Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehighExploited in the wild

Anubis operators used Lindnor backdoor in blocked US attack

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Anubis operators deployed Lindnor on two US SQL servers; Symantec blocked encryption before any files were encrypted.

In October 2026, attackers linked to Anubis ransomware and the group Hawkmoth compromised a U.S. organization, placing the custom Lindnor backdoor on two Microsoft SQL servers. Lindnor ran as a service under names such as healthcontroller64.exe or svchelper.exe and sent telemetry to command-and-control servers over port 443. The intruders dropped at least 13 tools, including five signed vulnerable drivers, to disable security software and installed AnyDesk through Safe Mode registry changes. Symantec blocked the encryption payload before it ran, and no files were encrypted in the observed case. According to Cyber Security News, the group claims 96 victims, 52 percent of them in the United States.

Key facts
  • October 2026 intrusion targeted a U.S. organization.
  • Lindnor was installed on two Microsoft SQL servers.
  • Backdoor ran as a service and used port 443.
  • At least 13 tools included five signed vulnerable drivers.
  • AnyDesk was installed through Safe Mode registry changes.
  • Symantec blocked the payload; no files were encrypted.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersNames Hawkmoth and reports command-and-control traffic on port 443.
  • Cyber Security NewsTwo SQL servers, five signed drivers, Symantec block, and victim claim.
Vendors
Symantec
Products
Microsoft SQL Server
Threat actors
Hawkmoth
Malware
LindnorAnubis
Victims
US organizationU.S. organization

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    Hawkmoth deploys custom Lindnor backdoor in Anubis ransomware attack

    U.S. organization hit with Anubis ransomware via Lindnor backdoor on SQL servers; security tools disabled but encryption blocked.

  2. · 2d ago Cyber Security News

    Anubis ransomware deploys Lindnor backdoor in US attack

    Anubis ransomware operators broke into a US organization deploying custom Lindnor backdoor and 13 security-killing tools including vulnerable drivers.