VULNpocalypse
MediumBreach / campaignMonitoring

Anubis ransomware Lindnor backdoor hits U.S. SQL Servers

Anubis ransomware affiliates used a new Lindnor backdoor on SQL Servers in a U.S. attack; check hosts for the listed indicators.

Published
Exploitation
Yes, used in an October 2026 intrusion at a U.S. organization; the encryption payload was blocked and no encrypted files were reported

What happened

Both outlets report, citing Symantec research, that attackers deploying Anubis ransomware hit a U.S. organization in October 2026 with a custom backdoor called Lindnor. Cyber Security News says the encryption payload was blocked before it could run. GBHackers adds that there is no evidence any files were encrypted.

The backdoor. Lindnor ran as a service on two Microsoft SQL Server machines. It was named healthcontroller64.exe in a folder imitating a Chrome component directory on one machine, and svchelper.exe in a VMware folder on the other. GBHackers reports it sent the process ID, OS version, file path, computer name, user name, domain and logon server to a command-and-control (C&C) server. It had a primary and a fallback C&C server, both reached over port 443. Cyber Security News notes that Symantec also saw Lindnor on the networks of two unrelated organizations, with no ransomware activity there.

Security tool removal. Within roughly an hour, the operators dropped at least 13 executables meant to terminate security products, plus five signed but vulnerable, publicly known drivers in a Bring Your Own Vulnerable Driver (BYOVD) approach. Eleven of the 13 executables appear to be previously unpublished. Two of them, gbbsym.exe and symgooq.exe, masqueraded as Symantec software. Per GBHackers, the -d switch lists and removes kernel callbacks, which leaves a security agent running but blind, and the observed command lines used -d. Everything was blocked except huntreagent.exe and s1.exe, which have the same size but different hashes, suggesting two builds of one tool.

Persistence. The attackers installed AnyDesk, created a new local user added to a local group, and ran safemode.exe, which configures AnyDesk to survive a Safe Mode boot. GBHackers reports a registry command that registered AnyDesk as a service under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk. Both outlets note that security software generally does not fully run in Safe Mode.

The ransomware. The encryptor, iservice.exe, appends the .anubis extension and drops ransom notes named restore files.txt and restore files.html. The notes claim data theft and threaten publication if negotiations fail. An optional wiper mode empties file contents.

Who is behind it. Symantec attributes Anubis to a group it tracks as Hawkmoth, which runs a ransomware-as-a-service operation that emerged in December 2024 as a rebrand of Sphinx ransomware. Both outlets report the group has claimed about 96 victims in the past 12 months, 52% of them in the U.S. Because affiliates carry out the attacks, tradecraft can vary between intrusions. Symantec did not determine how the attackers gained initial access in this case.

Am I affected?

The sources describe one confirmed intrusion at a U.S. organization and two further Lindnor sightings at unrelated organizations. Neither outlet names the victims.

  • You are most relevant to this report if you run Microsoft SQL Servers, since both confirmed Lindnor infections were on SQL Servers.
  • You may be affected if you find the file names, hashes or domains listed below, or unexpected AnyDesk installs, new local users or Safe Mode registry changes on your hosts.
  • The sources give no CVE, affected product version or patch. The initial access method is not confirmed.

Indicators reported:

  • Lindnor SHA-256 fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8, file names healthcontroller64.exe and svchelper.exe (GBHackers). Cyber Security News calls this the key Lindnor hash.
  • Further Lindnor SHA-256 values and file names (powerhost.exe, eventwatcher.exe, volumeproxy.exe) are listed in the indicator table in GBHackers.
  • Domains, defanged as in the source: msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com (Cyber Security News). GBHackers does not list domains.

What to do now

  1. Search SQL Servers and other hosts for the file names and hashes above, and for services running from folders that imitate Chrome or VMware components.
  2. Check network logs for connections to the listed domains and for unusual outbound traffic on port 443 from servers.
  3. Alert on new service creation, driver loading, Safe Mode registry changes and unexpected AnyDesk installs, especially on SQL Servers, as GBHackers advises.
  4. Review any AnyDesk install, any new local user added to a local group, and the SafeBoot\Network registry path named above.
  5. Block known vulnerable drivers and limit admin rights, as Cyber Security News recommends.
  6. Keep in mind that the sources report the encryption payload was blocked here only because security tooling stopped it, so check that your endpoint protection logs show no tampering or removed callbacks.

Sources