{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/general-internal-corporate-infrastructure/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Anubis"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["General internal corporate infrastructure"],"_cs_severities":["high"],"_cs_tags":["ransomware","extortion","data-theft","manufacturing"],"_cs_type":"threat","_cs_vendors":["Kahler Automation"],"content_html":"\u003cp\u003eThe Anubis ransomware-as-a-service (RaaS) group has claimed Kahler Automation, a German manufacturing firm, as a victim. The group alleges the exfiltration of data related to fertilizer and grain operations, publishing links to stolen data on their extortion portal. Anubis has maintained consistent activity since December 2024, focusing on the manufacturing, healthcare, and professional services sectors. The group utilizes a RaaS model and includes an optional destructive 'wipe mode' in their toolkit alongside standard encryption capabilities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe breach involves the suspected exfiltration of proprietary business data from Kahler Automation. No specific details regarding the operational status or extent of encryption have been confirmed by the organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor egress traffic for connections to the listed IP addresses associated with Anubis infrastructure.\u003c/li\u003e\n\u003cli\u003eReview internal logs for evidence of unauthorized data staging or large-volume data transfers consistent with double-extortion ransomware operations.\u003c/li\u003e\n\u003cli\u003ePrioritize the implementation of offline, immutable backups for critical manufacturing and operational technology (OT) systems.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T09:57:26Z","date_published":"2026-11-07T09:57:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-anubis-kahler/","summary":"The Anubis ransomware-as-a-service group has added Kahler Automation to its data leak site, claiming the theft of manufacturing-related data.","title":"Anubis Ransomware: Victim disclosure of Kahler Automation","url":"https://feed.craftedsignal.io/briefs/2026-11-anubis-kahler/"}],"language":"en","title":"CraftedSignal Threat Feed - General Internal Corporate Infrastructure","version":"https://jsonfeed.org/version/1.1"}