{
  "slug": "anubis",
  "group": "anubis",
  "name": "Anubis",
  "note": null,
  "attck": [],
  "activity": {
    "postings": 17,
    "first": "2026-08-10",
    "last": "2026-11-07",
    "countries": {
      "DE": 4,
      "US": 6,
      "??": 6,
      "GB": 1
    },
    "sectors": {
      "manufacturing": 5,
      "healthcare": 6,
      "unknown": 1,
      "services": 3,
      "technology": 1,
      "finance": 1
    },
    "recent": [
      {
        "date": "2026-11-07",
        "name": "Kahler Automation",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/S2FobGVyIEF1dG9tYXRpb25AYW51Ymlz"
      },
      {
        "date": "2026-10-28",
        "name": "Santiam Hospital & Clinics",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/U2FudGlhbSBIb3NwaXRhbCAmIENsaW5pY3NAYW51Ymlz"
      },
      {
        "date": "2026-10-25",
        "name": "Newcomer Cremations, Funerals & Receptions",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/TmV3Y29tZXIgQ3JlbWF0aW9ucywgRnVuZXJhbHMgJiBSZWNlcHRpb25zQGFudWJpcw"
      },
      {
        "date": "2026-10-20",
        "name": "Fisher59",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/RmlzaGVyNTlAYW51Ymlz"
      },
      {
        "date": "2026-10-09",
        "name": "Mynd",
        "country": "??",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/TXluZEBhbnViaXM"
      },
      {
        "date": "2026-10-07",
        "name": "Leadec",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/TGVhZGVjQGFudWJpcw"
      },
      {
        "date": "2026-09-22",
        "name": "Gaedke & Partner Steuerberatung",
        "country": "DE",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/R2FlZGtlICYgUGFydG5lciBTdGV1ZXJiZXJhdHVuZ0BhbnViaXM="
      },
      {
        "date": "2026-09-21",
        "name": "Summa Gold",
        "country": "??",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/U3VtbWEgR29sZEBhbnViaXM="
      },
      {
        "date": "2026-09-18",
        "name": "Quest Group",
        "country": "US",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/UXVlc3QgR3JvdXBAYW51Ymlz"
      },
      {
        "date": "2026-09-14",
        "name": "Better Accounting Solutions",
        "country": "??",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/QmV0dGVyIEFjY291bnRpbmcgU29sdXRpb25zQGFudWJpcw=="
      },
      {
        "date": "2026-09-09",
        "name": "Gellibrand Support Services",
        "country": "??",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/R2VsbGlicmFuZCBTdXBwb3J0IFNlcnZpY2VzQGFudWJpcw=="
      },
      {
        "date": "2026-09-02",
        "name": "Marlborough Partners",
        "country": "GB",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/TWFybGJvcm91Z2ggUGFydG5lcnNAYW51Ymlz"
      }
    ]
  },
  "convergences": [
    {
      "name": "Fisher59, LLC",
      "flagged": "2026-11-07",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Interim HealthCare Inc.",
      "flagged": "2026-09-11",
      "classes": [
        "leak",
        "litigation",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/",
      "publisher": "Microsoft Threat Intelligence",
      "published": "2026-09-24",
      "title": "Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [],
  "cves": [],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 0,
    "defendable": 0,
    "covered": 0,
    "uncovered": []
  }
}