anubis

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
anubis ransomware
*/

rule anubis_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.anubis"
        description = "Detects anubis ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "anubis" ascii nocase
        $name2 = "ANUBIS" ascii
        $onion  = "anubis.onion" ascii nocase

    condition:
        any of them
}

Good afternoon, [snip]!
This is the ANUBIS hacker team.
We want to let you know that we have been on your network for a long time and have been studying your company's business.
We have downloaded gigabytes of your data, which is now being analyzed by our best experts.
Contact us and we will provide you with a list of files that we have.
If we can't reach an agreement, we will notify every customer of the data leak.
If you ignore or refuse the deal, we will be forced to publish all your data in the public domain.
As our blog grows and attracts media attention every day, the case will become publicized and cause devastating damage to your business.
The only way to avoid this is to make a deal with us. Appoint a responsible person to negotiate and get down to business.
Otherwise, every client will see how you disregarded their personal information and will have a detailed plan on how to win a case against you in court.
To contact us and resolve this issue, you need to access us via TorBrowser ([redactado]
We regularly send you a chat link and your credentials through your website.
You will need to act strictly according to the instructions.
In addition, we have sent you confirmation that we hold all your data.
Then go to our website: [redactado]
And enter your unique ID: [snip]
I also recommend visiting our blog via the Tor browser, there, we post files from companies that refuse to pay.
The same fate awaits you if we dont reach an agreement. Our blog is followed by the global media.
[redactado]

• https://www.ransomware.live/group/anubis
• https://www.bleepingcomputer.com/news/security/anubis-banking-trojan-targets-android-users
• https://www.sentinelone.com/blog/anubis-android-banking-trojan-analysis
• https://www.trendmicro.com/en_us/research/19/j/anubis-malware-family-returns-with-new-variants.html
• https://blog.cyble.com/2023/06/14/anubis-banking-trojan-targets-multiple-countries
• https://www.cisa.gov/news-events/analysis-reports/ar22-187a

• Healthcare
  10
• Business Services
  4
• Manufacturing
  3
• Financial Services
  2