Illustration: JMiks | Shutterstock
An emerging ransomware strain dubbed Anubis ransomware has upgraded its capabilities, now adding a novel file wiping feature that permanently deletes all files on a targeted computer’s storage drive. The ransomware has been active since at least late 2024 under a ransomware-as-a-service (RaaS) model, mainly focused on data extortion.
The new functionality was spotted by researchers at Trend Micro. Their latest report on the ransomware claims that researchers have found “specific command line operations for these destructive actions, including attempts to change system settings and wipe directories.”
The new feature, dubbed “wipe mode,” doesn’t just permanently delete files. It specifically targets directories that severely affect the chance of recovery, rendering data recovery impossible even if a ransom is paid. The presence of this feature is expected to add more pressure on the victim, raising the stakes of an already damaging attack.
Anubis also targets specific processes on the target system, erases Volume Shadow copies, and encrypts data using Elliptic Curve Integrated Encryption Scheme (ECIES) encryption. The ransomware even changes the desktop wallpaper on the targeted systems to its own.
Initial access is often achieved using spear phishing emails. Once executed on the target system, the ransomware exploits commands and runs a number of scripts to gain administrator privileges. It then elevates access to the system level and moves on to detecting files and folders for encryption. So far, the ransomware has been focusing on data extraction, but now it’ll be able to threaten to permanently delete files on the drive, making recovery impossible and increasing the ransom incentive.
So far, the group has targeted construction, engineering, and healthcare firms in Australia, Canada, Peru, and the US. Anubis has seven victims listed on its dark web leak site so far, but the number is expected to rise courtesy of its new destructive abilities.
In the News: Police seize underground drug marketplace with over 600,000 users
