Sep 5, 2026 · 23 min
Anubis affiliates turn ordinary IT tools into ransomware weapons
RMM-ber this ransomware. [Research Saturday]
The episode shows why defenders must detect the sequence and context of routine administrative actions, not wait for a single unmistakable indicator.
- 1Anubis affiliates gain access through CitrixBleed 2 exploitation and stolen VPN credentials, often obscuring their origins through VPS infrastructure.
- 2Attackers use RMM tools, RDP, PsExec, credential theft, and tunneling to blend lateral movement into ordinary IT administration.
- 3Defenders can disrupt the chain by understanding normal activity, monitoring privileged systems, and securing critical assets such as domain systems and hypervisors.
Don't miss
Ismael Valenzuela explains why ordinary administrative actions become meaningful only when defenders correlate their sequence across an intrusion.
The brief
Ismael Valenzuela of Arctic Wolf explains how Anubis, a ransomware-as-a-service operation descended from Sphinx, organizes affiliates around repeatable intrusion methods.
The affiliates enter through CitrixBleed 2 exploitation or stolen VPN credentials, with mismatched residential logins and VPS traffic offering an important clue.
Once inside, they use RMM tools, RDP, PsExec, credential theft, and tunneling—legitimate capabilities that make the attack resemble ordinary administration.
The intrusion becomes most dangerous when attackers reach Active Directory, domain systems, hypervisors, NAS devices, and other high-impact organizational assets.
Valenzuela’s central warning is that no single action proves malicious; defenders need the surrounding sequence, layered monitoring, and a well-understood environment.