Anubis ransomware deploys Lindnor backdoor in US attack
Original title: Anubis Ransomware Hackers Deploy New Lindnor Backdoor and 13 Security-Killing Tools in U.S. Attack
Anubis ransomware operators broke into a US organization deploying custom Lindnor backdoor and 13 security-killing tools including vulnerable drivers.
Attackers using Anubis ransomware introduced the new Lindnor backdoor on two Microsoft SQL servers in a US breach. They dropped at least 13 tools to disable security software using Bring Your Own Vulnerable Driver technique. The encryption payload was blocked before execution by Symantec.
- Lindnor backdoor named healthcontroller64.exe or svchelper.exe ran as service
- Dropped 13 tools including five signed flawed drivers
- Real AnyDesk installed with Safe Mode persistence
- Group claims 96 victims with 52% in the US
- Symantec blocked payload before encryption began
Impact: Unauthorized access data theft and potential ransomware deployment
| Product | Affected |
|---|---|
| Microsoft Windows | all |
- 1.Watch for Lindnor IOCs and hashes
- 2.Block vulnerable drivers via BYOVD
- 3.Review AnyDesk installs and Safe Mode changes
- Vendors
- Symantec
- Threat actors
- Hawkmoth
- Victims
- US organization
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | msrcontrib.com | ile names and hashes Symantec listed, including the domains msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com. The key Li |
| sha256 | fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8 | -relay.eastus.cloudapp.azure[.]com. The key Lindnor hash is fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8. Teams should also block known vulnerable drivers, limit ad |
From the original article
3 min read at cybersecuritynews.com
Attackers using Anubis ransomware broke into a U. S. organization in October 2026.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.