Loading story…
The Anubis ransomware group breached the Adriatic Port Authority, which operates the Italian port of Ancona, in an intrusion that reportedly began with a spear-phishing attack on December 11, 2025 and was publicly attributed after the victim appeared on the gang’s leak site in January 2026. Reporting indicates the attackers moved through the authority’s IT environment rather than operational technology systems and exfiltrated a limited set of data, including employee records and sensitive port security-related documents.
Security researchers said the compromise may have been enabled by weak cloud account protections in Office 365 and Azure, alongside broader exposure to unpatched internet-facing systems commonly exploited by ransomware-as-a-service operators. The incident has been highlighted as a warning for the maritime sector, where aging IT infrastructure and comparatively low cyber maturity continue to leave port authorities vulnerable to disruptive and data-theft-focused attacks.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Resecurity published an analysis examining the Anubis attack on the Adriatic Port Authority. The report described operational disruption, vessel rerouting, a reported $10 million bitcoin ransom demand, and likely weaknesses involving Office 365 and Azure accounts.
The attack was attributed to Anubis in January 2026 after the group listed the Adriatic Port Authority on its leak site and leaked stolen data. Reported stolen material included employee records, contracts, and sensitive port security-related documents.
The Adriatic Port Authority said the breach dated back to December 11, 2025. Resecurity assessed the intrusion likely began with a spear-phishing email and later spread through core IT systems.
Anubis launched an affiliate program as part of its ransomware-as-a-service operation. The group reportedly offered different revenue shares for ransomware deployment, data extortion, and initial access brokering.
The Anubis ransomware group emerged as a new threat actor. The reporting notes it is distinct from the older Android banking malware that used the same name.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arctic Wolf reported multiple 2026 intrusions tied to the **Anubis** ransomware-as-a-service operation in which affiliates gained initial access through abused VPN credentials and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on NetScaler ADC and Gateway systems. The intrusions then progressed through lateral movement over **RDP** and **SMB**, credential harvesting, use of **PsExec**, and efforts to reduce security visibility before ransomware was deployed and files were encrypted with the `.anubis` extension. Investigators said the attackers relied heavily on legitimate remote management, tunneling, and data-transfer tools during the pre-encryption phase, including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, cloudflared, SSH tunnels, rclone, s5cmd,** and **S3 Browser**. The activity shows Anubis affiliates blending living-off-the-land techniques with benign-looking administration software to stage data and maintain access, giving defenders an opportunity to detect attacks earlier by treating unusual clusters of remote-access, credential, tunneling, and cloud-transfer behavior as signs of compromise rather than routine IT activity.
Jul 8, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
Dutch paint manufacturer **AkzoNobel** confirmed a network breach at one of its U.S. sites, with the **Anubis** ransomware operation claiming responsibility and alleging theft of ~**170GB** (about **170,000 files**) of data. Reported stolen materials include confidential client agreements, employee contact details, private emails, passport scans, and technical documents; AkzoNobel said the incident was contained and impact was limited, and it did not disclose whether negotiations are underway. Reporting also noted Anubis’ evolution as a **ransomware-as-a-service (RaaS)** operation and prior use of a **data-wiper** capability intended to destroy files beyond recovery. Separately, the **University of Mississippi Medical Center (UMMC)** reported it restored normal clinic operations after a ransomware attack disrupted electronic medical records, phone lines, and multiple IT systems for nine days; no group had publicly claimed the intrusion, though officials said they were in contact with the attackers and working with authorities and specialists. Additional context on the broader ransomware landscape included a February tally of publicly disclosed incidents across sectors and geographies, and technical reporting showing how a successful brute-force login against exposed **RDP** can lead to domain enumeration, credential-hunting, and identification of geo-distributed infrastructure tied to a **RaaS ecosystem** and **initial access brokers**—highlighting continued risk from internet-exposed remote access services and credential-based intrusion paths.
Jun 29, 2026