 25, 2026 | Inheritance lawyers expose IDs, estate records, and client data. |
| Quest Health Solutions | · Jun 25, 2026 | Employee data, internal files, and a few unexpected discoveries. |
| KTR Real Estate Advisors | · Jun 19, 2026 | Real estate client database exposed. |
| KoMiCo | · Jun 15, 2026 | Inside the internal data of a publicly traded company. |
| Power & Tel | · Jun 14, 2026 | Data breach exposes ecommerce platforms’ dirty laundry. |
| EXCEED Energy | · Jun 14, 2026 | Data breach at an international well management specialist. |
| Singing River Health System | · Jun 14, 2026 | New data breach at a large health system provider. |
| D&M Contractors | · Jun 14, 2026 | A small breach, real employee data. |
| FÉTIS Group & SECOM Engineering | · Jun 14, 2026 | Data breach at an engineering company. Financial records, project details, and personal information. |
| Colorado Dental Wellness Center | · May 19, 2026 | Clients’ medical data breach. |
| A.R.Ge.Co | · May 19, 2026 | Accounting firm data breach. |
| Tractial | · Apr 23, 2026 | A small but substantial data breach at a fintech company. |
| Marnell Financial Services | · Apr 23, 2026 | Data breach at financial company. |
| Samuel I. White, PC | · Apr 21, 2026 | Significant breach at a law firm. |
In the news
AllVictim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .