Anubis ransomware encrypts 3.35 million files at Greece-based organization

Anubis, a ransomware-as-a-service operation, told SuspectFile it took 530 GB and 335,093 files from Interim Healthcare in Greece and encrypted the organization's backups. The story carries CVE-2025-5777, the Citrix NetScaler ADC and Gateway flaw where insufficient input validation allows a memory overread on appliances running as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix rated it 9.3, fixed it in bulletin CTX693420 on June 17, 2025, and CISA added it to the Known Exploited Vulnerabilities Catalog on July 10, 2025 with ransomware use flagged as known.

The mechanics, not the file count, are what make this story worth a defender's attention. A memory overread on a Gateway or AAA virtual server hands an attacker valid session material, which means MFA and VPN posture count for nothing once a token leaks, and Citrix's own remediation guidance to kill all sessions after upgrading only makes sense if pre-patch session data stays usable to an intruder. Citrix dismissed public comparisons to Citrix Bleed (CVE-2023-4966), yet the exploitation pattern rhymes: a perimeter appliance, silent authenticated access, then encryption of backups, which converts a restore exercise into a negotiation. The victim profile fits a documented campaign rather than an outlier: ransomware.live describes Anubis as active since December 2024 with an optional wipe mode, healthcare as its top sector among 113 tracked victims, and two Interim HealthCare leak-site entries dated August 15 and August 21, 2026, weeks before this interview. SuspectFile's own earlier exclusives, Copec in January 2026 with 6 TB claimed and Brockton Hospital in April 2026 with a countdown timer, show the same pressure playbook aimed at hospitals and critical infrastructure. One detail the event list does not spell out: ransomware.live puts Anubis's average delay between attack and claim at 85 days, so a mid-August claim implies an intrusion that probably began around late spring 2026, well before anyone was talking about this victim.

Audit every NetScaler ADC or Gateway configured as a Gateway or AAA virtual server; only customer-managed appliances are affected, cloud-managed services are patched by the vendor, and EOL 12.0/13.0 builds have no fix at all, so those appliances need replacement, not patching. There are no mitigations and WAF signatures do not close the hole, so upgrade to the fixed builds (the vendor blog names 14.1 47.46 and 13.1 59.19, warning that a post-upgrade CSP header change can break DUO, SAML, or custom IDP login pages), then kill all sessions, since old tokens survive the patch. Hunt in Gateway and AAA authentication logs for one session token served to multiple client fingerprints or geographically impossible movement, and keep the 85-day math in mind when choosing the window to review. Citrix distributes limited IoCs through customer support, publishes the CTX694799 recovery runbook, and offers file integrity monitoring through NetScaler Console; ransomware.live additionally lists 30 Anubis IoCs, 25 MD5 hashes and 4 IP addresses, for blocklist and retro-hunt use. Since the victim's backups were encrypted, verify at least one immutable, offline copy exists outside the reach of whatever credentials the intruder held.

Watch for two moves. First, publication of the claimed 530 GB / 335,093-file set on Anubis's leak site, or a countdown against Interim Healthcare, the escalation pattern the group used at Brockton Hospital. Second, any CISA, Citrix, or forensic telemetry clarifying how CVE-2025-5777 was used here, because the interview is the attacker's own account, Citrix saw no exploitation evidence at disclosure, and a confirmed initial-access method would turn every unpatched or EOL NetScaler into a priority incident.