New Fully Undetected Anubis Malware Let Hackers Execute Remote Commands

A newly discovered Python-based backdoor called AnubisBackdoor is enabling threat actors to execute remote commands on compromised systems while completely evading detection by most antivirus solutions.

Developed by the notorious threat group Savage Ladybug (also known as FIN7), this malware combines simplicity with effectiveness through mild obfuscation techniques, allowing attackers to maintain persistent access to infected systems without raising security alerts.

The malicious software enables attackers to execute commands remotely, exfiltrate sensitive data, and further compromise systems across an organization’s network infrastructure.

The primary infection vector appears to be malspam campaigns where unsuspecting users receive seemingly legitimate emails containing malicious attachments or links.

When users interact with these malicious elements, the AnubisBackdoor is installed on their systems, establishing persistence mechanisms and communication channels with command and control servers operated by the attackers.

This stealthy approach allows the malware to remain operational for extended periods while victims remain unaware of the compromise.

PRODAFT’s researchers identified that the malware’s effectiveness stems from its carefully designed obfuscation techniques, which have proven remarkably successful at bypassing even sophisticated security solutions.

Their analysis reveals that despite its relatively simple structure, AnubisBackdoor leverages standard Python libraries in a way that minimizes its footprint while maximizing functionality, making it particularly challenging to detect through conventional means.

Technical examination of the malware’s architecture shows it employs a modular design that allows threat actors to customize payloads based on target environments and specific objectives.

The core functionality revolves around a command execution mechanism that interfaces directly with the system shell, as demonstrated in this representative code snippet extracted from analysis:-

def execute_command(cmd):
    try:
        output = subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT)
        return output.decode('utf-8')
    except subprocess.CalledProcessError as e:
        return e.output.decode('utf-8')

The malware’s ability to operate below the detection threshold of most security tools makes it particularly dangerous in today’s threat landscape.

Organizations may remain compromised for extended periods without any indication of the breach, allowing attackers to monitor activities, steal credentials, and gradually move laterally through networks.

While the malware’s Python-based nature also provides attackers with cross-platform capabilities, potentially affecting Windows, Linux, and macOS systems with minimal modification.

Mitigation Strategies and Recommendations

Defending against AnubisBackdoor requires a comprehensive security approach that goes beyond traditional signature-based detection methods.

Organizations should implement robust email filtering solutions capable of identifying and quarantining suspicious attachments before they reach end-users.

Regular system audits should be conducted to identify unauthorized Python installations or suspicious scheduled tasks that might indicate compromise.

Network traffic analysis can help detect unusual outbound connections to unknown servers that might represent command and control communications.

PRODAFT has published detailed indicators of compromise (IOCs) including file hashes, IP addresses, and domain names associated with AnubisBackdoor campaigns.

Security teams should immediately incorporate these IOCs into their detection systems to identify potential infections.

Security experts recommend implementing application whitelisting policies to prevent unauthorized Python scripts from executing in corporate environments.

Regular backup procedures should be maintained and tested to ensure data can be recovered in case of compromise.

IOCs

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.