APT / THREAT GROUP

Anubis Backdoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Prodaft, this is a Python-based backdoor used by the Savage Ladybug (FIN7) group is developed to provide remote access, execute commands, and steal data. It is obfuscated to avoid detection.

Threat Analysis

Anubis Backdoor is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/TheRavenFile/Daily-Hunt/blob/main/Anubis%20Backdoor

→https://github.com/prodaft/malware-ioc/blob/master/SavageLadybug/AnubisBackdoor.md

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

py.anubisbackdoorAnubis Backdoor

External Intelligence

Malpedia: py.anubisbackdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Anubis Backdoor