Lindnor Backdoor and Security Killer Tools Used in US Ransomware Attack

A ransomware attack against a U.S. organization involved Anubis ransomware and a newly identified custom backdoor known as Backdoor.Lindnor. The attackers deployed multiple Bring Your Own Vulnerable Driver (BYOVD) tools and security-disabling executables to obtain kernel-level access. The intrusion was ultimately disrupted before the ransomware encryption stage could begin.

The investigation started after the Lindnor backdoor was detected on two Microsoft SQL Server systems. Analysts found that the attackers disguised the malware as Chrome and VMware-related components while deploying several tools designed to terminate security services. Legitimate remote access software such as AnyDesk, configured to operate in Safe Mode, was also observed.

Organizations should configure security controls to block unauthorized driver loading and reduce exposure to BYOVD techniques. Strict execution controls for unsigned or known vulnerable drivers are essential. Security teams should also monitor for unauthorized remote access tools and suspicious registry changes associated with Safe Mode persistence or execution.

When malicious activity is detected, isolate affected SQL Server systems and audit recently installed executables and drivers. Conduct a comprehensive hunt for the Lindnor backdoor and related files such as healthcontroller64.exe or svchelper.exe . Review registry keys for AnyDesk-related modifications and investigate the creation of unauthorized local user accounts.

Attack Narrative & Commands: The adversary has gained initial access and intends to establish a persistent remote access channel that survives a reboot into Safe Mode. To evade detection from standard startup folder monitoring, the attacker targets the Windows Safe Boot registry configurations. They utilize reg.exe to inject a new value into the SafeBootNetwork registry key, specifically naming it “AnyDesk” and setting it to “Service”. This ensures that when a technician or the attacker triggers Safe Mode, AnyDesk starts automatically, providing a backdoor while the primary security suite is inactive.

Attack Narrative & Commands: The adversary has gained initial access and intends to establish a persistent remote access channel that survives a reboot into Safe Mode. To evade detection from standard startup folder monitoring, the attacker targets the Windows Safe Boot registry configurations. They utilize reg.exe to inject a new value into the SafeBootNetwork registry key, specifically naming it “AnyDesk” and setting it to “Service”. This ensures that when a technician or the attacker triggers Safe Mode, AnyDesk starts automatically, providing a backdoor while the primary security suite is inactive.

Regression Test Script: # Simulation script to mimic AnyDesk Safe Mode persistence via reg.exe # This command matches the specific strings in the detection logic. $registryPath = "HKLMSYSTEMCurrentControlSetControlSafeBootNetworkAnyDesk" $command = "reg add `"$registryPath`" /ve /t REG_SZ /d Service /f" Write-Host "[*] Executing simulation command: $command" Invoke-Expression $command if ($LASTEXITCODE -eq 0) { Write-Host "[+] Success: Telemetry should have been generated." } else { Write-Host "[-] Failure: Command failed. Ensure script is running as Administrator." }

Regression Test Script:

Cleanup Commands: # Cleanup script to remove the simulated registry key $registryPath = "HKLMSYSTEMCurrentControlSetControlSafeBootNetworkAnyDesk" Write-Host "[*] Cleaning up: Removing $registryPath" reg delete "$registryPath" /f

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.