Hackers Use New Lindnor Backdoor to Target Microsoft SQL Servers in Anubis Ransomware Attack

Gbhackers •Mayura Kathir • November 9, 2026

Attackers deploying Anubis ransomware hit a U.S. organization in October 2026 with a previously undocumented custom backdoor. The malware sat on two Microsoft SQL Server machines, disguised as a Chrome component on one and a VMware file on the other. The encryption payload was blocked, and there is no evidence that any files were encrypted. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Anubis Ransomware Uses New Lindnor Backdoor in U.S. Attack In October 2026, attackers using Anubis ransomware targeted a U.S. organization, deploying a new custom backdoor named Lindnor alongside at least 13 tools designed to disable security software. The attack was characterized by the presence of the Lindnor backdoor on two Microsoft SQL Server machines, where it disguised itself as a Chrome component and a VMware file. Symantec reported that the encryption payload was blocked before execution, and there is no evidence that any files were encrypted during the incident. The attack is linked to the Hawkmoth group, which has claimed approximately 96 victims in the past year, with a significant portion located in the U.S. The initial access method for the attackers remains unidentified, and the incident highlights the increasing sophistication of ransomware tactics. 4 sources 40

Extracted Entities

Hackers Use New Lindnor Backdoor to Target Microsoft SQL Servers in Anubis Ransomware Attack

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)

Ransomware Groups (1)

Tools (3)