Anubis Ransomware: Cloudflare Tunnels & MeshCentral Weaponization

Mjolnir Security's MTAC threat intelligence sensors and darknet monitoring infrastructure have identified 3,636 events across threat feed indicators and darknet netflow analysis confirming active Anubis ransomware infrastructure. Originally codenamed "Sphinx," Anubis has evolved into one of the most dangerous RaaS operations of 2026 by weaponizing Cloudflare Quick Tunnels for C2, MeshCentral for persistence, and DNS exfiltration via the operator handle "supersonic" on the RAMP and XSS underground forums.

Overview & Origins

The Anubis ransomware-as-a-service (RaaS) operation emerged in December 2024 under the codename "Sphinx" before being rebranded as Anubis in late 2024. MTAC sensors detected DNS lookups to legacy domains billing2.sphinx.ltd and email.sphinx.ltd, indicating the original infrastructure has not been fully decommissioned and continues to operate in parallel with the Anubis-branded systems — providing operational redundancy.

Anubis represents a new class of threat that combines traditional file encryption with destructive wiper capabilities. Unlike conventional ransomware that solely encrypts data for extortion, Anubis operators can deploy a /WIPEMODE flag that irrevocably destroys data — transforming what begins as a financial crime into a potentially destructive attack against critical infrastructure.

Operational Profile

• Victims: Nearly 60 organizations compromised as of early 2026
• Targeting: Healthcare, construction, and hospitality sectors across the United States, Canada, Australia, and Peru
• Encryption: ECIES (Elliptic Curve Integrated Encryption Scheme) — files renamed with .anubis extension
• Dual capability: Encryption mode (standard ransomware) and /WIPEMODE (destructive wiper)
• Operators: "supersonic" on RAMP forum, "Anubis__media" on XSS — Russian-speaking
• Model: RaaS — affiliates handle initial compromise; operators provide malware, leak site, and negotiation

Mobile Malware Component

MTAC sensors detected 3zer0.com tagged as "android anubis (malware)" across 66 events, indicating Anubis operators maintain a mobile malware component — likely used for credential harvesting and MFA bypass during initial access operations.

Cloudflare Tunnel Weaponization

The largest category of events detected by MTAC sensors — 427 events — involves the abuse of Cloudflare's tunnel infrastructure. This represents the most significant operational security technique employed by Anubis, transforming legitimate, encrypted cloud infrastructure into an impenetrable C2 channel.

How Cloudflare Tunnels Are Weaponized

• No inbound ports needed: The tunnel initiates from inside the network, bypassing all perimeter firewalls
• Encrypted by default: All traffic is TLS-encrypted and appears as legitimate Cloudflare traffic
• Free Quick Tunnels: trycloudflare.com subdomains require no account — fully disposable
• Legitimate binary: cloudflared.exe is signed by Cloudflare and passes most allowlisting controls
• SMB tunneling: Attackers tunnel SMB (port 445) through the encrypted channel for mass data exfiltration

Active C2 Endpoints

Fake Cloudflare Verification Domains

MTAC sensors detected domains impersonating Cloudflare's verification infrastructure using the cloudflare-verify pattern to socially engineer victims into completing fake security checks:

• bearsloveeggropryuqr.cloudflare-verify.ud-rap-prod-test-001.xyz
• 65boutiquuqr.cloudflare-verify.ud-rap-prod-test-00ae-verify.ud-rap-prod-test-001.xyz

Executable Renaming Evasion

Operators routinely rename cloudflared.exe to blend with legitimate system processes: svchost.exe, WGUpdater.exe, AdobeUpdater.exe, MicrosoftUpdate.exe. Once renamed and installed as a Windows service, the tunnel operates indefinitely with SYSTEM-level privileges, surviving reboots.

Other Ransomware Groups Using Cloudflared

MeshCentral: The Open-Source Weapon

MTAC sensors detected 44 events associated with MeshCentral and MeshAgent activity. MeshCentral is a full-featured, open-source remote device management platform — and its legitimacy makes it one of the most dangerous tools in the ransomware operator's arsenal. Industry data indicates that 30% of MDR incidents in 2024–25 involved the abuse of legitimate RMM tools.

Why Ransomware Groups Choose MeshCentral

• Full source code availability: Operators can customize the agent to evade detection signatures
• Complete remote access: File transfer, terminal access, screen sharing, and remote desktop
• Agent-based persistence: MeshAgent installs as a service and survives reboots
• Command execution: win-console and win-dispatcher provide full command-line access
• Self-hosted: Operators run their own MeshCentral server — no third-party logs

MeshCentral IOCs

The "supersonic" Connection

MTAC sensors detected 12 events linking directly to infrastructure controlled by the Anubis operator known as "supersonic" on the RAMP underground forum. This provides a direct technical link between sensor-detected infrastructure and a known ransomware operator persona.

DGA-Like Subdomain Infrastructure

The .alpha subdomain indicates development/testing; .delta indicates production deployment. The 25+ character random prefixes exhibit characteristics of DGA output or, more likely, encoded data being exfiltrated via DNS queries. Each DNS query can exfiltrate approximately 200 bytes of encoded data — bypassing virtually all data loss prevention controls.

"Supersonic" is the documented forum handle of Anubis operators on RAMP. The operator also maintains a presence on XSS as "Anubis__media." Posts are written in Russian and advertise Anubis RaaS capabilities to potential affiliates.

Attack Chain Reconstructed

Phase 1: Initial Access

Victims are compromised through phishing campaigns using COVID-themed lures, fake Adobe/Flash updates, and fake Cloudflare verification pages. The 3zer0.com mobile malware component may intercept MFA tokens.

Phase 2: Persistence via MeshCentral

Operators deploy a customized MeshAgent that installs as a system service, connecting back to operator-controlled MeshCentral servers hosted on GCP or behind DuckDNS dynamic domains. The win-console and win-dispatcher modules provide command-line access for reconnaissance and lateral movement.

Phase 3: C2 & Exfiltration via Cloudflare Tunnels

Operators establish Cloudflare Quick Tunnels using disposable trycloudflare.com subdomains. The WordPress-based C2 panel manages the operation. SMB (port 445) is tunneled through the encrypted Cloudflare connection for mass file exfiltration — invisible to network-level detection.

Phase 4: DNS Exfiltration via supersonic.ai

High-value data such as encryption keys, credentials, and configuration files are exfiltrated via DNS queries to DGA-generated subdomains under supersonic.ai. This backup exfiltration channel operates independently and is virtually undetectable without specialized DNS monitoring.

Phase 5: Ransomware Deployment

With data exfiltrated and the threat of a leak established, operators deploy the Anubis encryptor. Files are encrypted using ECIES and renamed with the .anubis extension. In cases where maximum damage is desired, the /WIPEMODE flag is activated — rendering all data irrecoverable.

Darknet Netflow Analysis

MTAC's darknet monitoring infrastructure recorded 3,031 network flow sessions over 13 months (April 2025 — April 2026) involving Anubis-associated infrastructure. After filtering relay infrastructure, 1,190 sessions reveal direct communication with identifiable threat infrastructure.

Key Findings

• Email exfiltration: 482 sessions on port 993 (IMAPS) to 92.243.7.212 (Gandi SAS, France) — sustained intelligence collection or victim negotiation infrastructure
• Cloudflare-fronted C2: 100 sessions across Cloudflare IPs (104.21.81.221, 172.67.170.97, 104.21.28.56) confirming Quick Tunnel behavior
• GCP traffic: 16 sessions to 35.220.178.96 (Google Cloud) — consistent with GCP-hosted MeshCentral instances
• DNS dominance: Port 53 (DNS) accounted for 1,318 sessions (43%) — far exceeding legitimate resolution, confirming DNS exfiltration

Infrastructure IP Addresses

Indicators of Compromise

MITRE ATT&CK Mapping

Detection & Recommendations

Cloudflare Tunnel Detection

• Block trycloudflare.com: Quick Tunnels are free and disposable — there is rarely a legitimate business need for them
• Detect cloudflared process execution: Use hash-based detection, certificate verification, and behavioral analysis of outbound QUIC connections to Cloudflare edge IPs regardless of filename
• Monitor service installations: Alert on new Windows services establishing persistent outbound connections to Cloudflare IP ranges (104.16.0.0/12, 172.64.0.0/13)
• Inspect cloudflare-verify domains: Any domain containing "cloudflare-verify" that does not resolve to Cloudflare's actual IP ranges is malicious

MeshCentral / RMM Detection

• Inventory authorized RMM tools: Maintain a strict allowlist; any MeshAgent installation not on the approved list should trigger immediate investigation
• Monitor for MeshAgent indicators: Watch for meshagent process names, connections to *.mesh.* domains, and duckdns.org DNS resolutions
• Block unauthorized DuckDNS: Unless specifically required, block all *.duckdns.org resolution — it is overwhelmingly used for malicious C2
• Patch CVE-2025-30406: Gladinet CentreStack exploitation leads directly to MeshCentral deployment

DNS Monitoring

• Monitor for supersonic.ai resolution: Any DNS query to *.supersonic.ai with long, random-looking subdomains should be treated as a confirmed compromise indicator
• Detect DNS exfiltration: Implement DNS query length monitoring — queries with subdomain labels exceeding 20 characters are statistically anomalous
• Log all DNS queries: Passive DNS logging is the single most effective detection mechanism for the techniques documented in this report

Network Segmentation

• Segment critical data: Ensure ransomware cannot reach backup systems, domain controllers, or file servers from standard user networks
• Block outbound SMB: Block SMB (port 445) from traversing network boundaries — primary protocol used for tunnel-based exfiltration
• Implement zero-trust: Require continuous authentication and authorization for all resource access

How Mjolnir Security Can Help