New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org

    Friday, November 6, 2026 In: Threat Research Print

    Date: 11/06/2026

    Severity: High

    Summary

    Anubis ransomware attackers deployed a newly discovered custom backdoor, named Backdoor.Lindnor, against a U.S. organization in October 2026. The malware disguised itself as legitimate Chrome and VMware components and was found on two Microsoft SQL Server systems. Attackers also deployed multiple security-disabling tools, vulnerable drivers, and AnyDesk to maintain access and bypass security protections. Although the ransomware encryption payload was successfully blocked, the incident highlights Anubis operators' growing capabilities and their focus on disabling security defenses before launching ransomware attacks.

    Indicators of Compromise (IOC) List

    Domains/URLs

    msrcontrib.com

    cfgsync-relay.eastus.cloudapp.azure.com

    Hash

    fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8

    5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b

    ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43

    e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026

    467d1395b61d4b886329571b564fb21db01639acd2799439646c85b9aeaec175

    47a864736764112d7897c76e56d51111ce75b3e46fdbac6933df8a5b29507d17

    6543ee9f89d80b2bcf08e98fb8e9e73a4b144a93c7b2a3f28e35de8f7e7a8a80

    83eff3e51b69968a4ddd503b0b1dccfa8829d638f2dc00cc69640a29aea814f1

    f8d4142a94269b4258f370ef2292d22a49cd6dee8266a7122f4531e9cc5d9a2f

    cd1e68583b8b984a9bb5b9f7067077c0e0d8f79da4455c326319e5e5fc6e9c5f

    5a2082162852984ffe7e7c501faa6cf473129fcba29406ffb98d55198de4b3a5

    5fcd2c954764ac0888c8ba72fc1cf54db64e8f23f83aeb0786ae5b80438ba926

    aa779d811e00a30dfb56b994bdd63424cbf97617af737a218b6aff9f7c3a50f5

    854c3e76beb200243ccf6af260e9a2089c2fc545f8f1b34d34c6fe86f2d056c3

    67dee1d52189460b88f8ce5ffa76a5c22f86ffd67f8e689118019fce0863c321

    cde8dbeaf15250337a03e07a7e257b12b03e5e951885cc69a578545f44425bdd

    28357d9666a9be36b2ea9ac6007bb8bfbe7e2438e095c1ec40720c4001f47c62

    588887e709459f1d1a8109b089cb3462c6f796d30b6297a1a0fdb3419a3ccbce

    962be6983f3ed4f1dc4ce117e135cc0a5ab8fc6b5f5aa0284eff8a9def66e338

    5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db

    72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258

    e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e

    9058388d05d984ca691a23ee70fcdbd3266c5cdc68ebc5aed95c67f1c502bc75

    2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection                

    Detection Query 1 :

    domainname like "cfgsync-relay.eastus.cloudapp.azure.com" or url like "cfgsync-relay.eastus.cloudapp.azure.com" or siteurl like "cfgsync-relay.eastus.cloudapp.azure.com" or domainname like "msrcontrib.com" or url like "msrcontrib.com" or siteurl like "msrcontrib.com"

    Detection Query 2 :

    sha256hash IN ("5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db","e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e","467d1395b61d4b886329571b564fb21db01639acd2799439646c85b9aeaec175","72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258","5a2082162852984ffe7e7c501faa6cf473129fcba29406ffb98d55198de4b3a5","f8d4142a94269b4258f370ef2292d22a49cd6dee8266a7122f4531e9cc5d9a2f","ad9575a9ef2dcc9d2fd2a24376c418549d4b3db5564c22b20081d33cf7629e43","9058388d05d984ca691a23ee70fcdbd3266c5cdc68ebc5aed95c67f1c502bc75","28357d9666a9be36b2ea9ac6007bb8bfbe7e2438e095c1ec40720c4001f47c62","2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a","fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8","5d2dd9caf2ae4a5083dbec16e688040456cdbc31eaeecbab78188e322ed0415b","e69b882218fa2a19fd351741874bfcd10a6ae91076e6a8483795e0e357f8d026","47a864736764112d7897c76e56d51111ce75b3e46fdbac6933df8a5b29507d17","6543ee9f89d80b2bcf08e98fb8e9e73a4b144a93c7b2a3f28e35de8f7e7a8a80","83eff3e51b69968a4ddd503b0b1dccfa8829d638f2dc00cc69640a29aea814f1","cd1e68583b8b984a9bb5b9f7067077c0e0d8f79da4455c326319e5e5fc6e9c5f","5fcd2c954764ac0888c8ba72fc1cf54db64e8f23f83aeb0786ae5b80438ba926","aa779d811e00a30dfb56b994bdd63424cbf97617af737a218b6aff9f7c3a50f5","854c3e76beb200243ccf6af260e9a2089c2fc545f8f1b34d34c6fe86f2d056c3","67dee1d52189460b88f8ce5ffa76a5c22f86ffd67f8e689118019fce0863c321","cde8dbeaf15250337a03e07a7e257b12b03e5e951885cc69a578545f44425bdd","588887e709459f1d1a8109b089cb3462c6f796d30b6297a1a0fdb3419a3ccbce","962be6983f3ed4f1dc4ce117e135cc0a5ab8fc6b5f5aa0284eff8a9def66e338")

    Reference:   

    Anubis Ransomware Deploys Custom Backdoor to Evade Detection                                                                                


    Tags

    MalwareThreat ActorRansomwareBackdoorUnited StatesMicrosoft

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.