General Internal Corporate Infrastructure - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/general-internal-corporate-infrastructure/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 09:57:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAnubis Ransomware: Victim disclosure of Kahler Automationhttps://feed.craftedsignal.io/briefs/2026-11-anubis-kahler/Sat, 07 Nov 2026 09:57:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-anubis-kahler/The Anubis ransomware-as-a-service group has added Kahler Automation to its data leak site, claiming the theft of manufacturing-related data.The Anubis ransomware-as-a-service (RaaS) group has claimed Kahler Automation, a German manufacturing firm, as a victim. The group alleges the exfiltration of data related to fertilizer and grain operations, publishing links to stolen data on their extortion portal. Anubis has maintained consistent activity since December 2024, focusing on the manufacturing, healthcare, and professional services sectors. The group utilizes a RaaS model and includes an optional destructive 'wipe mode' in their toolkit alongside standard encryption capabilities.

Impact

The breach involves the suspected exfiltration of proprietary business data from Kahler Automation. No specific details regarding the operational status or extent of encryption have been confirmed by the organization.

Recommendation

  • Monitor egress traffic for connections to the listed IP addresses associated with Anubis infrastructure.
  • Review internal logs for evidence of unauthorized data staging or large-volume data transfers consistent with double-extortion ransomware operations.
  • Prioritize the implementation of offline, immutable backups for critical manufacturing and operational technology (OT) systems.
]]>highthreatransomwareextortiondata-theftmanufacturing