Anubis RaaS: The Rise of a Ruthless Ransomware with Wiper Capabilities

Introduction: A New Breed of Ransomware Is Here

The ransomware landscape has long been plagued by malicious actors encrypting victims’ files in exchange for payments. But now, a more destructive force has entered the game. Named after the Egyptian god of death, Anubis is not just another ransomware-as-a-service (RaaS). It’s a hybrid threat that brings together traditional file encryption and a rare, devastating twist—a wiper mode that irreversibly erases data, even if victims pay the ransom. Launched in late 2024 and fully operational by 2025, Anubis has already targeted organizations across industries, exploiting both technology and psychology to pressure victims into submission. This article dissects Anubis’s tactics, impact, and implications for cybersecurity moving forward.

Anubis RaaS: Threat and Evolution

Anubis is a next-generation ransomware-as-a-service (RaaS) operation that distinguishes itself by offering both data encryption and a unique “wipe mode”—a capability that permanently deletes files, rendering data recovery impossible, even post-payment. First surfacing in December 2024, Anubis evolved from an earlier strain known as Sphinx, which shared much of the same code but lacked full extortion mechanics. The malware was rebranded and began appearing on cybercrime forums like RAMP and XSS in early 2025.

What makes Anubis particularly dangerous is its multi-layered extortion model. It leverages standard ransomware methods—spreading via phishing emails, escalating privileges, avoiding detection, and encrypting user files—but escalates the threat by threatening to leak stolen data and erase it permanently using its wiper functionality. This combination of double extortion and permanent data loss amplifies the psychological pressure on victims.

Anubis encrypts files using the Elliptic Curve Integrated Encryption Scheme (ECIES), similar to the encryption approach used by other advanced malware like EvilByte and Prince ransomware. It applies the “.anubis” file extension and alters file icons to display the group’s branding. It even attempts to set a custom desktop wallpaper as part of its intimidation tactics.

The ransomware is intelligent in its approach—it avoids critical system directories, deletes Volume Shadow Copies to prevent rollback, and halts interfering processes. The so-called “wiper mode” wipes contents while leaving file names intact at 0 KB, creating a façade of recoverable data while ensuring its destruction.

Anubis’s flexible affiliate program attracts cybercriminal partners by offering diverse monetization methods: direct ransom, data theft for black market resale, and access brokering. According to Trend Micro, this makes it an “evolving and flexible RaaS operation” with far-reaching implications.

What Undercode Say:

Anubis is a chilling example of how ransomware threats are becoming increasingly destructive and sophisticated. While older ransomware strains were content with encryption and simple extortion, Anubis takes a scorched-earth approach. Its “wiper mode” is essentially a digital death sentence for organizations that fail to comply—and even some that do.

This approach reflects a strategic shift in the cybercriminal world: monetization isn’t just about ransom anymore, but about maximizing pressure points. The addition of file destruction, resale of stolen data, and access monetization reflects an understanding of the corporate risk calculus. If a victim knows they’ll lose everything regardless of payment, they’re more likely to cave—and fast.

The ECIES encryption and the similarity to EvilByte suggest that Anubis’s developers are borrowing and refining proven tools rather than reinventing the wheel. This makes detection and prevention more difficult for security teams, especially as affiliates rapidly adopt and spread the tool through phishing and credential-based attacks.

From a technical standpoint, Anubis is built for endurance and stealth. It avoids detection by excluding system-critical directories and deploying multiple evasion layers. It also showcases a clear understanding of endpoint security blind spots, particularly through its ability to delete shadow copies and stop processes that might interfere with encryption.

Furthermore, the affiliate structure presents scalability concerns. With an open RaaS model, Anubis can infect a wide array of sectors—including healthcare and construction—without the original developers needing to engage directly. This decentralization makes attribution harder and neutralization slower.

Organizations need to respond to this kind of threat not just with backup strategies, but with proactive defense measures: advanced threat detection, real-time behavioral monitoring, privilege access management, and user awareness training to reduce phishing success rates.

In summary, Anubis is not merely a ransomware—it’s a weapon of digital sabotage with economic intent. It’s designed to not only extract money but also inflict maximum damage, erode trust, and make recovery virtually impossible. This new era of ransomware demands a paradigm shift in how we think about cybersecurity—focusing more on resilience, speed, and layered responses.

🔍 Fact Checker Results:

✅ Anubis evolved from the Sphinx malware family, with similar code structure.
✅ Anubis uses ECIES encryption, consistent with its classification as high-sophistication ransomware.
✅ Wiper mode effectively zeroes file content, making recovery impossible even if names remain.

📊 Prediction:

With the growth of Anubis and its affiliate model, 2025 is likely to see a surge in RaaS operations combining traditional encryption with destructive features. Expect to see copycat groups mimicking the wiper model, especially as cybercriminals realize the psychological leverage it creates. Also, enterprises may begin prioritizing immutable backups and decentralized storage models as part of their disaster recovery plans.

Cybercriminal ecosystems like RAMP and XSS will increasingly become marketplaces for hybrid threats, and tools like Anubis may soon integrate AI-driven decision engines for target selection and dynamic ransom setting—making them even more efficient and dangerous.

References:

Reported By: securityaffairs.com
Extra Source Hub:
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI

Image Source:

Unsplash
Undercode AI DI v2

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram