Hawkmoth deploys custom Lindnor backdoor in Anubis ransomware attack
Original title: Hackers Use New Lindnor Backdoor to Target Microsoft SQL Servers in Anubis Ransomware Attack
U.S. organization hit with Anubis ransomware via Lindnor backdoor on SQL servers; security tools disabled but encryption blocked.
Attackers used custom Lindnor backdoor disguised on Microsoft SQL servers in October 2026. After installing AnyDesk and vulnerable drivers in Safe Mode, encryption payload was blocked. The group Hawkmoth targets U.S. victims frequently with similar techniques.
- Backdoor sent telemetry to C&C servers over port 443.
- Dropped 13 executables to terminate antivirus processes.
- Used Bring Your Own Vulnerable Driver approach.
- AnyDesk installed via Safe Mode registry changes.
- No files encrypted in observed case.
Impact: Initial access to Microsoft SQL servers and potential data exfiltration
- 1.Monitor for new service creations on SQL servers
- 2.Check for AnyDesk installations and Safe Mode changes
- 3.Review usage of vulnerable drivers
- Vendors
- Symantec
- Products
- Microsoft SQL Server
- Threat actors
- Hawkmoth
- Victims
- U.S. organization
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b | cb8 healthcontroller64.exe , svchelper.exe Backdoor.Lindnor 5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b powerhost.exe , eventwatcher.exe Backdoor.Lindnor ad9575a9e |
| sha256 | ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43 | 22ed0415b powerhost.exe , eventwatcher.exe Backdoor.Lindnor ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43 volumeproxy.exe Backdoor.Lindnor Note: IP addresses and dom |
| sha256 | fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8 | ervers. Indicators of Compromise SHA-256 File names Malware fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8 healthcontroller64.exe , svchelper.exe Backdoor.Lindnor 5d2 |
From the original article
3 min read at gbhackers.com
Attackers deploying Anubis ransomware hit a U. S. organization in October 2026 with a previously undocumented custom backdoor.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.