ANUBIS ransomware has targeted Quest Health Solutions, exfiltrating 239 GB of sensitive operational data. Operating under a dual-threat encryption and wiping model, this Go-based malware poses severe risks to healthcare infrastructure. Explore the technical attack chain, SIEM detection rules, and containment steps.
Go-compiled ransomware payloads executing with custom command-line arguments and cryptographic keys represent a major operational risk for enterprise networks. This risk has materialized for Quest Health Solutions, a United States-based healthcare organization targeted by the ANUBIS ransomware group. The threat actors have claimed responsibility for exfiltrating 239 GB of sensitive files from the company's environment, setting an aggressive two-to-three-day deadline for negotiations before the stolen datasets are published on the dark web.
The incident demonstrates the escalating speed of double-extortion campaigns in the healthcare and pharmaceutical sectors, where service availability and patient confidentiality are deeply intertwined.
Operating under a Ransomware-as-a-Service (RaaS) model, the ANUBIS threat group (previously known as Sphinx before a rebranding campaign in early 2025) targets high-value enterprise networks globally. In this incident, the actors targeted questhealthsolutions.com, extracting a massive 239 GB archive of internal records, employee files, and operational data. The group relies on underground forums like RAMP and XSS to coordinate operations, offering customizable affiliate payouts depending on whether the attack involves double-extortion or pure data-theft exfiltration.
To evaluate if your own network credentials or corporate domains have been exposed in recent leaks, proactive investigation is necessary. Organizations can utilize FemtoSec's Dark Web Scanner to inspect underground forums, credentials, and compromised account signals linked to their domains before active exploitation occurs.
Spear-phishing or unpatched VPN/RDP
Go executable, token manipulation
Stops DB/backup services, deletes VSS
Stages and exfiltrates 239 GB of data
ECIES encryption or destructive /WIPEMODE
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
July 4, 2026
The Wallstreet ransomware group has listed Gold Standard Automotive Inc. on its data leak site, threatening to release exfiltrated databases, administrative credentials, and personal information within a five-day window. Learn about Wallstreet's TTPs and how to defend your enterprise infrastructure.
June 27, 2026
The Redact ransomware group, an extortion-only offshoot linked to UNC6671, has targeted FCCI Insurance Group, stealing 145 GB of corporate data. The group bypassed multi-factor authentication by utilizing advanced voice phishing (vishing) and session hijacking to execute automated cloud-to-cloud data extraction.
June 23, 2026
Corporación Primax S.A., Peru's prominent energy and fuel distributor, has been targeted by the Aur0ra ransomware syndicate. The attackers claim to have stolen sensitive operational files, databases, and customer records, demonstrating a dangerous trend in stealthy, non-renaming encryption methods.
This original source is hosted on the Tor network. Use Tor Browser to open it, and treat the forum as untrusted while reviewing the post.
Onion URL
http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/zs0kJn+TWO+EWnaEbyIpQaCT835tcHS1M1bX8cYZtRsoiruZcRaSFoZmfT7PLjbzYqWqL3UuLe+waxoy4oJUpWUklxb2Nj
The execution of ANUBIS ransomware follows a highly structured, automated sequence designed to maximize system encryption while permanently disabling recovery mechanisms. Because the binary is written in Go, it benefits from rapid cross-compilation, a minimal runtime footprint, and highly efficient multi-threaded operations.
A ransomware incident of this scale has profound consequences for healthcare and pharmaceutical providers. The loss of access to operational networks, patient documentation, and clinical files poses immediate risks to patient care continuity. Furthermore, the threat of publishing 239 GB of corporate data creates severe compliance risks under global regulatory frameworks such as HIPAA and PCI-DSS.
Organizations must realize that data extortion is often preceded by weeks of credential harvesting. Implementing robust Dark Web Monitoring allows security teams to detect compromised employee credentials on underground forums before threat actors can exploit them to establish a foothold.
Attackers commonly gain entry into targeted networks using spear-phishing campaigns that deliver malicious payloads disguised as legitimate business attachments or software installers. Additionally, affiliates frequently exploit exposed infrastructure assets, such as unpatched VPN or Remote Desktop Protocol (RDP) endpoints, or utilize compromised credentials purchased from dark web markets. To prevent these vulnerabilities from being exploited, continuous assessment of external assets is critical. Regular assessments via Penetration Testing can help identify these edge vulnerabilities and prevent unauthorized initial entry.
Once inside the environment, the ANUBIS binary must be executed with a specific command-line argument containing a unique 30-plus character key (using the /KEY= parameter) to validate its execution. If this key is missing or incorrect, the payload terminates to prevent sandbox analysis. Once authorized, the malware attempts to escalate privileges. It uses access token manipulation to achieve SYSTEM-level access. If administrative rights are missing, it spawns interactive prompts or restarts itself using the /elevated parameter.
To prevent active security agents from detecting the ransomware, the malware terminates critical local processes and services. It identifies and stops services associated with databases and enterprise backup infrastructure, such as SQLSERVERAGENT, VeeamTransportSvc, and BackupExecAgentBrowser. Additionally, the ransomware invokes command-line processes to permanently delete Windows Volume Shadow Copies, preventing simple system restoration:
vssadmin delete shadows /for=norealvolume /all /quietANUBIS employs the Elliptic Curve Integrated Encryption Scheme (ECIES) to encrypt files, relying on Go-based cryptographic libraries. After encryption, the extension .anubis or .anb is appended to the files, the system desktop wallpaper is changed to a localized image asset (wall.jpg), and a custom icon (icon.ico) is assigned to the encrypted files. A ransom note titled RESTORE FILES.html is dropped across affected directories.
A highly concerning element of the ANUBIS binary is its support for the /WIPEMODE parameter. When launched with this parameter, the malware switches from standard encryption to a destructive wiping phase. It permanently overwrites the contents of targeted files and truncates their sizes to 0 KB while preserving the overall directory tree. This makes any form of cryptographic recovery impossible, functioning as a pure wiper tool to exert maximum psychological pressure during negotiations.
To mitigate the risk of an ANUBIS attack, security operations centers (SOC) should establish specific detection rules and proactive containment strategies.
Security teams can deploy the following logic patterns within their SIEM or EDR solutions:
Shadow Copy Deletion: Monitor process creation logs for the execution of vssadmin.exe targeting shadow copies. Use the following query condition: process_name == "vssadmin.exe" AND (arguments CONTAINS "delete" AND arguments CONTAINS "shadows" AND arguments CONTAINS "/quiet").
Command-Line Argument Patterns: Create detection alerts for binaries executing with the distinctive ANUBIS syntax. Monitor for command-line arguments containing /KEY=, /WIPEMODE, /elevated, /PFAD=, or /PATH=.
Desktop Modification: Monitor registry changes under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System where the wallpaper value is mapped to %ProgramData%\wall.jpg.
If an active compromise is suspected, execute the following containment playbook immediately:
Network Isolation: Disconnect all infected systems from the local network and VLANs to block the lateral spread of the ransomware or wiper binary. Do not shut down systems immediately if memory forensics is required, but isolate them at the network switch or port level.
Session Revocation: Force a domain-wide password reset for all user and service accounts. Terminate all active VPN, RDP, and cloud-access sessions immediately to lock out the attackers' active sessions.
Immutable Backup Recovery: Because ANUBIS explicitly destroys local backups and volume shadow copies, recovery must rely on offline, out-of-band, or immutable cloud backups. Verify the integrity of the backup restoration environment before bringing assets back online.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.