Dark Web Profile: Anubis Ransomware

Anubis (Sphinx) ransomware is a relatively new Ransomware-as-a-Service operation that first appeared in late 2024 on Russian-language cybercrime forums, and it features a dual execution model that combines standard file encryption with an optional destructive wipe mode. According to TrendMicro, this wipe capability permanently overwrites files, making recovery impossible even if a ransom is paid.

The operation is affiliate-driven, with affiliates handling initial access and deployment while Anubis operators supply the malware, leak-site infrastructure, and negotiation backend, and roughly 80% of ransom proceeds go to operators on the intrusion side. It is not related to the older Anubis Android banking trojan or the Anubis backdoor historically linked to FIN7, despite the shared name.

Anubis also monetises through data extortion and an access resale programme, enabling affiliates to pursue encryption, data-only extortion, or access resale based on victim profile and risk. Initial access commonly relies on spear-phishing emails and exposed RDP services, with manual, operator-controlled execution rather than autonomous spreading.