Nascent Anubis RaaS operation examined

Newly emergent Anubis ransomware-as-a-service operation, which was first identified late last year, could prove to be a formidable threat to organizations this year with its extensive affiliate programs, reports SecurityWeek.

Three new affiliate programs touted by Anubis actor 'superSonic' include options for a classic ransomware option, a stolen data monetization service, and succeeding revenue payments to access brokers, according to an investigation from threat intelligence company Kela.

Additional findings showed that despite compromising data belonging to Australian healthcare provider Pound Road Medical Centre — its initial victim — Anubis was not reported to have leveraged ransomware in its attack, indicating its data extortion priorities.

While Anubis has focused on data extortion, it has not put traditional RaaS encryption by the wayside, with superSonic's post detailing the malicious payload's file encryption capabilities.

"Anubis's operators may be experienced individuals, possibly former affiliates of other ransomware groups," said the report.