ANUBIS Ransomware: US Healthcare & Retail Targeted — Critical CVE Exploitation Analysis | Security Arsenal

Date: 2026-08-04
Source: Ransomware.live / Dark Web Leak Site Monitoring
Analyst: Security Arsenal Intel Unit

Threat Actor Profile — ANUBIS

Alias & Operations: ANUBIS operates as a Ransomware-as-a-Service (RaaS) entity, likely an evolution of previous lock-screen malware tooling adapted for enterprise espionage. They leverage a "double-extortion" model, encrypting victim systems while threatening to release sensitive exfiltrated data.

TTPs & Dwell Time:

Initial Access: Heavily reliant on perimeter exploits (VPN/Firewall vulnerabilities) and compromised remote management tools (RMM). The group demonstrates advanced capability in exploiting unpatched edge devices rather than simple phishing.
Lateral Movement: Uses a mix of Cobalt Strike beacons and native tools like PsExec and WMI for internal propagation.
Ransom Demands: Typically ranges from $500k to $5M, calibrated based on victim revenue and urgency of service restoration.
Dwell Time: Estimated 3–7 days. ANUBIS actors move quickly from initial foothold to data exfiltration, often detonating encryption within a week of access to minimize defender response windows.

Current Campaign Analysis

Sector Targeting: The current wave (2026-08-03) indicates a sharp pivot towards high-value targets in Healthcare and Retail & E-Commerce.

Healthcare: Cameron Regional Medical Center, BLACKBURN’S.
Retail: Winn-Dixie.

Geographic Focus: Exclusively United States based on recent postings.

Victim Profile: Targets are mid-to-large enterprises. The inclusion of major grocery chains (Winn-Dixie) and regional medical centers suggests ANUBIS is targeting organizations with high transaction volumes and sensitive PII/PHI, where operational downtime is unacceptable, increasing the likelihood of ransom payment.

Observed Posting Frequency: A cluster of 3 victims posted on a single day (2026-08-03) suggests a coordinated "weekend dump" or the conclusion of a specific operation phase against the US market.

CVE Correlation & Initial Access Vectors: The CISA KEV list associated with this group provides critical insight into their intrusion methods:

Perimeter Breach: The listing of CVE-2026-50751 (Check Point Security Gateway) and CVE-2026-20131 (Cisco Secure Firewall Management Center) strongly suggests the gang is exploiting VPN/Firewall interfaces for initial access. These are critical entry points for bypassing traditional perimeter defenses.
Remote Management: CVE-2024-1708 (ConnectWise ScreenConnect) is a known vector for gaining remote code execution (RCE) on internal management stations, often used to bypass local firewall rules.

Detection Engineering

The following detection rules and scripts are designed to identify the specific TTPs observed in the ANUBIS campaign, focusing on edge device exploitation and lateral movement.

YAML

---
title: Potential Check Point VPN Improper Authentication (CVE-2026-50751)
id: 4b2f6c1a-8f3d-4a5b-9e0c-1d2a3b4c5d6e
status: experimental
description: Detects signs of improper authentication or异常 IKEv1 key exchange requests indicative of CVE-2026-50751 exploitation attempts against Check Point Security Gateways.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/04
logsource:
  product: firewall
  service: vpn
detection:
  selection:
    destination_port: 500
    protocol: 'IKEv1'
    vpn_action|contains: 'failure' # Or specific IKE payload anomalies if available in logs
  condition: selection
falsepositives:
  - Misconfigured VPN clients
  - Legacy system compatibility attempts
level: high
---
title: Suspicious ConnectWise ScreenConnect Webshell Activity
definition:
  "threat": T1190
  "sub_threat": Initial Access
id: 5c3g7d2e-9g4h-5j6k-0f1e-2a3b4c5d6e7f
status: experimental
description: Detects path traversal and potential webshell upload patterns associated with CVE-2024-1708 in ConnectWise ScreenConnect.
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/04
logsource:
  category: web
detection:
  selection_uri:
    cs-uri-query|contains:
      - '..%2f'
      - '..\'
      - 'SetupCache'
  selection_agent:
    cs-user-agent|contains: 'ScreenConnect'
  condition: all of selection*
falsepositives:
  - Legacy integration testing
level: critical
---
title: ANUBIS Ransomware Pattern - Mass Data Staging via Rclone
id: 6d4h8e3f-0h5i-6k7l-1g2h-3i4j5k6l7m8n
status: experimental
description: Detects the use of rclone or similar tools for large-scale data exfiltration, commonly used by ANUBIS prior to encryption.
author: Security Arsenal
date: 2026/08/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
  selection_cli:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'sftp:'
      - 'swift:'
  condition: all of selection*
falsepositives:
  - Legitimate backup admin tasks
level: high

KQL Hunt Query (Microsoft Sentinel)

Hunt for lateral movement and suspicious process execution patterns often seen in ANUBIS operations involving Cobalt Strike and PowerShell.

KQL — Microsoft Sentinel / Defender

let ProcessList = datatable(ProcessName:string, CommandLine:string)[
"powershell.exe", " -enc ",
"cmd.exe", " /c ",
"rundll32.exe", ".dll,javascript"
];
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (ProcessList) or ProcessCommandLine has_any ("Invoke-SMBExec", "Invoke-WmiMethod", "C:\\Windows\\Temp\\")
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "excel.exe", "msedge.exe", "chrome.exe") or InitiatingProcessFileName == "unknown"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| summarize count() by DeviceName, FileName
| order by count_ desc

Rapid Response Script (PowerShell)

Script to enumerate scheduled tasks and VSS modifications—key indicators of ransomware staging.

PowerShell

<#
.SYNOPSIS
    Hunt for ANUBIS Ransomware Pre-Encryption Artifacts.
.DESCRIPTION
    Checks for recently modified Scheduled Tasks and Volume Shadow Copy deletions.
#>

Write-Host "[+] Hunting for ANUBIS Ransomware Indicators..." -ForegroundColor Cyan

# Check for Scheduled Tasks created/modified in the last 24 hours
$DateCutoff = (Get-Date).AddDays(-1)
Write-Host "[*] Checking for Scheduled Tasks created/modified in last 24 hours..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | Select-Object TaskName, TaskPath, Date, Author

# Check for VSS Deletion Events (Event ID 1 from volsnap)
Write-Host "[*] Checking Volume Shadow Copy deletion attempts (Volsnap Event ID 1)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='volsnap'; ID=1; StartTime=$DateCutoff} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message

Write-Host "[+] Hunt complete. Review output." -ForegroundColor Green


---

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption):

VPN/Firewall Logs: Immediate review of Check Point and Cisco FMC logs for spikes in IKEv1 failures or unauthorized admin login attempts correlating to CVE-2026-50751 and CVE-2026-20131.
RMM Audit: Audit ConnectWise ScreenConnect logs for logins from unknown IP addresses or successful authentication sessions followed by process creation.
Exchange Servers: Hunt for deserialization anomalies or unexpected PowerShell execution on Exchange servers (CVE-2023-21529).

Critical Assets for Exfiltration:

Healthcare: Electronic Health Records (EHR) databases, PACS imaging archives, patient billing systems.
Retail: Point of Sale (POS) databases, customer loyalty programs (PII), credit card transaction logs.

Containment Actions (Order of Urgency):

Isolate: Disconnect vulnerable VPN gateways (Check Point/Cisco) from the management plane if patches are not verified.
Disable: Temporarily disable internet-facing RMM services (ScreenConnect) until CVE-2024-1708 is patched.
Revoke: Force-reset passwords for all admin accounts on firewall and email infrastructure.

Hardening Recommendations

Immediate (24h):

Patch Edge Devices: Apply patches for CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco FMC) immediately. If patching is delayed, disable IKEv1 or restrict management access to trusted source IPs.
RMM Hygiene: Update ScreenConnect to the latest patched version. Enforce MFA and IP whitelisting for all RMM access.

Short-term (2 weeks):

Network Segmentation: Implement strict micro-segmentation preventing direct lateral movement from VPN edge zones to EHR/POS database segments.
Zero Trust Access: Replace always-on VPNs with Zero Trust Network Access (ZTNA) solutions to reduce the attack surface of perimeter gateways.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

ANUBIS Ransomware: US Healthcare & Retail Targeted — Critical CVE Exploitation Analysis