Anubis Ransomware Introduces Irreversible File Destruction Feature

A new and menacing player has emerged in the cybercrime landscape with the introduction of Anubis, a Ransomware-as-a-Service (RaaS) operation that blends traditional file encryption with a devastating file destruction capability.

Active since December 2024, Anubis has quickly gained notoriety in 2025 for its unique “wipe mode” feature, which permanently erases file contents, rendering recovery impossible even if victims comply with ransom demands.

A Dual-Threat Evolution in Ransomware-as-a-Service

According to Trend Micro Report, this dual-threat approach marks a significant escalation in ransomware tactics, targeting industries like healthcare, engineering, and construction across regions including Australia, Canada, Peru, and the U.S.

With seven victims already listed on its leak site, Anubis demonstrates an opportunistic strategy, exploiting a wide range of targets through sophisticated attack chains that include spear-phishing as the initial access vector (T1566) and command-line execution (T1059) for deployment.

Delving into the technical intricacies, Anubis ...