Anubis
MITRE ATT&CK: S0422 View on attack.mitre.org
Aliases: Anubis
- First seen
- 2017-01-01 00:00:00
- Malware type
- trojan
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 73 (32 malicious)
- Last IoC activity
- 2026-10-16 12:37:56
- Profile updated
- 2026-07-07 13:55:58
Targeted industries: financial-services
Targeted regions: country_code:us country_code:de country_code:in country_code:ru
Context
Anubis is Android malware that was originally used for cyber espionage, and has been retooled as a banking trojan.
Recent IoC activity
32 malicious indicators in Maltiverse are attributed to Anubis (S0422). The 20 most recently updated:
Malware & tools used
- Abuse Accessibility Features (attack-pattern)
- Data from Local System (attack-pattern)
- Archive Collected Data (attack-pattern)
- Process Discovery (attack-pattern)
- System Information Discovery (attack-pattern)
- SMS Control (attack-pattern)
- System Checks (attack-pattern)
- Call Control (attack-pattern)
- Software Discovery (attack-pattern)
- GUI Input Capture (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
- Location Tracking (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Contact List (attack-pattern)
- Screen Capture (attack-pattern)
- Prevent Application Removal (attack-pattern)
- Download New Code at Runtime (attack-pattern)
- Keylogging (attack-pattern)
- Dead Drop Resolver (attack-pattern)
- Audio Capture (attack-pattern)
Used by threat actors
- FIN7 Anubis Backdoor Activity (campaign)
Reports & references
- ransomlook.io — Anubis (report)
- bleepingcomputer.com — Anubis Banking Trojan Targets Android Users (report)
- sentinelone.com — Anubis Android Banking Trojan Analysis (report)
- Trend Micro — Anubis Malware Family Returns With New Variants (report)
- blog.cyble.com — Anubis Banking Trojan Targets Multiple Countries (report)
- CISA — Ar22 187A (report)
- MITRE ATT&CK — S0422 (report)
- web.archive.org — Infostealer Keylogger Ransomware One Anubis Targets 250 Android Applications (report)