New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org

Attackers using the Anubis ransomware, which is developed by a group Symantec tracks as Hawkmoth, deployed a previously undocumented custom backdoor and an unusually large number of security software-disabling tools in an October 2026 attack on an organization in the U.S. Hawkmoth runs a ransomware-as-a-service (RaaS) operation that emerged in December 2024 as a rebrand of the Sphinx ransomware. Its payload appears to be largely unchanged from the Sphinx version, with only the branding updated. As Hawkmoth operates an affiliate program, Anubis attacks may be carried out by different groups of affiliates. Attackers using it seem to be particularly tenacious. In a July 2026 Anubis attack documented by Symantec, we noted that the threat actor used four different exfiltration tools (Megasync, WinSCP, Filezilla, S3browser) to steal data from the affected network and that it was unusual to see that many of the same type of tool deployed in a single attack.

The group has claimed approximately 96 victims in the past 12 months, and the majority of them (52%) are located in the U.S., which aligns with targeting patterns by the group. We did not identify how the attackers gained initial access. The first indicator of the intrusion was the detection of the new Lindnor backdoor, which was found on two machines that were also the only two Microsoft SQL Servers among those affected.

Symantec protects you from this threat, identified by the following:

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

Audit: Bad Reputation Application Activity

System Infected: Trojan.Backdoor Activity 634

URL Reputation: Webpulse Bad Reputation Domain Request

Observed domains/IPs are covered under security categories in all WebPulse enabled products.