Lindnor Backdoor Clears the Way for Anubis Ransomware: 13 Security-Killers and Five Vulnerable Drivers Deployed on SQL Servers in About an Hour

High · 2026-11-09 · By H.A

Lindnor Backdoor Clears the Way for Anubis Ransomware: 13 Security-Killers and Five Vulnerable Drivers Deployed on SQL Servers in About an Hour

Researchers documented an October 2026 U.S. intrusion where Anubis ransomware affiliates planted the previously undocumented Lindnor backdoor on SQL Server hosts, then ran at least 13 mostly novel EDR-killers and five BYOVD drivers before the encryptor was blocked.

Overview

Researchers have documented an October 2026 intrusion at a U.S. company. Anubis ransomware operators planted a previously undocumented backdoor, now called Lindnor, on the victim's Microsoft SQL Server hosts. In roughly one hour they then deployed at least 13 security-disabling programs and five signed vulnerable drivers.

The final step failed. Endpoint defences blocked the Anubis encryptor and no files were damaged. Even so, the case shows how much tooling ransomware affiliates now bring just to take down EDR before they encrypt.

The Campaign

Lindnor was found on two machines, the only SQL database servers among the compromised hosts. It was disguised differently on each:

It most likely ran as a Windows service. On start-up it reports the computer name, user name, domain information, operating-system version, current process and its own file path to its command-and-control server, then waits for instructions.

How the attackers first got into the network has not been determined.

Timeline

Tradecraft

Mass security-killer deployment. The attackers ran at least 13 executables built to stop security software. Researchers say 11 of them had never been publicly documented. Those identified include:

Bring Your Own Vulnerable Driver (BYOVD). Five legitimately signed but vulnerable kernel drivers were loaded to get kernel-level access for killing protected processes.

Persistence and remote access. AnyDesk was installed and a new local user account was created, so access would survive the Safe Mode reboot.

Anubis payload. Anubis appends .anubis to encrypted files, drops ransom notes, threatens to leak stolen data, and includes a wipe mode that destroys files so they cannot be recovered even if the ransom is paid. The group has claimed about 96 victims in the last 12 months, 52% of them in the United States.

Indicators of Compromise

File names published by researchers (full hashes are in the original report):

healthcontroller64.exe   (Lindnor, fake Chrome component path)
svchelper.exe            (Lindnor, fake VMware path)
gbbsym.exe
symgooq.exe
huntreagent.exe
s1.exe
safemode.exe
iservice.exe
*.anubis                 (encrypted file extension)

Detection

# services allowed to start in Safe Mode with Networking
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network' | Select-Object PSChildName
# pending safe-boot configuration
bcdedit /enum | Select-String safeboot

Recommended Actions

Analyst Assessment

The attack failed, but it still matters. Deploying more than a dozen mostly novel EDR killers, plus BYOVD and a Safe Mode trick, in about an hour shows affiliates investing heavily in defence evasion. They assume one tool will be caught and bring backups. Placing a dedicated backdoor on SQL servers points to deliberate targeting of the data most valuable for extortion. Defenders should alert on the preparation phase (driver loads, Safe Mode registry changes, remote-tool installs) rather than wait for encryption. In this case the last line held, but it was the last line.

REEF SENTINEL