Loading story…
Researchers identified Anatova as a new ransomware family with a modular architecture that could expand beyond file encryption into additional malicious functions such as data theft or backdoor deployment. McAfee reported finding the malware distributed through private peer-to-peer networks, where it was disguised as games or applications to lure victims, and said infections were observed globally, with notable activity in the United States and parts of Europe.
Once executed, Anatova seeks administrator privileges, encrypts files using Salsa20, targets network shares, and deletes Windows Volume Shadow Copies to hinder recovery. The malware also uses anti-analysis techniques including checks for usernames associated with sandbox or analyst environments, encrypted strings, and dynamic API calls, while demanding a ransom payment of 10 DASH from victims.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Anatova was first observed in January 2019 after McAfee researchers discovered it in a private peer-to-peer network, where it masqueraded as a game or application to lure victims into downloading it.
The analyzed Anatova sample carried a compilation date of January 1, 2019, providing the earliest explicit anchor for the malware's development timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
Arctic Wolf reported multiple 2026 intrusions tied to the **Anubis** ransomware-as-a-service operation in which affiliates gained initial access through abused VPN credentials and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on NetScaler ADC and Gateway systems. The intrusions then progressed through lateral movement over **RDP** and **SMB**, credential harvesting, use of **PsExec**, and efforts to reduce security visibility before ransomware was deployed and files were encrypted with the `.anubis` extension. Investigators said the attackers relied heavily on legitimate remote management, tunneling, and data-transfer tools during the pre-encryption phase, including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, cloudflared, SSH tunnels, rclone, s5cmd,** and **S3 Browser**. The activity shows Anubis affiliates blending living-off-the-land techniques with benign-looking administration software to stage data and maintain access, giving defenders an opportunity to detect attacks earlier by treating unusual clusters of remote-access, credential, tunneling, and cloud-transfer behavior as signs of compromise rather than routine IT activity.
Jul 8, 2026
Prometheus emerged as a **Thanos-based ransomware** operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as `RESTORE_FILES_INFO.txt` and `.hta` variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to **REvil**, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from **$6,000 to $100,000 in Monero**, and the malware was observed terminating backup and security processes, altering services, and disabling protections including **Raccine** to speed encryption and increase pressure on victims. A free **CyCraft decryptor** later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived **Salsa20** key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related **Thanos-derived** strains including **Haron, Spook, and Midas** continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.
Aug 15, 2026