Anubis Ransomware Operators Deploy Lindnor Backdoor and Security-Disabling Tools

Anubis ransomware operators have breached a U.S. organization, deploying a novel custom backdoor named Lindnor alongside at least 13 tools specifically designed to disable security software. Symantec's analysis indicates that the group, tracked as Hawkmoth, operates a ransomware-as-a-service (RaaS) model, which previously rebranded from Sphinx ransomware in December 2024. While the core encryption payload remains largely unchanged, the RaaS model allows affiliates to vary attack methodologies, leading to diverse tactics observed across different incidents.

This particular attack saw the deployment of the Lindnor backdoor, disguised as legitimate system processes like 'healthcontroller64.exe' or 'svchelper.exe' and running as services. Lindnor communicates with its command-and-control server using port 443 to blend with normal web traffic, exfiltrating system information such as process IDs, Windows versions, and user credentials. The use of custom backdoors is relatively rare in ransomware operations, as most groups opt for publicly available or built-in tools, highlighting a level of sophistication by the Hawkmoth group.

Following the backdoor deployment, the attackers utilized Bring Your Own Vulnerable Driver (BYOVD) techniques, leveraging five signed but flawed drivers to achieve kernel-level control. This allowed them to disable security products by exploiting the trust Windows places in signed drivers. Some of these tools even mimicked Symantec software, such as 'gbbsym.exe' and 'symgooq.exe', in an attempt to evade detection. While Symantec managed to block most of the dropped files, the attackers' persistence was evident as they attempted multiple tools in succession.

The attackers also installed the legitimate AnyDesk remote access tool, created a new local user, and configured AnyDesk to persist through Windows Safe Mode with Networking. This maneuver provides a window of opportunity for attackers to operate with reduced security scrutiny, as many security solutions are not fully functional in Safe Mode. This tactic, while not new, is infrequently observed.

The Anubis encryptor, named 'iservice.exe', was prepared to append the '.anubis' extension to files and drop ransom notes. The group also retains an optional wiper mode, which can permanently delete file contents, adding another layer of threat beyond simple data encryption. In this instance, however, Symantec successfully blocked the encryption payload before it could execute, preventing data loss.

Symantec's investigation noted that the initial entry vector into the network remains unknown. However, the presence of Lindnor on two Microsoft SQL Servers was the first indicator of compromise. The backdoor was also observed on two other unrelated networks, though no ransomware deployment occurred in those instances, suggesting potential reconnaissance or staging activities.

Defenders are advised to monitor for specific file names, hashes, and domains associated with the Lindnor backdoor, including the key hash fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8. Additionally, blocking known vulnerable drivers, restricting administrative privileges, and alerting on new services mimicking legitimate system files are crucial mitigation steps. Close monitoring of SQL Servers and any unusual AnyDesk installations or Safe Mode registry modifications are also recommended.