[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (Symantec / SECURITY.COM, Nov 2026 write-up of Oct 2026 intrusion); encryption blocked; Hawkmoth/Anubis attribution

Hunt: Anubis (Hawkmoth) dropped custom Backdoor.Lindnor plus a pile of BYOVD killers and Safe Mode AnyDesk — encryption blocked

  • Lindnor names: healthcontroller64.exe (Chrome-like path), svchelper.exe (VMware-like path), also powerhost.exe/eventwatcher.exe/volumeproxy.exe; C2 over 443 with fallback — SHA-256 in report.
  • BYOVD / killers: watch for bursts of new EXEs plus drivers such as havoc.sys, monprocessex.sys, xhunter1.sys, bdapiutil64.sys, fly.sys; tools masquerading as Symantec (gbbsym.exe, symgooq.exe) with -d to strip callbacks.
  • Safe Mode persistence: reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk and safemode.exe.
  • Domains: msrcontrib[.]com, cfgsync-relay.eastus.cloudapp.azure[.]com.

Sources: Symantec SECURITY.COM: New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org