Anubis Ransomware Group

Threat Actor

The Anubis group is a Ransomware-as-a-Service (RaaS) operation that emerged in late 2024 and gained significant visibility in 2025. Anubis attracts affiliates with flexible revenue splits. They also run a separate data extortion program for criminals who have already stolen data.

Anubis is notable for combining traditional file encryption with an optional file-wiping feature (activated via a /WIPEMODE parameter). This feature permanently erases file contents, making recovery impossible, even after a ransom is paid. This is an unusual and destructive tactic for a financially motivated group, serving to increase pressure on victims to pay for data not to be leaked, even if files cannot be decrypted.

Initial Access is typically achieved through spear-phishing emails containing malicious links or attachments, crafted to look like trusted communications.

Incidents Associated with this Threat

Malware Used by this Threat Actor

No malware identified for this threat actor.