---
title: Hunt: Anubis (Hawkmoth) dropped custom Backdoor.Lindnor plus a pile of BYOVD killers and Safe Mode AnyDesk — encryption blocked | ctxsec
url: https://ctxsec.com/items/hunt-symantec-lindnor-anubis-byovd-safemode-anydesk
description: "Symantec describes an October 2026 Anubis ransomware intrusion on a U.S. org that opened with a new custom backdoor (Backdoor.Lindnor) on two SQL Server hosts, then within about an hour dropped at least 13 security-termination executables and five known vulnerable drivers. Attackers also installed AnyDesk, created a local user, and registered AnyDesk to run in Safe Mode with Networking. The Anubis encryptor (iservice.exe, .anubis extension) was blocked; no evidence of encryption. Anubis has claimed ~96 victims in 12 months (~52% U.S.)."
status: "confirmed research (Symantec / SECURITY.COM, Nov 2026 write-up of Oct 2026 intrusion); encryption blocked; Hawkmoth/Anubis attribution"
published: 2026-11-06
---

> Symantec describes an October 2026 Anubis ransomware intrusion on a U.S. org that opened with a new custom backdoor (Backdoor.Lindnor) on two SQL Server hosts, then within about an hour dropped at least 13 security-termination executables and five known vulnerable drivers. Attackers also installed AnyDesk, created a local user, and registered AnyDesk to run in Safe Mode with Networking. The Anubis encryptor (iservice.exe, .anubis extension) was blocked; no evidence of encryption. Anubis has claimed ~96 victims in 12 months (~52% U.S.).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-symantec-lindnor-anubis-byovd-safemode-anydesk.md)

confirmed research (Symantec / SECURITY.COM, Nov 2026 write-up of Oct 2026 intrusion); encryption blocked; Hawkmoth/Anubis attribution

2026-11-06

### Hunt: Anubis (Hawkmoth) dropped custom Backdoor.Lindnor plus a pile of BYOVD killers and Safe Mode AnyDesk — encryption blocked

- **Lindnor names:** `healthcontroller64.exe` (Chrome-like path), `svchelper.exe` (VMware-like path), also `powerhost.exe`/`eventwatcher.exe`/`volumeproxy.exe`; C2 over 443 with fallback — SHA-256 in report.
- **BYOVD / killers:** watch for bursts of new EXEs plus drivers such as `havoc.sys`, `monprocessex.sys`, `xhunter1.sys`, `bdapiutil64.sys`, `fly.sys`; tools masquerading as Symantec (`gbbsym.exe`, `symgooq.exe`) with `-d` to strip callbacks.
- **Safe Mode persistence:** `reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk` and `safemode.exe`.
- **Domains:** `msrcontrib[.]com`, `cfgsync-relay.eastus.cloudapp.azure[.]com`.

Sources: [Symantec SECURITY.COM: New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org](https://www.security.com/blog-post/lindnor-new-backdoor-anubis-ransomware)