Skip to content
Anubis Ransomware Uses New Lindnor Backdoor in U.S. Attack

Anubis Ransomware Uses New Lindnor Backdoor in U.S. Attack

First seen 9 Nov 2026, 18:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 18:39 UTC
  • •Anubis ransomware utilized a new backdoor named Lindnor in an October 2026 attack.
  • •The attack involved at least 13 tools to disable security measures on targeted systems.
  • •No files were encrypted during the attack, as the encryption payload was blocked.

In October 2026, attackers using Anubis ransomware targeted a U.S. organization, deploying a new custom backdoor named Lindnor alongside at least 13 tools designed to disable security software. The attack was characterized by the presence of the Lindnor backdoor on two Microsoft SQL Server machines, where it disguised itself as a Chrome component and a VMware file. Symantec reported that the encryption payload was blocked before execution, and there is no evidence that any files were encrypted during the incident. The attack is linked to the Hawkmoth group, which has claimed approximately 96 victims in the past year, with a significant portion located in the U.S. The initial access method for the attackers remains unidentified, and the incident highlights the increasing sophistication of ransomware tactics.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-10-01
Anubis ransomware attack occurred
Attackers deployed the Lindnor backdoor and multiple security-disabling tools on a U.S. organization.
Broadcom
2026-11-05
Symantec Protection Bulletin released
Symantec detailed the Anubis ransomware attack, highlighting the use of the Lindnor backdoor and security tools.
Broadcom
2026-11-09
Cybersecurity news coverage published
Multiple outlets reported on the Anubis ransomware attack and the Lindnor backdoor's deployment.
Cybersecuritynews

More articles in this cluster (4)

Following this threat?

Track anubis, Hawkmoth and Lindnor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 3

Common questions

What systems were targeted?
The attackers specifically targeted Microsoft SQL Server machines within the affected organization.
Was any data encrypted during the attack?
No, the encryption payload was blocked before it could execute, and no files were encrypted.
How can organizations protect against this threat?
Organizations should ensure their security software is up to date and monitor for indicators of compromise related to the Anubis ransomware.