What is Anubis Ransomware?
Discovered in mid-2025, Anubis is a ransomware variant that takes its name from the Egyptian god of the dead—and for good reason. Instead of merely holding files hostage, it executes them. After encrypting a victim’s files, the malware demands a ransom (usually in cryptocurrency), promising a decryption key upon payment. However, analysis has revealed that the malware has no functional decryption routine—once the files are encrypted, they are irreversibly overwritten or deleted.
Security researchers believe this behavior is intentional, likely designed to cause maximum disruption and psychological damage rather than financial gain.
Who Are the Targets?
Anubis doesn’t discriminate by industry, but critical infrastructure and healthcare institutions appear to be prime targets. Several reported attacks have involved:
- Hospitals and clinics, resulting in data loss and halted medical operations.
- Municipal networks, affecting emergency response and civic services.
- Educational institutions, erasing research and administrative records.
- SMBs (small and medium-sized businesses) lacking proper backups.
The choice of targets seems tactical—disrupting organizations where downtime equals danger.
Technical Behavior
While the full technical breakdown is still ongoing, researchers have observed the following behavior:
- Payload Delivery: Via phishing emails, malicious attachments, or vulnerable exposed services (e.g. RDP, VPN).
- Encryption: Files are encrypted with strong algorithms, but without saving decryption metadata.
- Destruction: Files are deleted or corrupted even if ransom is paid.
- Anti-Recovery: It wipes shadow copies, disables backups, and often attempts to overwrite files with garbage data before deletion.
Anubis also prevents boot in some cases, corrupting system partitions or disabling key services to paralyze the system further.
How to Protect Yourself
Given Anubis’ non-negotiable nature, prevention is the only real defense. Here are critical steps to minimize your risk:
1. Backups Are King
- Maintain regular, offline, and offsite backups.
- Test recovery procedures monthly.
- Avoid mapping backup storage directly to production systems.
2. Patch and Harden
- Keep systems, especially public-facing services, fully patched.
- Disable unnecessary ports (like RDP) and use firewalls or VPNs to restrict remote access.
- Harden configurations using CIS Benchmarks or similar guidelines.
3. Educate Your Team
- Conduct regular phishing training.
- Simulate attacks to build awareness.
4. Use EDR and Network Monitoring
- Employ Endpoint Detection and Response (EDR) tools with behavioral detection.
- Monitor traffic for unusual activity (e.g., outbound traffic spikes, command & control connections).
5. Zero Trust Principles
- Limit permissions.
- Segment networks.
- Authenticate everything—especially internal access.
Should You Ever Pay?
No. Not with Anubis. This is not a ransomware that unlocks your files post-payment—it destroys them. Paying only funds further destruction and emboldens attackers.
Instead, report the attack to national cybersecurity authorities (like CERT-SE in Sweden or CISA in the U.S.), preserve any evidence, and isolate infected systems immediately.
Final Thoughts
Anubis is not just another ransomware strain—it represents a shift in cybercriminal mindset from extortion to pure sabotage. It also underlines the critical importance of preparedness over reaction.
“Hope is not a strategy. Backups, segmentation, and proactive defense are.”
Organizations—especially those in healthcare and critical infrastructure—must now treat ransomware not just as a financial threat, but as a destructive force. With no key, no mercy, and no trust, Anubis lives up to its mythological namesake—ushering victims straight to the digital underwo