RMM-ber this ransomware.

Dave Bittner: Hello, everyone, and welcome to the CyberWire's Research Saturday. I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. [ Music ]

 

Ismael Valenzuela: It was kind of interesting because we were -- we realized as we compare nodes, and I always tell organizations, this is the most important intelligence that you can get, like, when you look at incident response, and you connect the dots across different incidents. When we did that, we realized that we were watching pretty much the same movie, just with different actors, like different affiliates, different environments, different victims, but pretty much the same script.

 

Dave Bittner: That's Ismael Valenzuela, Vice President of Labs, Threat Research and Intelligence at Arctic Wolf. Today, we're discussing their work tracking Anubis. [ Music ] Well, for our listeners who may have heard the name but aren't up on all the details, how do you describe Anubis?

 

Ismael Valenzuela: Yeah. So Anubis is a ransomware-as-a-service operation. That's the one we're describing here. We don't want to confuse this with the -- there's also an Android banking trojan called Anubis, completely unrelated. Same god, different criminals. So what we're talking here is the ransomware-as-a-service operation. It actually started with a different name, Sphinx, but they rebranded later in 2024. And you can literally see the rebrand in the file extensions, the encrypted files. They went from.sphinx to Anubis. And this was formally announced in a Russian -- very popular Russian cybercrime forum called RAMP in February 2025. And since then, it's grown into a multi-platform, multi-affiliate system with Windows, Linux encryptors, and they claim north of 80 victims on their leak site.

 

Dave Bittner: Well, your report emphasizes that this is an affiliate ecosystem rather than a single threat actor. What makes that distinction important?

 

Ismael Valenzuela: Yeah. So distinction is important because even though the weapon that they use is the same, the people using these weapons are different. So that introduces some element of randomness in that different groups may follow different playbooks. And we can see some variations here as well. But the interesting piece is that even though the actual tools that they use, especially once they break in, or even sometimes the -- how they get through the front door may involve, like, different vulnerabilities or different methods, there is a lot of common things that we see across the entire attack chain when we see the full picture.

 

Dave Bittner: Well, you all looked at multiple incidents here. What sort of patterns started emerging that the individual cases may not have revealed on their own?

 

Ismael Valenzuela: Yeah. So that's a very, very good question. I mean, I can walk you from the -- maybe from the very beginning?

 

Dave Bittner: Yeah. Let's do it. Sure.

 

Ismael Valenzuela: Yeah. Let's do that. So, essentially, as we report here, there's, like, two different front doors. We have the CitrixBleed 2, which is a pre-authenticated memory disclosure in the Citrix NetScaler appliances. Essentially, they can pull the session material straight off the appliance memory, hijack a session that is legitimate, and then just, like, walk past the multifactor authentication, getting through the front door. The other one is VPN, right, stealing VPN credentials, valid credentials. So just stealing somebody's keys, right? Just logging in. And how they get these credentials, typically through info stealers, initial access brokers, credential stuffing, things like that.

 

Dave Bittner: One of the things that caught my eye in the research was that you all pointed out that the VPN activity was coming from VPS hosting providers, instead of residential broadband connections. What stands out about that for you?

 

Ismael Valenzuela: Yeah. That's a very interesting detection detail that I love here. In the VPN logs, you could see how the session's original client IP was a normal residential broadband address, which is becoming more and more common, but then the attacker's traffic was coming from a VPS hosting provider. So that's a mismatch, right? The user who logged in from, you know, a couch in their living room, they're suddenly operating from a data center. That's a signal that if you're tracking this, if you can correlate these signals, defenders can hunt for this.

 

Dave Bittner: You know, another one of the themes that runs through the report is that the attackers are using legitimate IT tools instead of custom malware, and that's been very effective for them.

 

Ismael Valenzuela: Absolutely. This is also an interesting misconception. Sometimes we think that these ransomware groups, they're super uber sophisticated and they use, like, very sophisticated malware, but in this case, it's actually the country, and that's what makes them successful. They move laterally once they're in through RDP and PsExec, which, as we know, they're tools that every sysadmin use. They install legitimate, commercially available remote management software like ScreenConnect, Zoho Assist, MeshAgent. So they're not really breaking through the front door. They're just, like, stealing the key, walking during business hours in a contractor's uniform, and then just doing the things that contractors do, which may mimic what you're doing on a regular basis inside of your organization.

 

Dave Bittner: Yeah. The report describes what -- looks to me like it's practically a playbook, from the suspicious VPN access all the way to the ransomware deployment. Can we go through that sequence together?

 

Ismael Valenzuela: Yes. So the playbook, as we mentioned, right, in this case, has, like, different points of entry, and that shows resiliency. Attackers will choose from a variety of ways to break in, whether it's through a vulnerability or just stealing the keys with legitimate credentials. Once they're in, they're going to be using all of these tools. I would highlight that one of the things to watch for is the use of remote management monitoring tools, especially those that are not common in your environment. The fact that they may use these tools, it's very -- it can be noisy if you know what you have. And then I'll show you -- I'll walk you through a very interesting example. Once they're in, they're going to go after domain controllers, hypervisors, NAS devices as well for backups. For example, in the report, we talk about this Synology NAS, and that's a very interesting one, because once they were -- the attacker was in, they used a valid domain account that they compromised. Then they created their own local administrator account on the device, and they granted themselves every single permission to use SMB, FTP. Now they transfer their tools over FTP, SSH. They escalated to root, and then they started setting up Cloudflare Tunnels to exfiltrate the data. Now, interestingly, this didn't work for them. As I usually say, when something doesn't work, attackers don't go to a corner and cry, right? What they do is they pivot. They just try something else. And that's what they did here. They set up SSH forwarding, they pivoted to an authenticated HTTP proxy, and they just essentially created a separate route, one that the organization may have not been monitoring. So, that shows, again, resiliency. Sure, they have a script, but, you know, I love sports, so I like to also use this analogy. It's like a well-rehearsed playbook from a sports team, right? I love football. We call it soccer here, but let's say that, you know, that's what they do. They play -- they look at the different things that could happen during the game. They rehearse it, they have a plan, and they're going to follow the plan. [ Music ]

 

Dave Bittner: We'll be right back. [ Music ] Now, is my perception correct here that this group spends a good amount of time moving laterally throughout systems before they ever launch the ransomware?

 

Ismael Valenzuela: Yes. And this malware also has the capability of -- destructive capabilities, so they have a wiper. So they do have a lot of, let's say, options that they can use. But yes, they move fast. They go to the things that matter the most. For example, we talk about the threat actor copying the ntds.dit, which may be some of the most technical -- the audience will recognize this -- is the Active Directory database that has, you know, every single master key for the company and the domain controllers. And within one minute, that file was zipped on the desktop, ready to go. Within one hour, the encryption was running across the environment. So once the attackers have all the data exfiltrated, sometimes they would encrypt; other times they may not encrypt. But the final act is at machine speed.

 

Dave Bittner: Well, credential theft was a big part of these intrusions. What kinds of credentials did they seem to be after here?

 

Ismael Valenzuela: Anything that would give them the keys, right, to the front door, or once they're inside, the keys to other systems. For example, we talked about VPN credentials, but also once they're on the network, if they get access to domain credentials, they can move into hypervisors. Many times, these are part of the domain, the corporate domain. They may move to these NAS devices. They're seeking impact, so they're going to go after what I call the crown jewels, right? These systems that are critical, maybe tier zero for the organization. We see a lot of, like, browser passwords being exfiltrated as well, being maybe one of the biggest gaps for the enterprise. So they definitely have different options.

 

Dave Bittner: You know, one of the most interesting conclusions that you all shared is that no single behavior is especially unique. It's this combination that matters. Can you unpack that for us?

 

Ismael Valenzuela: Yeah. That's correct. If we think about it, before the malware, the ransomware encryptor detonates, there's a lot of other activity that is not necessarily malicious. It could be legitimate. They're just mimicking the same activity that a sysadmin would do. So if you take any of these actions in isolation, they're not really malicious. Like, okay, somebody's listing the contents of an Active Directory group. Is that good or bad? Well, we don't know. What's the context, right? Somebody's using RDP to move laterally. That's the same thing that your sysadmins use. But when you put everything into context, for example, is this happening during business hours, or who is the user doing this? Now, all of a sudden, there is a user in the HR department that is doing all of this activity. That's not normal, right? Or we never use -- I don't know -- ScreenConnect. We don't use these other types of legitimate tools. So when you see all of these together as a pattern -- the pattern emerges, like, very, very clearly, but that relies on knowing what normal looks like, having, you know, an inventory of what's approved to be able to alert on anything else. And that's where a lot of the organizations maybe fail. They don't really know what normal looks like.

 

Dave Bittner: Yeah. That's an interesting insight. Where do you suppose organizations have the best opportunity to interrupt this attack before that ransomware is deployed?

 

Ismael Valenzuela: That's a great question. And I love to see these in phases. I'm a big fan of -- we've been talking about defense in depth for a long time. I always say that defense in depth is not out of style, right? It's just that you have -- it's not enough. You have to complement it with detection in depth and response in depth. That all makes part of what I call a defensible security architecture, right? Zero trust principles. Essentially the same thing. So that starts with the way you design your architecture. If you don't have segmentation in place, if you don't have least privilege, if you don't rehearse these types of behaviors before you go through a scenario like this, if you don't know where your risks are within your organization, it's going to be very difficult for you to detect this. So the first step would be doing an assessment of your organization and looking at where you can implement these controls that will slow down the attack. And when you slow down the attacker, because you have more choke points, you have more inspection, you make it more difficult, you build tripwires. Put tripwires, security cameras, security sensors, so to speak, around your infrastructure that can improve the chances, increase the chances of you detecting this activity.

 

Dave Bittner: I'm curious, you know, based on everything you've observed here, do you think this style of attack, which is relying on legitimate administrative tools, is this becoming the new normal for ransomware operators?

 

Ismael Valenzuela: Well, it's -- I think we have a good variety of different tactics and playbooks, but same thing I said before, same way that I said that attackers don't cry in a corner when things don't work. Attackers, I always say they're lazy. If something works, why would they pivot? Why would they change? So the most interesting thing about this playbook is it's not that it's something like super uber sophisticated; it's just that they're doing simple things that you're not watching, you're not looking, because, you know, you may be thinking that this is just legitimate activity. And this is nothing new. We have seen living-off-the-land techniques for a long time, but the fact that in 2026, this is still working and this is still affecting many organizations out there should be, like, you know, like a wake-up call.

 

Dave Bittner: What's the take-home for you? For folks who read this research, what do you hope they take away from it?

 

Ismael Valenzuela: The takeaway would be, you know, stop treating these intrusions like something you can fix with one single -- with a silver bullet. Stop looking for one single bad indicator to just, like, start the response. You have to focus on, first, building a defensible, secure architecture and a defensible security monitoring program, and at the same time, focusing on knowing what normal looks like in your environment. It's the boring stuff. This is, to be honest, this is the boring thing about security. It's the day-to-day operations. It's the limiting of the privileges, the continuous daily monitoring of things that can help you to pull that thread and find out something early in the attack chain. And remember, it's not just about preventing all bad things from happening; it's detecting this, like a type of malicious activity, early in the attack chain so you can save yourself from having, you know, to deal with this type of incident response. [ Music ]

 

Dave Bittner: Our thanks to Ismael Valenzuela from Arctic Wolf for joining us. We'll have a link to their research in our show notes. And that's Research Saturday, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com. This episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here next time. [ Music ]