anubis
ransomware group · aka Anubis, Anubis ransomware (Phobos/Dharma-linked per some researchers) · unknown; researchers have noted code and artifact similarities to the long-running Phobos/Dharma (CrySiS) ransomware family, but no confirmed operator background or country · active since Late 2024 (per vendor research; exact date varies by source). Leak-site coverage on this dashboard begins 2026-09-09.
Victims · 7d
2▲1 vs prev. week
Victims · 30d
6active targets
Victims · 90d
28
All-time (tracked)
110since 2025-02-25
Last post
09-15 02:30UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Anubis is a Windows ransomware and data-extortion operation first documented by researchers in late 2024, with several vendors noting similarities to the Phobos/Dharma (CrySiS) family, though formal attribution remains unknown. The group practices double extortion, encrypting files and publishing victim names on a Tor-based leak blog when negotiations or payments do not occur. Publicly reported victim volume and ransom activity have been modest compared with major ransomware-as-a-service brands, and no law-enforcement action or takedown has been announced. This dashboard's leak-site feed shows low-volume activity, with a single listing (Gellibrand Support Services) since tracking began on 2026-09-09. This group is distinct from the unrelated 'Anubis' Android banking trojan that shares the name.
Tactics & tooling
- Windows file encryptor that appends an extension to encrypted files and drops ransom notes (per vendor write-ups)
- Code and artifact similarities to Phobos/Dharma (CrySiS) ransomware noted by researchers
- Initial access typically linked to exposed RDP or remote-access services; no specific CVE publicly attributed (unknown)
- Double extortion: data exfiltration before encryption, followed by leak-site listing on non-payment
- Victim shaming via Tor-based leak blog; historically low posting volume
- Broad sector targeting with no clear industry concentration in public reporting (unknown)
- Cryptocurrency ransom demands; demand amounts not publicly disclosed (unknown)
Targeted sectors
Nonprofit / social servicesVarious (limited public data; no confirmed concentration)
Notable public victims
Gellibrand Support Services - Australian community/disability support not-for-profit (listed on leak site 2026-09-09)
Estimated earnings
No public figure.
Leak-site victims110 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Ladue Family Dental | · Mar 7, 2026 | A major leak of smiles. |
| Andal Law Group | · Mar 3, 2026 | Injury accident law firm data breach: driver IDs and other personal data. |
| AkzoNobel | · Mar 2, 2026 | Data breach at leading global paints and coatings company. |
| Physicians Clinic of Iowa | · Feb 26, 2026 | Clinic data breach: another example of negligence in a medical institution. |
| Envirogen Technologies | · Feb 26, 2026 | Major data breach of Engineering firm with high-profile clients. |
| Micaforce Technology | · Feb 21, 2026 | Data breach involving the cloud provider's clients. |
| IFL Group | · Feb 18, 2026 | Data breach at an Air Transportation Company. |
| Samkwang | · Feb 13, 2026 | Insider Information about Samsung and Other South Korean Tech Companies |
| Langley Twigg Law | Part 2 | · Feb 10, 2026 | Personal and Corporate data breach. |
| Rutherford Investment Company | · Feb 9, 2026 | Data breach of real estate investment firm: financial and Personalp identification data exposed. |
| Abel Schillinger | · Feb 8, 2026 | Patent lawyers' data breach; Drafts and intellectual property. |
| Advent Aircraft Systems, Inc. | · Feb 6, 2026 | Data breach on aerospace developments. |
| Ashby Computers | · Feb 4, 2026 | IT service data breach. |
| Law Offices of Thomas J Skinner, IV | · Feb 3, 2026 | What problems does this law firm have besides its shitty logo? Find out in the article. |
| Langley Twigg Law | · Jan 25, 2026 | Personal and Corporate data breach. |
| Vitosha Park Hotel | · Jan 25, 2026 | Employee data breach. |
| Copec S.A. | · Jan 13, 2026 | Data Breach at One of Chile's Leading Companies |
| Adriatic Port Authority | · Jan 13, 2026 | www.porto.ancona.it - data breach. |
| About Women Ob-Gyn | · Jan 8, 2026 | Data Breach at Gynecology Clinic. |
| Carbis Loadtec | · Dec 23, 2025 | Contracts, drawings, and client contacts. |
| Laidley Family Doctors | · Dec 23, 2025 | Data breach at a clinic. |
| Woodglen Medical Group | · Dec 23, 2025 | The biggest leak of boobies! |
| Deibel Laboratories | · Dec 23, 2025 | Data breach at a U.S. food safety and quality testing laboratory. |
| Markham Stouffville Hospital | · Dec 16, 2025 | Personal data. |
| Beyer Law Group | · Dec 16, 2025 | Data breach from Silicon Valley lawyers. |
| Trumbull County | · Dec 6, 2025 | The Internal Story of a County in the State of Ohio. |
| Duhabex | · Dec 6, 2025 | Data breach at a Polish international transport and logistics company. |
| Smith Fire Systems | · Dec 4, 2025 | A company that provides comprehensive fire protection services for buildings. |
| Fun For Less Tours | · Dec 1, 2025 | Customer passports and personal data. |
| Mid South Pulmonary & Sleep Specialists | · Nov 28, 2025 | Patient data breach. |
| AllerVie Health | · Nov 26, 2025 | Major customer database leak. |
| FSGROUP-Engineering | · Nov 19, 2025 | Leakage of customer contact details. |
| Lung Rose Voss Wagnild | · Nov 13, 2025 | Hawaii’s leading law firm data breach. |
| Brenda Richardson Memorial Care Home LLC | · Nov 11, 2025 | Negligence of mental health care agency employees. |
| Olive Branch Family Medical Center | · Nov 11, 2025 | Data Breach at U.S. Medical Center Puts Thousands of Patients at Risk. |
| Dermatology Associates | · Nov 6, 2025 | Leak of clinic customer data. |
| Mayco International [www.maycointernational.com] | · Nov 3, 2025 | Data breach at automotive industry leader. |
| Mayco International | · Nov 3, 2025 | Data breach at automotive industry leader. |
| Goodfellow & Schuettlaw | · Oct 23, 2025 | Personal data, confidential documents, and more. |
| Paterson & Dowding Family Lawyers | · Oct 23, 2025 | Law firm data breach |
| Aussie Fluid Power | · Oct 17, 2025 | An Australian engineering leader has fallen victim to a cyberattack causing a data breach. |
| Maine Oxy | · Oct 11, 2025 | Financial data breach |
| Den Hartogh Logistics | · Oct 10, 2025 | Data leak at one of the world's leading logistics service providers |
| One law firm in Canada | · Oct 7, 2025 | It seems they have decided to play silent. |
| Storage King | · Sep 30, 2025 | Major personal data leak |
| DRL group | · Sep 26, 2025 | Customer data leak |
| Alan Shintani, Inc | · Sep 19, 2025 | Photos and blueprints of government facilities. |
| GCC of America, inc. | · Sep 2, 2025 | Data breach at one of the largest cement and concrete producers in North America. |
| TRAF Industrial Products Inc | · Aug 28, 2025 | Data breach at an aerospace and defense contractor. |
| Grand Rapids Controls | · Aug 15, 2025 | The 150 GB leak involves confidential documents and NDA agreements with companies such as Ford, Bentley, Lear, and others. |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .