Anubis Ransomware Recovery: What's Recoverable

Anubis has been active since December 2024 as a ransomware-as-a-service operation, running affiliate programs with revenue splits from 50% to 80%, plus a separate program for affiliates who only want help monetizing data they've already stolen. Confirmed victims span healthcare, construction and other sectors across Australia, Canada, Peru and the United States.

File content is encrypted using ECIES (Elliptic Curve Integrated Encryption Scheme), via a Go-based implementation similar to one used by EvilByte/Prince ransomware, with files renamed to a .anubis extension. The detail that sets Anubis apart is a separate /WIPEMODE flag: rather than encrypting, it truncates a file's contents to zero bytes — permanently destructive rather than reversible with a key.

This is the one distinction that changes everything about what's realistic: if a file was wiped rather than encrypted, no decryption key — leaked, purchased or otherwise obtained — brings back content that no longer exists in that copy. Recovery for a wiped file depends entirely on sources outside the ransomware itself: backups, snapshots, shadow copies or an unaffected replica. Establishing which behaviour actually happened, file by file, is the first thing an assessment needs to determine before anything else about the case can be judged.