CyberWire Daily - RMM-ber this ransomware. [Research Saturday]

Episode Date: September 5, 2026

Ismael Valenzuela, Vice President of Labs, Threat Research and Intelligence at Arctic Wolf, sits down with Dave to discuss their work tracking Anubis. Arctic Wolf Labs details a series of 2026 Anubis ransomware intrusions, revealing affiliates using stolen VPN credentials and exploiting CitrixBleed 2 to gain initial access. Attackers then blended into legitimate IT activity by deploying RMM tools, using RDP and PsExec for lateral movement, stealing credentials, and establishing tunnels and proxies for persistence and exfiltration. The research highlights a repeatable attack chain defenders can disrupt before encryption, from suspicious remote access and unauthorized RMM deployment to credential theft, security-tool tampering, and ransomware execution. The research and executive brief can be found here: ⁠From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

You're listening to the Cyberwire Network, powered by N2K. Maybe that's an urgent email from your CEO, or maybe it's a deep fake targeting your business. Doppel is the AI-native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back, automatically dismantling cross-channel attacks, building team resilience, and providing agentic email protection. Dopple, outpacing what's next in social engineering. Learn more at doppel.com.

That's do p-p-p-el.com. Hello everyone and welcome to the CyberWire's Research Saturday. I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the cyberwires research. hard problems and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. It was kind of interesting because we realized as we compare nodes, and I always tell organizations, this is the most important intelligence that you can get.

Like when you look at incident response and you connect the dots across different incidents, when we did that, we realized that we were watching pretty much the same movie just with different actors, like different affiliates, different environments, different victims, but pretty much the same script. That's Ismail Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf. Today we're discussing their work tracking Anubis.

Well, for our listeners who may have heard the name but aren't up on all the details, how do you describe Anubis? Yeah, so Anubis is a ransomware service operation. That's the one we're describing here. We don't want to confuse this with the, this also an Android-anking Trojan, all the nubes, completely unrelated.

Same God, different criminals. So what we're talking here is the ransom as a service operation. It actually started with a different name, Sphinx, but they rebranded later in 2004. And you can literally

see the rebrand in the file extensions, the encrypted files. They went from dot Sphinx to a newbies. And this was formally announced in a very popular Russian cybercrime forum called Ramp. in February 2025.

And since then, it's grown into a multi-platform, multi-affiliate system with Windows, Linux encryptors, and they claim north of 80 victims on their league site. Well, your report emphasizes that this is an affiliate ecosystem rather than a single threat actor. What makes that distinction important? Yeah, so the distinction is important because even though the weapon that they use is the same,

the people using these weapons are different. So that introduces some element of randomness in that different groups may follow different playbooks. And we can see some variations here as well. But the interesting piece is that even though the actual tools that they use, especially once they break in, or even sometimes how they get through the front door may involve different vulnerabilities or different methods,

there is a lot of common things that we see across the entire attack chain when we see the full picture. Well, you all looked at multiple incidents here. What sort of pattern started emerging that the individual cases may not have revealed on their own? Yes, that's a very good question.

I mean, I can walk you from the, maybe from the very beginning. Yeah, let's do it. Sure. Yeah, let's do that. So essentially, as we report here, there's like two different front doors. we have the Citrix Bleed 2, which is a pre-authenticated memory disclosure

in the Citrix Net Scalar appliances. Essentially, they can pull the session material straight of the appliance memory, hijack a session that is legitimate, and then just walk past the multifactor authentication, getting through the front door. The other one is VPN, right? It's stealing VPN credentials, valid credentials.

So just stealing somebody's keys, right? Just logging in. and how they get these credentials, typically through info stealers, initial access brokers, credential stuffing, things like that. One of the things that caught my eye in the research was that you all pointed out that the VPN activity was coming from VPS hosting providers

instead of residential broadband connections. What stands out about that for you? Yeah, that's a very interesting detection detail that I love here. In the VPN logs, you could see how the session's original client IP was a normal residential broadband address, which is becoming more and more common. But then the attacker's traffic was coming from a VPS hosting provider. So that's a mismatch, right? The user who logged in from, you know, a couch in their living room, they're suddenly operating from a data center.

That's a signal that if you're tracking this, if you can correlate this, signals, defenders can hunt for this. Another one of the themes that runs through the report is that the attackers are using legitimate IT tools instead of custom malware, and that's been very effective for them. Absolutely. This is also an interesting misconception sometimes we think that these ransomware groups, they're super, super, over sophisticated and they use very sophisticated malware. But in this case, it's actually the country, and that's what makes them successful. They move

laterally once they're in through RDP and PSXEC, which as we know, they're tools that every CIS admin use. They install legitimate commercially available remote management software like a screen connect, ZOho assist mesh agent.

So they're not really breaking through the front door. They're just like stealing the key, walking during business hours in a contractor's uniform and then just doing the things that contractors do. Which may mimic what you do on a regular basis inside of your organization. Yeah, the report describes what, it looks to me like it's practically a playbook,

from the suspicious VPN access all the way to the ransomware deployment. Can we go through that sequence together? Yes, so the playbook, as we mentioned, right, in this case, has like different points of entry, and that shows resiliency. Attackers will choose from a variety of ways to break in, whether it's through a vulnerability or just stealing the keys with legitimate credentials. Once they're in, they're going to be using all of these tools. I would highlight that one of the things to watch for

is the use of remote management monitoring tools, especially those that are not common in your environment. The fact that they may use these tools, it can be noisy if you know what you have. And then I'll show you, I'll walk you through a very interesting example. Once they're in, they're going to go after domain controllers, hypervisors, NAS devices as well for backups. For example, in the report, we talk about this Synology NAS,

and that's a very interesting one. Because once the where the attacker was in, they used a valid domain account that they compromised. Then they created their own local administrator account on the device, and they granted themselves every single permission to use SMB, FTP. now they transfer their tools over FTP SSH. They escalated to root, and then they started setting up Cloudflare tunnels

to exfiltrate the data. Now, interestingly, this didn't work for them. As I usually say, when something doesn't work, attackers don't go to a corner and cry. What they do is they pivot. They pivot. They just try something else. And that's what they did here.

They set up SSH forwarding, they pivoted to an offensive. authenticated HTTP proxy, and they just essentially created a separate route, one that the organization may have not been monitoring. So that shows, again, resiliency. Sure, they have a script, but, you know, I love sports. So I like to also use this analogy. It's like a well-rehearsed playbook from a sports team, right? I love football. We call it soccer here. but let's say that, you know, that's what they do. They play, they look at the different things that could happen during the game. They rehearse it.

They have a plan, and they're going to follow the plan. We'll be right back. Today's cyber criminals aren't just launching attacks. They're building businesses around them. They have subscription models. They have a marketplace. They have affiliate program. If you want to do referrals, you can get credits.

They make it really easy. It really looks like a legitimate SaaS product that some people. somebody might use. I sat down with Mike Britton, CIO at Abnormal AI, to explore how AI is lowering the barrier to cybercrime and what security leaders need to change in response. Here are full conversation at explore.thecyberwire.com slash abnormal AI. Now, is my perception correct here that this group spends a good amount of time moving laterally throughout systems before they ever launched the ransomware?

Yes, and this malware also has the capability of destructive capabilities. So they have a wiper. So they do have a lot of, let's say, options that they can use. But yes, they move fast. They go to the things that matter the most. For example, we talk about the thractor copying the NTDS.D, which maybe some of the most technical in the audience we'll recognize this.

It's the active directory database that has every single master key for the company in the domain controllers. And within one minute, that file was zipped on the desktop, ready to go.

Within one hour, the encryption was running across the environment. So once the attackers have all the data exfiltated, sometimes they would encrypt or the times they may not encrypt, but the final act is at machine speed.

Well, credential. theft was a big part of these intrusions, what kinds of credentials did they seem to be after here? Anything that would give them the keys, right? To the front door or once they're inside, the keys to other systems. For example, we talked about VPN credentials, but also once they're on the network, if they get access to domain credentials, they can move into hypervisors many times.

These are part of the domain, the corporate domain. they may move to these NAS devices. They're seeking impact. So they're going to go after what I call the crown jewels, right? These systems that are critical, maybe tier zero for their organization. We see a lot of like browser passwords being X-Fruit-Ratered as well, being maybe one of the biggest gaps for the enterprise. So they definitely have different options.

You know, one of the most interesting conclusions that you all shared is that no single behavior is especially unique. it's this combination that matters. Can you unpack that for us? Yeah, that's correct. If we think about it, before the malware, that ransomware and cryptor detonates, there's a lot of other activity that is not necessarily malicious.

It could be legitimate. They're just mimicking the same activity that a cis admin would do. So if you take any of these actions in isolation, they're not really malicious. Like, okay, somebody's listing the contents of an active directory group is that good or bad?

Well, we don't know. What's the context? Somebody's using RDP to move laterally. That's the same thing that your CSA admins to use. But when you put everything into context, for example, is this happening during business hours or who is the user doing this? Now, all of a sudden, there is a user in the HR department that is doing all of this activity.

That's not normal, right? Or we never use, I don't know, screen connect, we don't use these other type of legitimate tools. So when you see all of these together as a pattern, the pattern emerges very, very clearly, but that relies on knowing what normal looks like, having an inventory of what's approved to be able to alert on anything else.

And that's where a lot of the organizations may fail. They don't really know what normal looks like. Yeah, that's an interesting insight. where do you suppose organizations have the best opportunity to interrupt this attack before that ransomware is deployed? That's a great question. And I love to see this in phases. I'm a big fan of, we've been talking about defense in depth for a long time. I always say that defense in death is not out of style, right? It's just that you have, it's not enough. You have to complement it with detection in depth and response in depth. that all makes part of what I call a defensible security architecture,

zero trust principles. It's essentially the same thing. So that starts with the way you design your architecture. If you don't have segmentation in place, if you don't have least privilege, if you don't rehearse this type of behaviors before you go through a scenario like this,

if you don't know where your risks are within your organization, it's going to be very difficult for you to detect this. So the first step would be doing an assessment of your organization and looking at where you can implement these controls that will slow down the attack. And when you slow down the attacker, because you have more chalk points, you have more inspection,

you make it more difficult, you build trip wires. With trip wires, security cameras, security sensors, so to speak, around your environment. infrastructure that can improve the chances, increase the chances of you detecting this activity. I'm curious, you know, based on everything you've observed here, do you think this style of attack, which is relying on legitimate administrative tools, is this becoming the new normal for ransomware operators? Well, it's, I think we have a good variety of different tactics and playbooks.

But the same thing I said before, same way that I said that attackers don't cry in a corner around when things don't work. Attickers, I always say they're lazy. If something works, why would they pivot? Why would they change? So the most interesting thing about this playbook is it's not that it's

something like super, over sophisticated. It's just that they're doing simple things that you're not watching. You're not looking because you may be thinking that this is just legitimate activity. And this is nothing new We have seen Living Off the Land techniques for a long time. But the fact that in 26, this is still working,

and this is still affecting many organizations out there should be like a wake-up call. What's the take home for you? For folks who read this research, what do you hope they take away from it? The takeaway would be, you know, stop treating these intrusions like something you can't fix with one single with a silver bullet.

stop looking for one single bad indicator to just start the response you have to focus on first building a defensive security architecture and a defensive security monitoring program and at the same time focusing on knowing what normal looks like in your environment

it's the boring stuff this is to be honest this is the boring thing about security is the day-to-day operations is the limiting of the privilege privileges, the continuous daily monitoring of things that can help you to pull that thread and find out something early in the attack chain. Remember, it's not just about preventing all bad things from happening. It's detecting this type of malicious activity early in the attack chain so you can save yourself

from having to deal with this type of insulin response. Our thanks to Ismail Valenzuela from Arctic Wolf for joining us. We'll have a link to their research in our. show notes. And that's Research Saturday brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. This episode was produced by Liz Stokes. We're mixed by Elliot

Peltzman and Trey Hethers. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.