Summary Points
-
Emerging Threat: A new ransomware strain named Anubis combines file encryption with a permanent deletion feature, termed a "wipe mode," making recovery impossible even if the ransom is paid.
-
Operational Tactics: Anubis operates as ransomware-as-a-service (RaaS) with a flexible affiliate program, offering lucrative revenue splits of 80-20 for ransom, and 60-40 and 50-50 for data extortion and access sales, respectively.
-
Attack Vectors: The ransomware primarily spreads via phishing emails, enabling attackers to escalate privileges, conduct reconnaissance, and delete volume shadow copies before encryption, increasing pressure on victims to comply.
- Wider Implications: The incorporation of destructive capabilities in ransomware like Anubis raises significant risks for victims, intensifying compliance pressure and complicating response strategies in cybersecurity.
Underlying Problem
On June 16, 2025, cybersecurity experts from Trend Micro unveiled a sophisticated ransomware strain dubbed “Anubis,” which notably combines data encryption with a potentially catastrophic “wipe mode” that irretrievably annihilates files. This malevolent software, emerging from a ransomware-as-a-service (RaaS) model since December 2024, has targeted diverse sectors including healthcare and hospitality across multiple countries, such as the U.S., Australia, and Canada. The dual-threat nature of Anubis, allowing for both extortion through ransom and irrevocable data loss, significantly escalates the stakes for victims, compelling them into hasty compliance even if financial recompense is rendered futile.
The Anubis operation employs phishing emails to infiltrate systems, from which attackers escalate privileges and erase critical recovery points before executing their encryption or wiping commands. Researchers Maristel Policarpio, Sarah Pearl Camiling, and Sophia Nilette Robles have noted the strategic affiliate model of this cybercriminal enterprise, which offers varying revenue splits to accomplices based on the monetization strategies employed. Concurrently, Recorded Future has linked additional criminal activities to the infamous FIN7 group, reinforcing the intricate and evolving web of threats in the cyber domain as vulnerabilities in software products continue to be mercilessly exploited.
What’s at Stake?
The emergence of the Anubis ransomware strain, characterized by its dual capacity to both encrypt and irreversibly erase files, poses a profound risk not only to direct victims but also to a broader ecosystem of businesses and organizations. As sectors such as healthcare, hospitality, and construction increasingly rely on interconnected digital infrastructures, any breach has the potential for cascading effects; compromised data integrity can disrupt supply chains, jeopardize sensitive patient information, and undermine consumer trust. Furthermore, the innovative monetization strategies employed by the ransomware’s affiliate networks—the ability to exploit stolen data or sell access to compromised systems—can incentivize other cybercriminals to engage in similar attacks, thereby amplifying vulnerabilities across the entire digital landscape. The heightened pressure to comply with ransom demands, exacerbated by the threat of permanent data loss, could lead organizations to make hasty decisions, further entrenching a cycle of victimization and financial instability that could destabilize entire industries.
Fix & Mitigation
Timely remediation is crucial in the face of Anubis ransomware due to its dual capacity to not only encrypt files but also permanently erase them, rendering recovery attempts futile even upon payment.
Mitigation Steps
- Regular Data Backups
- Robust Antivirus Solutions
- User Education Programs
- Network Segmentation
- Intrusion Detection Systems
- Incident Response Plan
NIST CSF Guidance
The NIST Cybersecurity Framework (CSF) emphasizes the need for identifying, protecting against, detecting, responding to, and recovering from cyber incidents. For further details, refer to NIST SP 800-53, which outlines comprehensive security and privacy controls essential for safeguarding against ransomware attacks.
Continue Your Cyber Journey
Stay informed on the latest Threat Intelligence and Cyberattacks.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
