TL;DR: Arctic Wolf's June 30, 2026 threat intel and TechTimes' Anubis breach coverage report that the Anubis ransomware group, which has claimed 91 victims since it emerged in December 2024, operates by (a) exploiting Citrix Bleed 2 (CVE-2025-5777) to steal session tokens and bypass MFA and (b) installing legitimate remote-management tools (ScreenConnect, Zoho Assist, MeshAgent, UltraVNC) for persistent access that blends in with normal IT activity. Arctic Wolf adds (c): attempted outbound tunnels such as cloudflared, alongside data-transfer tools like rclone and S3 Browser. Separately, Anubis has claimed the ransomware attack that Coca-Cola disclosed at its Fairlife subsidiary in a July 16 SEC 8-K, listing Fairlife on its leak site on July 20. North Carolina SMBs, especially those running NetScaler ADC appliances or relying on remote-management tools for IT support, need a same-week remote-access audit.
Key takeaway: The 2026 ransomware wave does not need novel malware. It exploits your Citrix appliance, installs the same remote-management tools your IT team uses, and tries outbound tunnels such as cloudflared. The defense is not "buy more AV," it is inventory + patch + allowlist RMM + monitor outbound tunnels + immutable backup.
Are your NetScaler, RMM stack, and outbound tunnels audited for Anubis-style abuse? Contact Preferred Data Corporation at (336) 886-3282 for a 72-hour remote-access assessment. Serving High Point, Greensboro, Winston-Salem, Charlotte, Raleigh, and the Piedmont Triad since 1987.
Who Is Anubis and Why Should NC SMBs Care Now?
Anubis is a ransomware-as-a-service operation that emerged in late 2024 and became one of the most prolific SMB-targeting crews of 2026. Fortra's Anubis profile documents an affiliate model with a data-leak site, double-extortion (encrypt + exfiltrate), and a specific preference for small and mid-market victims where MFA gaps and thin monitoring make execution reliable.
Three data points make Anubis a July-2026 NC SMB event rather than a distant enterprise problem.
- 91 claimed victims since December 2024, which TechTimes ties to Citrix Bleed 2 exploitation, covering healthcare, manufacturing, technology, and financial services.
- US-heavy victimology. TechTimes' Anubis coverage reports that more than half of the 91 listed victims are US-based.
- RMM-abuse pattern. Anubis affiliates install the same legitimate remote-management tools IT teams use for remote support, so their persistent access blends in with normal IT activity in a small SOC.
For a Triad manufacturer, a Charlotte medical practice, or a Wilmington law firm, "blends in with normal IT activity" is exactly the pattern that a Defender-only stack, an IT-outsourced-to-a-two-person MSP, or a bank-hours SOC will miss.
What Is Citrix Bleed 2 (CVE-2025-5777) and Why Is It Still Exploited in Mid-2026?
Citrix Bleed 2 is an out-of-bounds read vulnerability in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker read chunks of process memory over HTTP. In practice, that memory contains active session tokens for authenticated users, which an attacker can lift and replay to enter the environment as a valid, MFA-satisfied user. It is a modern re-run of the 2023 Citrix Bleed pattern.
Three defensive points matter for NC SMBs.
- MFA does not stop Citrix Bleed 2, because the stolen token has already satisfied MFA at the point of theft. This is why "we have MFA" is not a defense against session-hijacking attacks in 2026.
- Patching alone is not enough, because tokens issued during the exposure window remain valid until they expire. Post-patch, defenders must invalidate all active sessions and force reauthentication.
- NetScaler appliances often live in the DMZ of small businesses because they were installed years ago for VPN or remote-app publishing and are treated as "networking gear" rather than as attack surface. Every NC SMB with an on-prem NetScaler should confirm patch build and forcibly clear all sessions this week.
How Do Anubis Affiliates Abuse RMM and Cloudflared to Stay Invisible?
The Anubis affiliate playbook is a textbook example of living-off-the-land attacks: using legitimate, signed tools to accomplish adversary objectives. Arctic Wolf describes these patterns across Anubis intrusions:
- ScreenConnect and Zoho Assist installed after the initial compromise for persistent, interactive access that blends in with normal IT activity.
- MeshAgent, Remotely and UltraVNC deployed as further remote-access channels, so removing one tool does not necessarily remove the attacker.
- Total Software Deployment used as an administrative deployment mechanism to push agents across multiple hosts.
- Tunnels and data-transfer tools. In one intrusion the attackers tried to run Cloudflare's
cloudflaredtunnel binary, but the captured output showed repeated TLS failures, and Arctic Wolf says its logs do not confirm a working tunnel. Several intrusions included data-transfer tools such as S3 Browser, rclone and s5cmd.
The single most important operational implication is that detecting Anubis by looking for "unusual software" almost always fails, because none of the software is unusual. Detection requires looking at behavior: which user account installed ScreenConnect, from where, at what time, and whether the outbound Cloudflared tunnel matches any known-good pattern for the business.
What Does the Fairlife Claim Tell Us?
A recent Anubis claim illustrates the SMB relevance for NC business owners. BleepingComputer's reporting covers Anubis adding Fairlife to its leak site on July 20 and claiming the attack, following Coca-Cola's July 16 SEC 8-K disclosure of the underlying incident.
Two lessons transfer directly to NC SMBs.
- Manufacturing supply chains are Anubis' bread and butter. Help Net Security's ransomware trends report puts manufacturing as the most targeted sector. NC has 350+ defense manufacturers plus thousands of small industrial and food-manufacturing firms in the Piedmont Triad.
- Public-company subsidiaries pull SMB suppliers into the disclosure timeline. When a large parent (Coca-Cola) files an 8-K, downstream suppliers get pulled into the notification and evidence-request process within 72 hours. Any NC SMB that supplies a public company should have a documented incident-response evidence packet ready to hand over on 24-hour notice.
What Does a 30-Day NC SMB Anubis-Style Defense Program Look Like?
A 30-day program that hardens against the Anubis playbook can be executed by a competent internal IT team or by a managed provider like PDC's managed cybersecurity practice. The program has four parallel workstreams.
- Workstream 1: Identity + session hygiene. Force-reset all active NetScaler sessions after applying the CVE-2025-5777 patch. Enable session-binding to source IP where the client base is small. Enforce phishing-resistant MFA (FIDO2, Windows Hello for Business) for admin accounts. Move all admin activity to a Privileged Access Workstation.
- Workstream 2: RMM inventory and allowlist. Enumerate every installed RMM agent across the fleet (ScreenConnect, Zoho Assist, MeshAgent, UltraVNC, Splashtop, TeamViewer, N-able, ConnectWise Automate, Datto RMM, Kaseya VSA). Approved: put on allowlist. Unknown: remove. Any RMM installed by anyone other than the sanctioned IT/MSP account is a red flag.
- Workstream 3: Outbound tunnel + AiTM detection. Configure DNS filtering, managed detection and response, and firewall egress rules to detect and alert on unusual
cloudflared,ngrok,frp, and SSH-tunnel traffic. AiTM (adversary-in-the-middle) phishing kits proxy to real Microsoft 365 or Google Workspace login pages. - Workstream 4: Backup + IR readiness. Deploy immutable, air-gapped backups with a documented restore test in the last 90 days. Assemble the six-component incident-response packet (technical timeline, forensic image chain-of-custody, executive brief, NC ITPA / HIPAA / DFARS notification templates, insurance broker script, PR statement) so the first response is orderly rather than improvised.
The 30-day plan is not a full security program; it is the specific set of controls that inconveniences the Anubis affiliate model enough to move them to a softer target.
Ready to execute the 30-day Anubis defense plan? Contact Preferred Data Corporation at (336) 886-3282 or visit 1208 Eastchester Drive, Suite 131, High Point, NC 27265.
How Does This Attack Class Compare to Traditional Ransomware Defenses?
Traditional ransomware defense assumes attackers use custom malware, novel exploits, and blatant activity. Modern Anubis-style attacks assume the opposite: legitimate tools, patched-but-not-invalidated sessions, quiet lateral movement.
| Defensive Layer | Traditional Ransomware Value | Anubis-Style Value | Notes |
|---|---|---|---|
| Signature-based AV | Medium | Low | LOLBins are signed and trusted |
| Standard MFA | High | Low | Session-token theft bypasses MFA |
| Perimeter firewall | Medium | Low | Outbound TLS to Cloudflare bypasses IP filtering |
| EDR + behavioral detection | High | High | Watches process lineage and network patterns |
| 24/7 MDR | High | Very High | Watches for unexpected RMM installs and tunnel attempts |
| RMM allowlisting | Low | Very High | Direct counter to the ScreenConnect/Zoho playbook |
| Immutable backup + restore | High | High | Only reliable path to full recovery |
| Cyber insurance evidence pack | Medium | High | Determines whether the loss is paid |
The gap between "traditional" and "Anubis-style" columns is why NC SMBs still running 2020-vintage ransomware defenses are seeing incidents in 2026 despite MFA and AV. The upgrade path is EDR + 24/7 MDR + RMM allowlist + outbound-tunnel detection + immutable backup, layered on the traditional stack.
How Does Anubis Intersect With NC ITPA, HIPAA, Cyber Insurance, and CMMC?
Any Anubis-style incident against an NC SMB is a five-front event: technical, legal, insurance, PR, and (for regulated data) compliance. Four intersections define the July-2026 playbook.
- NC ITPA (N.C.G.S. § 75-65). Notification requirements apply to any breach involving NC-resident PII. Anubis double-extortion (encrypt + exfiltrate) usually triggers notification, and the "reasonable security" defense weakens sharply when a known CISA KEV (Citrix Bleed 2) was left unpatched or unrotated.
- HIPAA and 42 CFR Part 2. For NC healthcare and behavioral-health providers, an Anubis event is a Security Rule Risk Management failing under 45 CFR § 164.308(a)(1)(ii)(B).
- CMMC / DFARS 252.204-7012. The July 13, 2026 CMMC Phase 2 pause did not pause the DFARS 7012 72-hour incident-reporting obligation, and NIST SP 800-171 controls remain in force.
- Cyber insurance. Cyber insurance applications commonly ask about MFA and EDR. An Anubis-style incident that bypassed MFA via session-token theft on an unpatched NetScaler is exactly the fact pattern insurers cite in coverage disputes; a documented Citrix-patch + session-invalidation + RMM-allowlist program is the counter-argument that keeps the claim payable.
Frequently Asked Questions
We do not use Citrix. Are we still exposed to the Anubis playbook?
Yes, partially. Citrix Bleed 2 is one initial-access vector; Arctic Wolf also saw Anubis intrusions begin with valid VPN credentials. The RMM-abuse, data-transfer, and lateral-movement stages followed that route too. Every NC SMB should harden RMM inventory, outbound-tunnel detection, and immutable backup even without a NetScaler in the environment.
We patched our NetScaler in July. Are we clear?
Not automatically. Tokens issued during the exposure window remain valid until they naturally expire (typically hours). Post-patch, the correct action is to force-invalidate all active sessions, rotate any local admin passwords on the NetScaler, and hunt in NetScaler logs for anomalous session-token use during the exposure window.
How do we tell if ScreenConnect on an endpoint is legitimate or attacker-installed?
The correct check is not "is ScreenConnect installed?" but "who installed it, when, from where, and does it phone home to our sanctioned instance?" A ScreenConnect agent phoning home to an unfamiliar screenconnect.com subdomain or instance ID is a red flag. The PDC managed IT team can build an RMM-allowlist policy that catches this automatically.
Is Cloudflared always malicious?
No. Cloudflare Tunnels have many legitimate uses. The relevant signal is unexpected cloudflared.exe installation, unusual outbound Cloudflare traffic volume, or Cloudflared running from a user profile directory rather than from a Program Files install. Any of those should trigger an investigation.
How much data can an attacker exfiltrate through a Cloudflared tunnel before detection?
There is no built-in ceiling. The traffic is encrypted and goes to Cloudflare's network, which a default outbound firewall policy allows, so volume alone will not stand out unless someone is watching egress. Blocking unapproved tunnel software and monitoring outbound volume are the controls that matter.
What does managed detection and response actually catch that Defender misses?
Defender is signature-plus-behavior for a single endpoint. Managed detection and response (MDR) correlates events across endpoints, identity, cloud, and network, and has human analysts on-call 24/7 to interpret ambiguous signals. Anubis-style attacks are specifically designed to look ambiguous, so the human-in-the-loop is where the interruption happens.
What is the cost of a typical Anubis incident for a 50-person NC manufacturer?
Costs vary too widely for one honest number. Beyond any ransom, the total loss includes downtime, restoration, legal, notification, PR, cyber insurance retention, and lost customers. Ask your broker and incident-response provider to model those line items for your business before an incident.
Should we ban RMM tools entirely?
No, RMM tools are how modern IT actually gets delivered. The correct posture is a documented approved-tools list, a documented installer-account, and monitoring that alerts on any RMM install by any other account or from any other source. Ban-lists cannot compete with allowlists.