HOMETHREATSAnubis Backdoor
MALWARE FAMILY

Anubis Backdoor

Internal ID: py.anubisbackdoor
4
victims
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to Prodaft, this is a Python-based backdoor used by the Savage Ladybug (FIN7) group is developed to provide remote access, execute commands, and steal data. It is obfuscated to avoid detection.

Threat Analysis

Anubis Backdoor is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

Ransomware Victims (4)

CTIWATCH tracks 4 organizations claimed as victims by Anubis Backdoor on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→https://github.com/TheRavenFile/Daily-Hunt/blob/main/Anubis%20Backdoor
→https://github.com/prodaft/malware-ioc/blob/master/SavageLadybug/AnubisBackdoor.md

Quick Facts

TypeMalware Family
Aliases1

Also Known As

py.anubisbackdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Anubis Backdoor Victims (4)·Geopolitics Map·Search Anubis Backdoor
Anubis Backdoor — Malware Family | Threat Intelligence | CTIWATCH.COM