kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

anubis

2 stories · 2 in the wild · July 28, 2026 – July 30, 2026

evidence: 2 observed

how they got in

  • exposed service 1 · Jul 30

sectors

  • retail 1 · Jul 30

techniques

  • citrixbleed 1 · Jul 30
  • data exfiltration 1 · Jul 30

attack phases seen

  • Impact 2 · Jul 30
  • Exfiltration 1 · Jul 30
  • Initial access 1 · Jul 30

what we reported, newest first, grouped by story

Jul 28 – July 30, 2026 · 2 reports

  • The Fairlife breach is confirmed after Coca-Cola refused Anubis's ransom (earlier coverage). Anubis published ~1 TB of stolen data after its July 27 deadline; a CitrixBleed exploit is cited as the entry point. TechTimes · Jul 30 · observed · via exposed service · Data Breaches & Extortion
  • Coca-Cola confirmed data theft at dairy subsidiary Fairlife in a ransomware attack, with the Anubis crew claiming credit and threatening to leak (BleepingComputer). · Jul 28 · observed · Threat Activity