Anubis Ransomware Decryption & Data Recovery

Anubis (early builds codenamed Sphinx) surfaced in December 2024: a Russian-speaking RaaS crew recruiting on RAMP and XSS as superSonic and Anubis__media, with three revenue models - encryption ransom at 80% to the affiliate, data extortion at 60%, access monetisation at 50%, restricted to US, European, Canadian and Australian targets.

What sets it apart is the wiper inside the encryptor. Detonated with /WIPEMODE it permanently zeroes file contents: the filename remains, the size reads 0 KB. Paying for a key restores nothing.

By September 2026 its leak site had named more than a hundred organisations, over half in the United States, then the UK, Australia, France and Canada, concentrated in healthcare, manufacturing, professional services and finance. In June 2026 Resecurity documented an attack on an Adriatic port authority that disrupted cargo tracking and customs processing; in July Coca-Cola disclosed a ransomware attack on its Fairlife subsidiary that halted US dairy production (Fairlife runs four US production facilities), after which Anubis claimed the intrusion on its leak site, saying it had encrypted the Nutanix platform and taken about 1 TB of data - both claims are the attackers' own and were not independently verified, though Coca-Cola later confirmed data was taken.

"Anubis" is an overloaded name, also used for an Android banking trojan and the AnubisBackdoor; both are unrelated, so attribute from the extension and sample characteristics. No mainland-China victim is publicly confirmed, but the entry points - internet-facing Citrix and SSL VPN, remote accounts without MFA - are just as common there.

Extension and note. Files get .anubis appended to the original name (Trend Micro's sample screenshots record it as .anubis. with a trailing dot, while other vendors record .anubis - go by the filenames actually on the host), and an HTML note, RESTORE FILES.html, appears in affected directories, supplying a per-victim ID, a Tor negotiation portal and a publication countdown. No email address is given.

Wipe artefacts are the most misread signal. After a /WIPEMODE detonation the directory fills with files that look normal by name but are 0 KB. Responders often read this as corruption or a disk fault and start chkdsk passes or RAID rebuilds - the most damaging mistake in these cases. Instead, count and map the zero-byte files and tally them separately from the .anubis files.

Other indicators.

• Encrypted file icons are replaced with the Anubis logo; some builds attempt a wallpaper change.
• Endpoint alerts carry names such as Ransom:Win64/Anubis.A.
• Logs show vssadmin deleting shadow copies and database and backup agent processes force-stopped.
• Linux encryptors are dropped under a six-digit-number_encrypt_x86_64 naming pattern.
• A leak-site listing with a sample data pack confirms exfiltration already happened.

Bottom line. Extension plus note attributes the family, but the ratio of encrypted to 0 KB files drives the response plan, so inventory first.

Anubis affiliates concentrate on edge appliances and valid credentials:

• CitrixBleed 2 (CVE-2025-5777). Pre-authentication memory disclosure against Citrix NetScaler devices configured as Gateway or AAA virtual servers, stealing session tokens and bypassing MFA outright - the dominant 2026 entry point.
• Valid VPN credentials. From historical breaches, infostealer logs and access brokers; responders have documented legitimate Cisco AnyConnect logins originating from a handful of VPS hosting ASNs.
• Spear phishing. Targeted mail with malicious attachments or links led the 2025 reporting and started the port authority intrusion.
• Exposed RDP. Microsoft's family description lists RDP exploitation and malware loaders among the distribution routes.

Beyond CVE-2025-5777, no public report confirms Anubis exploiting another named edge vulnerability; widening the review to every internet-facing remote-access entry point beats matching against a list of product names.

Post-access tradecraft is unremarkable but efficient: persistence through legitimate RMM tooling (ScreenConnect, Zoho Assist, MeshAgent, UltraVNC, mRemoteNG, Total Software Deployment) that blends into normal IT traffic; cloudflared installed on servers and even NAS appliances for outbound tunnels; lateral movement over RDP and PsExec with hypervisor hosts such as Hyper-V as jump points; credential access via Mimikatz, saved browser passwords and ntds.dit; exfiltration with rclone, s5cmd, S3 Browser, WinSCP and PuTTY.

Dwell time can be very short. In one documented case roughly 24 hours elapsed between the tunnelling infrastructure being stood up and the encryptor running. Patching edge appliances and enforcing MFA on VPN remain the cheapest effective controls.

Algorithms. File content is encrypted with a stream cipher and each per-file key wrapped with Elliptic Curve Integrated Encryption Scheme (ECIES); the operators advertise the pairing as "ChaCha + ECIES", and reverse engineering places the ECIES implementation in the same lineage as EvilByte and Prince (the Go ecies library). Key material must be supplied through /KEY= at launch, so without the operators' private key there is nothing to invert.

Command-line parameters. /KEY= (key), /elevated (escalation), /PATH= (directories to encrypt), /PFAD= (exclusions) and /WIPEMODE (destruction). Deployment is hands-on-keyboard and scope can differ from host to host, so damage must be inventoried machine by machine rather than extrapolated from one sample.

Behaviour. The encryptor probes access to the physical drive device to test for administrative rights and attempts token manipulation if it lacks them, then deletes volume shadow copies via vssadmin, force-stops database and backup agent processes, and skips critical system directories so the host still boots. Under /WIPEMODE the contents are permanently zeroed: the filename survives, the size does not - the first fact to establish during assessment.

On intermittent encryption. Public research has not reported that Anubis uses intermittent or partial encryption, so do not assume databases and virtual disks retain untouched regions; the overwrite pattern must be measured byte by byte against real samples, and that measurement decides whether page-level rebuilds are viable at all.

Platforms and extortion. The build set advertised in recruitment posts covers Windows, Linux, NAS and ESXi; in the field, Linux encryptors have been dropped and Synology NAS devices compromised, and in the Fairlife case the actors claimed to have encrypted a Nutanix platform. Note that no public analysis of an ESXi encryptor sample exists to date - ESXi support rests on the advertising alone, so treat virtualisation platforms as high risk without assuming a dedicated ESXi build is a settled fact. Data is stolen before encryption, with staged publication on the leak site under a countdown if no payment follows.