{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/santiam-hospital--clinics/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Anubis"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Santiam Hospital \u0026 Clinics"],"_cs_severities":["high"],"_cs_tags":["ransomware","healthcare","data-exfiltration"],"_cs_type":"threat","_cs_vendors":["Santiam Hospital \u0026 Clinics"],"content_html":"\u003cp\u003eThe Anubis ransomware group has publicly claimed responsibility for a data breach at Santiam Hospital \u0026amp; Clinics. The group operates under a Ransomware-as-a-Service (RaaS) model and is known for double extortion, which involves exfiltrating sensitive medical data and encrypting organizational systems. The threat actor also provides affiliates with an optional destructive \u0026quot;wipe mode\u0026quot; to permanently delete data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe breach at Santiam Hospital \u0026amp; Clinics has resulted in the exposure of sensitive medical data. Anubis has listed the victim on its public-facing onion leak site, indicating intent to extort the organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock the listed IP addresses at the perimeter firewall and web proxy to prevent communication with known Anubis infrastructure.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring (FIM) and hunt for the presence of the provided MD5 hashes on endpoints to identify potential remnants of the Anubis ransomware payload.\u003c/li\u003e\n\u003cli\u003ePrioritize monitoring of network traffic to and from healthcare infrastructure for unauthorized data staging or transfer, consistent with the double-extortion TTPs used by this group.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T08:37:22Z","date_published":"2026-10-29T08:37:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-anubis-santiam/","summary":"The Anubis ransomware-as-a-service group has claimed a new victim, Santiam Hospital \u0026 Clinics, following their established pattern of double-extortion attacks against the healthcare sector.","title":"Anubis Ransomware: Santiam Hospital \u0026 Clinics Data Breach","url":"https://feed.craftedsignal.io/briefs/2026-10-anubis-santiam/"}],"language":"en","title":"CraftedSignal Threat Feed - Santiam Hospital \u0026 Clinics","version":"https://jsonfeed.org/version/1.1"}