Actor Profile

Anubis is a threat actor group operating the Anubis ransomware. The group demonstrates sophisticated tradecraft by exploiting recent vulnerabilities in enterprise infrastructure to gain initial access. Their operations are characterized by the use of legitimate remote monitoring and management (RMM) tools to blend in with normal administrative activity, combined with hands-on-keyboard techniques that indicate experienced operators conducting interactive network intrusions. The group's motivation appears to be financially driven through ransomware deployment.

TTPs (Tactics, Techniques, Procedures)

The Anubis threat actors leverage CVE-2025-5777 (Citrix Bleed 2) for initial access, exploiting vulnerabilities in Citrix infrastructure. Post-compromise, they deploy legitimate RMM tooling to establish persistence and maintain command and control, likely corresponding to T1219 (Remote Access Software). The group employs credential access techniques to harvest authentication material, enabling lateral movement across the victim network. Their hands-on-keyboard approach indicates interactive sessions for network reconnaissance, privilege escalation, and eventual ransomware deployment. The use of living-off-the-land techniques through legitimate administrative tools demonstrates operational security awareness and evasion capabilities.

Targets & Patterns

While specific targeted sectors are not identified in available reporting, the exploitation of Citrix Bleed 2 (CVE-2025-5777) indicates the group targets organizations utilizing Citrix infrastructure for remote access and application delivery. Citrix environments are commonly deployed in enterprise settings across healthcare, finance, government, and corporate sectors, suggesting Anubis likely focuses on medium to large organizations with the financial capacity to pay ransoms. The use of sophisticated exploitation techniques and hands-on-keyboard methods indicates selective targeting of high-value networks rather than opportunistic mass compromise.

Historical Context

The Anubis ransomware operation represents an evolution in ransomware threat actor tactics, specifically the rapid weaponization of newly disclosed vulnerabilities. The exploitation of CVE-2025-5777 (Citrix Bleed 2) follows a pattern observed in other ransomware operations that have previously exploited Citrix vulnerabilities for initial access. The naming suggests potential relation to earlier Citrix exploitation campaigns, though specific historical connections to previous Anubis activity or other ransomware families require additional attribution data. The group's methodology aligns with broader ransomware ecosystem trends of combining vulnerability exploitation with legitimate tool abuse.

Defensive Recommendations

  • Immediately patch CVE-2025-5777 (Citrix Bleed 2) on all Citrix infrastructure and conduct forensic review of Citrix logs for indicators of exploitation prior to patching
  • Monitor and restrict RMM tool deployment via application whitelisting; detect unauthorized RMM software execution through EDR telemetry and network traffic analysis for known RMM C2 domains
  • Implement credential hygiene controls including privileged access management (PAM), MFA on all remote access points, and monitor for abnormal credential access patterns (T1003 - OS Credential Dumping)
  • Deploy network segmentation to limit lateral movement opportunities and monitor for anomalous interactive logon sessions, especially from service accounts or during non-business hours
  • Enable enhanced logging for PowerShell, command-line activity, and authentication events; establish baseline behavior profiles to detect hands-on-keyboard activity and living-off-the-land techniques