Anubis

MITRE ATT&CK does not currently catalogue Anubis, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: anubis executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1569.002 Service Execution Execution

   What they do: anubis executes malicious binaries through service contexts to maintain persistence and evade user interaction.

   What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

3. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: anubis modifies registry run keys to ensure malware reactivation after system reboots.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

4. T1685 Disable or Modify Tools Defense Impairment

   What they do: anubis disables security tools like EDR and firewalls to prevent detection and hinder incident response.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

5. T1027.016 Junk Code Insertion Stealth

   What they do: anubis injects junk code into legitimate binaries to evade static analysis and behavioral detection.

   What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

6. T1070.004 File Deletion Stealth

   What they do: anubis deletes Volume Shadow Copies and backup directories to eliminate recovery options for victims.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

7. T1018 Remote System Discovery Discovery

   What they do: anubis leverages remote system discovery to identify additional hosts within the victim network for lateral movement.

   What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

8. T1057 Process Discovery Discovery

   What they do: anubis uses process discovery to identify critical services and isolate targets for disruption.

   What that means: Adversaries may attempt to get information about running processes on a system.

9. T1135 Network Share Discovery Discovery

   What they do: anubis scans network shares to map victim infrastructure and identify high-value data repositories.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

10. T1486 Data Encrypted for Impact Impact

    What they do: anubis encrypts victim files using custom symmetric encryption routines to maximize impact and extortion leverage.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

11. T1489 Service Stop Impact

    What they do: anubis stops critical Windows services and kills processes to cripple victim operations before encryption.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

12. T1490 Inhibit System Recovery Impact

    What they do: anubis triggers system shutdown commands and service termination to disrupt operational continuity.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

Good afternoon, [snip]!
This is the ANUBIS hacker team.
We want to let you know that we have been on your network for a long time and have been studying your company's business.
We have downloaded gigabytes of your data, which is now being analyzed by our best experts.
Contact us and we will provide you with a list of files that we have.
If we can't reach an agreement, we will notify every customer of the data leak.
If you ignore or refuse the deal, we will be forced to publish all your data in the public domain. 
As our blog grows and attracts media attention every day, the case will become publicized and cause devastating damage to your business. 
The only way to avoid this is to make a deal with us. Appoint a responsible person to negotiate and get down to business.
Otherwise, every client will see how you disregarded their personal information and will have a detailed plan on how to win a case against you in court.

To contact us and resolve this issue, you need to access us via TorBrowser (https://www.torproject.org/download/).
We regularly send you a chat link and your credentials through your website.
You will need to act strictly according to the instructions.
In addition, we have sent you confirmation that we hold all your data.

Then go to our website: 6g3aoky5hft4mvzcqt2bugo4r465woaorjhd7em2k2v24sr2exaro5id.onion
And enter your unique ID: [snip]

I also recommend visiting our blog via the Tor browser, there, we post files from companies that refuse to pay.
The same fate awaits you if we don�t reach an agreement. Our blog is followed by the global media.
http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion

Ransom-note text from RansomLook, licensed CC BY 4.0.