Anubis Ransomware: Victim disclosure of Kahler Automation

The Anubis ransomware-as-a-service (RaaS) group has claimed Kahler Automation, a German manufacturing firm, as a victim. The group alleges the exfiltration of data related to fertilizer and grain operations, publishing links to stolen data on their extortion portal. Anubis has maintained consistent activity since December 2024, focusing on the manufacturing, healthcare, and professional services sectors. The group utilizes a RaaS model and includes an optional destructive 'wipe mode' in their toolkit alongside standard encryption capabilities.

Impact

The breach involves the suspected exfiltration of proprietary business data from Kahler Automation. No specific details regarding the operational status or extent of encryption have been confirmed by the organization.

Recommendation

• Monitor egress traffic for connections to the listed IP addresses associated with Anubis infrastructure.
• Review internal logs for evidence of unauthorized data staging or large-volume data transfers consistent with double-extortion ransomware operations.
• Prioritize the implementation of offline, immutable backups for critical manufacturing and operational technology (OT) systems.