Anubis Ransomware Crew Brought Its Own Backdoor and 13 Security Killers

Anubis ransomware attackers showed up at a U.S. organization in October with something most ransomware crews don’t bother with: their own custom backdoor. Symantec says the new Lindnor backdoor sat on two Microsoft SQL servers, then in about an hour the attackers dropped at least 13 security-killing tools and five vulnerable drivers, and rigged AnyDesk to keep working in Safe Mode. It still failed: the encryptor was blocked and no files were encrypted.

msrcontrib[.]com

Lindnor: healthcontroller64.exe, svchelper.exe, powerhost.exe, eventwatcher.exe, volumeproxy.exe
Encryptor: iservice.exe (.anubis extension, restore files.txt)
Killers: gbbsym.exe, symgooq.exe, huntreagent.exe, s1.exe, safemode.exe
Drivers: havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys, fly.sys
Registry: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk
Lindnor SHA256 fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8

Source article: New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org
Publisher: Symantec and Carbon Black Threat Hunter Team (SECURITY.COM)
Published: Nov. 5, 2026
URL: https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware

Executive Summary

Symantec describes an October 2026 intrusion at a U.S. organization by attackers using Anubis, a ransomware-as-a-service family developed by the group Symantec tracks as Hawkmoth; Anubis emerged in December 2024 as a rebrand of Sphinx, runs an affiliate program, and claims about 96 victims in 12 months, 52% of them in the U.S. Initial access was not identified. The first sign of the intrusion was a previously undocumented custom backdoor, Backdoor.Lindnor, found only on the organization’s two Microsoft SQL Servers, installed as healthcontroller64.exe in a folder imitating a Chrome component unpacker directory and as svchelper.exe in a VMware folder, apparently running as a service and reporting host, user and domain details to a primary or fallback command-and-control server over port 443; the same backdoor appeared at two other unrelated organizations without ransomware activity. Within roughly an hour the attackers dropped at least 13 executables built to terminate security products, two of them posing as Symantec software and removing kernel callbacks, along with five publicly known signed vulnerable drivers for kernel access, installed AnyDesk, created a local account and added it to a local group, and ran safemode.exe to register AnyDesk to start in Safe Mode with Networking. The objective was encryption and extortion with the Anubis payload iservice.exe, which also has a wiper mode; in this case it was blocked and no files were encrypted. Hunt leads, false positive expectations and indicators are detailed below; the source published no YARA or Sigma rules.

ATT&CK chain: Persistence → Privilege Escalation → Defense Evasion → Discovery → Command and Control → Impact

Hunt Lead Grid

Lindnor and Anubis Artifact Sweep

Lindnor was the first indicator of the intrusion and lived only on the two SQL Servers, as healthcontroller64.exe inside a folder made to look like a Chrome component unpacker directory and as svchelper.exe inside a VMware folder; further Lindnor builds were published as powerhost.exe, eventwatcher.exe and volumeproxy.exe. It contacted a primary and a fallback command-and-control server over port 443, and Symantec published msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com as network indicators. The security killers (gbbsym.exe, symgooq.exe, bdr.exe, hwaudioch.exe, gibformin.exe, gibfor.exe, test.exe, xs.scr, g.exe, backup.exe, rustr.exe, huntreagent.exe, s1.exe), safemode.exe, the drivers havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys and fly.sys, and the encryptor iservice.exe, which appends .anubis and drops restore files.txt and restore files.html, complete the set. The detection logic is a retrospective sweep of DNS and proxy logs for the two domains, and of file and process telemetry for the published SHA-256 hashes and for the Lindnor names when they sit outside the real Chrome and VMware install paths.

Use DNS resolver logs, web proxy or firewall logs with SNI, and EDR file and process telemetry, and sweep at least 90 days, since Lindnor was also found at two unrelated organizations where no ransomware followed, which suggests it can sit quietly before an affiliate acts. Scope first to database servers, then fleet-wide. The Azure host is an attacker subdomain on a shared cloud platform, so block or alert on that exact name and never on cloudapp.azure.com as a whole. Blocking the AnyDesk hash is the wrong control because it is the legitimate installer and would break approved use; detect its Safe Mode registration instead. Any domain or hash hit should go straight to incident response, because Lindnor implies an operator with server access who may be preparing encryption.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location); Command and Control → T1071 (Application Layer Protocol) (our mapping; the source publishes no ATT&CK IDs and does not name the protocol beyond port 443)

Sources: “New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org”, Symantec and Carbon Black Threat Hunter Team, Nov. 5, 2026, https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware (source article)

AnyDesk Registered for Safe Mode

After installing AnyDesk and creating a new local account that they added to a local group, the attackers ran safemode.exe, which configures AnyDesk to keep working when Windows boots into Safe Mode, and ran the registry command “CSIDL_SYSTEM\reg.exe” add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /t REG_SZ /d Service /f. Most security software does not fully run in Safe Mode, so a reboot into Safe Mode with Networking would give the attackers remote access while protections are down, a window to use the vulnerable drivers. The detection logic is a registry-set rule for any new key under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network or SafeBoot\Minimal whose name matches a remote access tool (AnyDesk, ScreenConnect, TeamViewer and similar), plus a process rule for reg.exe or PowerShell command lines containing SafeBoot and a remote access tool name, raised further when bcdedit with safeboot follows on the same host.

Use EDR or Sysmon registry events (Event IDs 12 and 13) and process creation with command lines, and sweep 90 days fleet-wide. Some backup and security agents legitimately register for Safe Mode; allowlist those by service name and signed image path, not by the writing process, because the attackers used the stock reg.exe. Blocking reg.exe or AnyDesk outright is the wrong fix where they are needed; removing unapproved remote access tools and alerting on SafeBoot changes is the right one. Treat any remote access tool under SafeBoot as an active intrusion and escalate, and check for a recently created local account on the same host. The technique generalizes beyond Anubis to any crew planning to beat endpoint protection with a Safe Mode reboot.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1688 (Safe Mode Boot); Command and Control → T1219 (Remote Access Tools) (our mapping; the source publishes no ATT&CK IDs)

Sources: “New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org”, Symantec and Carbon Black Threat Hunter Team, Nov. 5, 2026, https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware (source article)

Burst of Vulnerable Driver Loads

Within about an hour the attackers dropped at least 13 executables in quick succession together with five signed but vulnerable drivers (havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys, fly.sys), abusing them for kernel-level access to terminate security products. Two of the tools, gbbsym.exe and symgooq.exe, posed as Symantec software and accepted -l to list kernel callbacks through a loaded vulnerable driver and -d to list and remove them; the observed command lines used -d. Symantec reads the volume as trial and error, one tool after another until something worked. The detection logic has two parts: a driver-load rule for any of the five drivers, or any driver on a known vulnerable-driver list, loaded from a user-writable path or shortly after its .sys file was created, and a count rule for two or more new kernel driver services created, or two or more unsigned or newly seen executables launched with a single-letter switch such as -d or -l, on one host within an hour.

Use EDR driver-load and service-creation telemetry (Sysmon Event ID 6, Windows Event 7045), file creation for .sys files, and process command lines. Sweep 30 to 90 days and scope fleet-wide, servers first. Expect noise from hardware monitoring utilities, overclocking tools and game anti-cheat on workstations; allowlist by signer and install path for approved software, not by driver file name, since attackers rename freely. Blocking the driver hashes through Microsoft’s vulnerable driver blocklist or application control is a sound preventive control because these drivers are legitimate but abusable, but hash blocking the 11 new killer executables will not stop the next build. A burst of driver loads followed by security services stopping is an active attack in its final stage and should be escalated immediately, with the host isolated. This generalizes to most current ransomware crews that rely on BYOVD.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1687 (Exploitation for Defense Impairment); Defense Evasion → T1685 (Disable or Modify Tools) (our mapping; the source publishes no ATT&CK IDs)

Sources: “New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org”, Symantec and Carbon Black Threat Hunter Team, Nov. 5, 2026, https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware (source article)

New Service From a Lookalike Folder Calling Out on 443

Lindnor appears to have run as a service from a folder imitating a Chrome component unpacker directory on one SQL Server and from a VMware folder on the other, collecting the process ID, operating system version, its own file path, computer name, user name, domain and logon server and sending them to a command-and-control server, with a fallback, over port 443. Database servers rarely run Chrome components, and a VMware-named folder on a server is only expected where VMware Tools is genuinely installed, so the masquerade is weakest exactly where it was used. The detection logic correlates three signals per host: a new service (Event 7045 or 4697) whose image path is under a Chrome, Google or VMware-named directory but whose binary is not signed by Google or VMware; outbound connections on 443 from that service’s process; and destinations never contacted by that host in the prior 30 days. Fire when all three occur within 24 hours, and at lower priority when only the first two do.

Use Windows System and Security logs or EDR service-creation telemetry, EDR network connection events joined on process ID, and firewall or proxy logs for the destination baseline. Sweep 90 days, since the backdoor was found at organizations where it had not yet led to ransomware, and scope first to SQL and other database servers, then to all servers. The join on signer is what keeps noise down: real Chrome and VMware updaters are signed by their vendors, so allowlist by signer and path together rather than by file name. Blocking 443 or common cloud hosting is the wrong control. Any confirmed hit warrants memory and disk capture of the service binary and escalation to incident response. The logic generalizes to any backdoor that hides behind vendor-styled folders on servers.

Hunt Lead Level: 3 (Elite)

ATT&CK: Persistence → T1543.003 (Create or Modify System Process: Windows Service); Discovery → T1082 (System Information Discovery) (our mapping; the source says the backdoor “appears to have run as a service”)

Sources: “New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org”, Symantec and Carbon Black Threat Hunter Team, Nov. 5, 2026, https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware (source article)

Hash Appendix

Backdoor.Lindnor

SHA-256s from the source article; MD5s and SHA-1s were not published (OTX AlienVault and VirusTotal not checked).

MD5s
(not available)  # healthcontroller64.exe / svchelper.exe -> Lindnor in Chrome-lookalike and VMware folders
(not available)  # powerhost.exe / eventwatcher.exe -> Lindnor
(not available)  # volumeproxy.exe -> Lindnor

SHA1s
(not available)  # healthcontroller64.exe / svchelper.exe -> Lindnor in Chrome-lookalike and VMware folders
(not available)  # powerhost.exe / eventwatcher.exe -> Lindnor
(not available)  # volumeproxy.exe -> Lindnor

SHA256s
fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8  # healthcontroller64.exe / svchelper.exe -> Lindnor in Chrome-lookalike and VMware folders
5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b  # powerhost.exe / eventwatcher.exe -> Lindnor
ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43  # volumeproxy.exe -> Lindnor

Anubis encryptor

SHA-256 from the source article; MD5 and SHA-1 not published (OTX AlienVault and VirusTotal not checked).

MD5s
(not available)  # iservice.exe -> Anubis ransomware payload (blocked)

SHA1s
(not available)  # iservice.exe -> Anubis ransomware payload (blocked)

SHA256s
e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026  # iservice.exe -> Anubis ransomware payload (blocked)

Security killers and Safe Mode tooling

SHA-256s from the source article; MD5s and SHA-1s not published (OTX AlienVault and VirusTotal not checked). anydesk.exe is the legitimate AnyDesk remote access tool: blocking its hash breaks approved AnyDesk use, so detect its Safe Mode registration and unapproved installs instead.

MD5s
(not available)  # anydesk.exe -> legitimate AnyDesk, abused for remote access
(not available)  # safemode.exe -> registers AnyDesk to run in Safe Mode
(not available)  # bdr.exe -> security killer
(not available)  # hwaudioch.exe -> security killer
(not available)  # gibformin.exe -> security killer
(not available)  # test.exe -> security killer
(not available)  # xs.scr -> security killer
(not available)  # gibfor.exe -> security killer
(not available)  # gbbsym.exe -> security killer posing as Symantec software, removes kernel callbacks
(not available)  # symgooq.exe -> security killer posing as Symantec software, removes kernel callbacks
(not available)  # g.exe -> security killer
(not available)  # backup.exe -> security killer
(not available)  # rustr.exe -> security killer
(not available)  # huntreagent.exe -> not blocked; purpose unknown
(not available)  # s1.exe -> not blocked; purpose unknown

SHA1s
(not available)  # anydesk.exe -> legitimate AnyDesk, abused for remote access
(not available)  # safemode.exe -> registers AnyDesk to run in Safe Mode
(not available)  # bdr.exe -> security killer
(not available)  # hwaudioch.exe -> security killer
(not available)  # gibformin.exe -> security killer
(not available)  # test.exe -> security killer
(not available)  # xs.scr -> security killer
(not available)  # gibfor.exe -> security killer
(not available)  # gbbsym.exe -> security killer posing as Symantec software, removes kernel callbacks
(not available)  # symgooq.exe -> security killer posing as Symantec software, removes kernel callbacks
(not available)  # g.exe -> security killer
(not available)  # backup.exe -> security killer
(not available)  # rustr.exe -> security killer
(not available)  # huntreagent.exe -> not blocked; purpose unknown
(not available)  # s1.exe -> not blocked; purpose unknown

SHA256s
467d1395b61d4b886329571b564fb21db01639acd2799439646c85b9aeaec175  # anydesk.exe -> legitimate AnyDesk, abused for remote access
47a864736764112d7897c76e56d51111ce75b3e46fdbac6933df8a5b29507d17  # safemode.exe -> registers AnyDesk to run in Safe Mode
6543ee9f89d80b2bcf08e98fb8e9e73a4b144a93c7b2a3f28e35de8f7e7a8a80  # bdr.exe -> security killer
83eff3e51b69968a4ddd503b0b1dccfa8829d638f2dc00cc69640a29aea814f1  # hwaudioch.exe -> security killer
f8d4142a94269b4258f370ef2292d22a49cd6dee8266a7122f4531e9cc5d9a2f  # gibformin.exe -> security killer
cd1e68583b8b984a9bb5b9f7067077c0e0d8f79da4455c326319e5e5fc6e9c5f  # test.exe -> security killer
5a2082162852984ffe7e7c501faa6cf473129fcba29406ffb98d55198de4b3a5  # xs.scr -> security killer
5fcd2c954764ac0888c8ba72fc1cf54db64e8f23f83aeb0786ae5b80438ba926  # gibfor.exe -> security killer
aa779d811e00a30dfb56b994bdd63424cbf97617af737a218b6aff9f7c3a50f5  # gbbsym.exe -> security killer posing as Symantec software, removes kernel callbacks
854c3e76beb200243ccf6af260e9a2089c2fc545f8f1b34d34c6fe86f2d056c3  # symgooq.exe -> security killer posing as Symantec software, removes kernel callbacks
67dee1d52189460b88f8ce5ffa76a5c22f86ffd67f8e689118019fce0863c321  # g.exe -> security killer
cde8dbeaf15250337a03e07a7e257b12b03e5e951885cc69a578545f44425bdd  # backup.exe -> security killer
28357d9666a9be36b2ea9ac6007bb8bfbe7e2438e095c1ec40720c4001f47c62  # rustr.exe -> security killer
588887e709459f1d1a8109b089cb3462c6f796d30b6297a1a0fdb3419a3ccbce  # huntreagent.exe -> not blocked; purpose unknown
962be6983f3ed4f1dc4ce117e135cc0a5ab8fc6b5f5aa0284eff8a9def66e338  # s1.exe -> not blocked; purpose unknown

Vulnerable drivers

SHA-256s from the source article; MD5s and SHA-1s not published (OTX AlienVault and VirusTotal not checked). These are publicly known, signed but vulnerable drivers: blocking them through a vulnerable-driver blocklist is appropriate, but they are legitimate files from other products, so confirm no approved software on a host needs them first.

MD5s
(not available)  # havoc.sys -> vulnerable driver abused for kernel access
(not available)  # monprocessex.sys -> vulnerable driver abused for kernel access
(not available)  # xhunter1.sys -> vulnerable driver abused for kernel access
(not available)  # bdapiutil64.sys -> vulnerable driver abused for kernel access
(not available)  # fly.sys -> vulnerable driver abused for kernel access

SHA1s
(not available)  # havoc.sys -> vulnerable driver abused for kernel access
(not available)  # monprocessex.sys -> vulnerable driver abused for kernel access
(not available)  # xhunter1.sys -> vulnerable driver abused for kernel access
(not available)  # bdapiutil64.sys -> vulnerable driver abused for kernel access
(not available)  # fly.sys -> vulnerable driver abused for kernel access

SHA256s
5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db  # havoc.sys -> vulnerable driver abused for kernel access
72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258  # monprocessex.sys -> vulnerable driver abused for kernel access
e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e  # xhunter1.sys -> vulnerable driver abused for kernel access
9058388d05d984ca691a23ee70fcdbd3266c5cdc68ebc5aed95c67f1c502bc75  # bdapiutil64.sys -> vulnerable driver abused for kernel access
2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a  # fly.sys -> vulnerable driver abused for kernel access

References Appendix

• “New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org”, Symantec and Carbon Black Threat Hunter Team (SECURITY.COM), Nov. 5, 2026, https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware (source article; intrusion details, tooling, registry command, hashes and network indicators)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/