{"id":12924,"date":"2025-04-02T08:19:37","date_gmt":"2025-04-02T08:19:37","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/fin7-uses-anubis-backdoor-on-windows\/"},"modified":"2025-04-02T08:19:38","modified_gmt":"2025-04-02T08:19:38","slug":"fin7-uses-anubis-backdoor-on-windows","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/fin7-uses-anubis-backdoor-on-windows\/","title":{"rendered":"FIN7 Uses Anubis Backdoor on Windows"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Apr 02, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Ransomware \/ Email Security<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

A financially motivated threat actor known as FIN7 has been linked to a Python-based backdoor called Anubis, which is not to be confused with an Android banking trojan<\/a> with the same name. This backdoor enables the threat actors to gain remote access to compromised Windows systems.<\/p>\n

According to Swiss cybersecurity company PRODAFT, in a technical report<\/a> on the malware, “This malware allows attackers to execute remote shell commands and other system operations, giving them full control over an infected machine.”<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

FIN7, also known as Carbon Spider, ELBRUS, Gold Niagara, Sangria Tempest, and Savage Ladybug, is a Russian cybercrime group<\/a> known for its constantly evolving<\/a> and expanding<\/a> set of malware families used for obtaining initial access and data exfiltration. Recently, the group has transitioned into a ransomware affiliate.<\/p>\n

In July 2024, the group was observed using various online aliases to promote a tool called AuKill (also known as AvNeutralizer), which is capable of terminating security tools, likely in an attempt to diversify its monetization strategy.<\/p>\n

Anubis is believed to be spread through malspam campaigns that trick victims into executing the payload hosted on compromised SharePoint sites.<\/p>\n

The malware is delivered in the form of a ZIP archive, with the entry point of the infection being a Python script designed to decrypt and execute the main obfuscated payload directly in memory. Once launched, the backdoor establishes communication with a remote server over a TCP socket in Base64-encoded format.<\/p>\n

The responses from the server, also Base64-encoded, enable the backdoor to gather the IP address of the host, upload\/download files, change the current working directory, grab environment variables, alter Windows Registry, load DLL files into memory using PythonMemoryModule, and terminate itself.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

According to an independent analysis of Anubis by German security company GDATA, the backdoor also supports the ability to run operator-provided responses as a shell command on the victim system, stating<\/a> that this feature enables attackers to perform actions such as keylogging, taking screenshots, or stealing passwords without directly storing these capabilities on the infected system.<\/p>\n

As noted by PRODAFT, “By keeping the backdoor as lightweight as possible, they reduce the risk of detection while maintaining flexibility for executing further malicious activities.”<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n