[anubis]

September 27, 2026

• Storm-2570 keeps the same tradecraft across four ransomware brands. Microsoft has tracked the affiliate since April 2025 deploying Qilin, DragonForce, Anubis and BERT with largely uniform post-compromise tooling, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling — the argument being that payload-centric tracking hides the actor doing the intrusions (Microsoft). · Cloud & Identity

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

July 30, 2026

• The Fairlife breach is confirmed after Coca-Cola refused Anubis's ransom (earlier coverage). Anubis published ~1 TB of stolen data after its July 27 deadline; a CitrixBleed exploit is cited as the entry point. TechTimes · Data Breaches & Extortion

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 28, 2026

• Coca-Cola confirmed data theft at dairy subsidiary Fairlife in a ransomware attack, with the Anubis crew claiming credit and threatening to leak (BleepingComputer). · Threat Activity

in Agentic AI Muscles Into the Offensive Toolkit

July 4, 2026

• Anubis ransomware adopts Citrix Bleed 2 for initial access. Affiliates are exploiting CVE-2025-5777 and leaning on legitimate RMM tooling and hands-on-keyboard tradecraft. CERT-EU separately advised on multiple NetScaler ADC/Gateway flaws. The Hacker News · CERT-EU 2026-003 · Threat Intelligence

in Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat