Lindnor Backdoor Clears the Way for Anubis Ransomware: 13 Security-Killers and Five Vulnerable Drivers Deployed on SQL Servers in About an Hour

High · 2026-11-09 · By H.A

Researchers documented an October 2026 U.S. intrusion where Anubis ransomware affiliates planted the previously undocumented Lindnor backdoor on SQL Server hosts, then ran at least 13 mostly novel EDR-killers and five BYOVD drivers before the encryptor was blocked.

Overview

Researchers have documented an October 2026 intrusion at a U.S. company. Anubis ransomware operators planted a previously undocumented backdoor, now called Lindnor, on the victim's Microsoft SQL Server hosts. In roughly one hour they then deployed at least 13 security-disabling programs and five signed vulnerable drivers.

The final step failed. Endpoint defences blocked the Anubis encryptor and no files were damaged. Even so, the case shows how much tooling ransomware affiliates now bring just to take down EDR before they encrypt.

The Campaign

Lindnor was found on two machines, the only SQL database servers among the compromised hosts. It was disguised differently on each:

• healthcontroller64.exe, placed in a folder made to look like a Google Chrome component directory
• svchelper.exe, placed in a folder made to look like a VMware directory

It most likely ran as a Windows service. On start-up it reports the computer name, user name, domain information, operating-system version, current process and its own file path to its command-and-control server, then waits for instructions.

How the attackers first got into the network has not been determined.

Timeline

• Late 2024: Anubis appears as a ransomware-as-a-service operation. Researchers attribute it to a group tracked as Hawkmoth.
• October 2026: The intrusion. Lindnor is installed on both SQL servers, then the defence-evasion toolkit is deployed in about an hour.
• October 2026: The Anubis payload is launched and blocked. No encryption takes place.
• 6 November 2026: Researchers publish their analysis and indicators.

Tradecraft

Mass security-killer deployment. The attackers ran at least 13 executables built to stop security software. Researchers say 11 of them had never been publicly documented. Those identified include:

• gbbsym.exe and symgooq.exe: posed as security-vendor components. They can enumerate and remove kernel callbacks, which blinds EDR drivers to process, thread and image-load events.
• huntreagent.exe and s1.exe: names suggest they target specific EDR products. Samples were not recovered, so their function is unconfirmed.
• safemode.exe: added AnyDesk to the list of services allowed in Safe Mode with Networking. That lets the attackers reboot into a mode where most security products do not load and keep remote access.
• iservice.exe: also part of the toolset.

Bring Your Own Vulnerable Driver (BYOVD). Five legitimately signed but vulnerable kernel drivers were loaded to get kernel-level access for killing protected processes.

Persistence and remote access. AnyDesk was installed and a new local user account was created, so access would survive the Safe Mode reboot.

Anubis payload. Anubis appends .anubis to encrypted files, drops ransom notes, threatens to leak stolen data, and includes a wipe mode that destroys files so they cannot be recovered even if the ransom is paid. The group has claimed about 96 victims in the last 12 months, 52% of them in the United States.

Indicators of Compromise

File names published by researchers (full hashes are in the original report):

healthcontroller64.exe   (Lindnor, fake Chrome component path)
svchelper.exe            (Lindnor, fake VMware path)
gbbsym.exe
symgooq.exe
huntreagent.exe
s1.exe
safemode.exe
iservice.exe
*.anubis                 (encrypted file extension)

Detection

• Inventory services on SQL Server hosts. Unexpected executables in Chrome- or VMware-looking paths on a database server are a strong signal.
• Alert on new kernel driver loads, especially known-vulnerable drivers. Enable Microsoft's vulnerable driver blocklist and compare loads against the LOLDrivers list.
• Monitor for changes under the SafeBoot\Network registry key and for bcdedit commands that set safe boot:

# services allowed to start in Safe Mode with Networking
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network' | Select-Object PSChildName
# pending safe-boot configuration
bcdedit /enum | Select-String safeboot

• Alert on AnyDesk installs on servers, and on new local accounts (Event ID 4720) on database hosts.
• Treat any burst of security-service stops or tamper-protection events across several hosts within a short window as an active intrusion.

Recommended Actions

• Turn on tamper protection and the vulnerable driver blocklist (HVCI / Memory Integrity where supported).
• Restrict remote-access tools with application control. Block AnyDesk and similar tools on servers unless they are explicitly approved.
• Segment SQL Server hosts. Limit inbound management access and outbound internet access from database servers.
• Keep offline, immutable backups. Anubis' wipe mode means paying may not get data back.
• If any of the indicators are found, isolate the hosts, reset credentials used on them and hunt for the initial access vector.

Analyst Assessment

The attack failed, but it still matters. Deploying more than a dozen mostly novel EDR killers, plus BYOVD and a Safe Mode trick, in about an hour shows affiliates investing heavily in defence evasion. They assume one tool will be caught and bring backups. Placing a dedicated backdoor on SQL servers points to deliberate targeting of the data most valuable for extortion. Defenders should alert on the preparation phase (driver loads, Safe Mode registry changes, remote-tool installs) rather than wait for encryption. In this case the last line held, but it was the last line.