Ransomware: anubis named Leadec (DE)

1. Executive summary

The ransomware group tracked as anubis listed Leadec, a German industrial services provider, on its leak site on 2026-10-07. The listing carries no technical detail: no initial-access vector, no malware family, no sample, no exfiltration volume, and no proof-of-data screenshot in the indexed record. anubis has no MITRE ATT&CK profile in our verified reference data, so the group's identity, sponsorship and tradecraft remain unconfirmed; the only corroborated fact is the leak-site post itself. For EMEA financial services the direct exposure is indirect but real: Leadec is a German industrial services firm, and any client or counterparty relationship that places Leadec inside a financial institution's ICT supply chain pulls this into third-party risk scope. The bottom-line risk is low for most clients and moderate for any that contract Leadec directly, because the listing is a claim of compromise, not evidence of one.

2. Regulatory framing

No other article in the regulatory reference is engaged. DORA Art. 17, 18, 19, 24, 29 and 30 and NIS2 Art. 23 are not triggered by a leak-site listing alone: there is no confirmed incident at a client, no confirmed major incident, no testing obligation, no concentration finding, no contractual gap and no client-side reporting event in the source material. If a client confirms its own Leadec dependency is compromised, Art. 17, 18 and 19 and NIS2 Art. 23 become live and should be assessed at that point.

3. Technical analysis & attack chain

The source material does not support an attack chain. The indexed record contains a group name, a victim name, a country code and a publication timestamp. There is no initial-access vector, no exploited component or CVE, no payload, no persistence mechanism, no command-and-control, no lateral movement, no data-access description and no observed impact beyond the listing itself.

What is confirmed:

1. anubis posted Leadec to its leak site on 2026-10-07 at 16:54 UTC.
2. The listing is indexed by ransomware.live, which states it does not acquire, download, host or redistribute the underlying stolen data and indexes only publicly visible operator posts.
3. No leak screenshot, sample, hash, domain, IP or file artefact accompanies the record.

Everything else is unconfirmed. The group's identity, its tooling, whether data was actually exfiltrated, whether encryption occurred, and whether Leadec has acknowledged the event are all absent from the source. The listing itself is a single-source claim by the operator, republished by an indexer; it is not corroborated by a Leadec statement, a regulator, or a second vendor. Treat the compromise as asserted, not established.

Context from related anubis listings in the same indexer corpus shows a pattern of German and French professional-services and financial-adjacent victims: Nachlass Nord (DE, inheritance law, described as exposing IDs, estate records and client data), Gaedke & Partner Steuerberatung (DE, accounting, described as exposing client data), and Prelys Courtage (FR, mortgage brokerage, described as a client data breach). These are indexer descriptions, not verified technical findings, and they are single-sourced. They suggest anubis targets firms holding client personal and financial records, which is the reason this listing matters to financial services clients even where Leadec is not a direct supplier. Do not treat the pattern as an established targeting profile; it rests on one indexer's summaries.

4. Mitigation & containment

P1 within 24h

• Determine whether Leadec appears anywhere in your ICT third-party register, including as a subcontractor to a named supplier. If it does, contact the relationship owner and request Leadec's incident status in writing. Do not rely on the leak-site listing as confirmation.
• If Leadec is a direct supplier, suspend non-essential data flows to and from Leadec until its status is confirmed, and review any shared credentials, VPN tunnels, SFTP endpoints or API integrations for exposure.
• Check whether any Leadec-issued or Leadec-shared credentials exist in your environment (service accounts, shared mailboxes, file-transfer accounts) and rotate them.

P2 within 72h

• For any client with a Leadec dependency, run a targeted review of the DORA Art. 28 third-party risk record for that supplier and confirm the contractual incident-notification clause is being exercised.
• Where Leadec is a material dependency, assess whether the relationship meets the NIS2 Art. 21(2)(d) supply chain security threshold and document the assessment.
• Monitor for credential-stuffing and business email compromise attempts referencing Leadec staff or domains, since professional-services victims in this corpus are described as exposing client records.

P3 within 7 days

• If Leadec confirms a breach affecting your data, move to your DORA Art. 17 incident management process and assess classification under Art. 18.
• Add Leadec to the watch list for the next third-party risk cycle and record the outcome of this review, including the fact that the trigger was an unverified leak-site listing.

No vendor fix, patch or version pin applies. There is no CVE in this item.

5. Indicators of compromise

No indicators of compromise available in the source material. The indexed record contains no hash, domain, IP, URL, file path, registry key or sample. The only observable is the leak-site listing itself, which is a publication event, not a machine-pivotable artefact.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text or hard-coded values. The only named entities are the group and victim names, which are reporting artefacts, not threat artefacts, and would produce rules that detect coverage of the event rather than the event itself. No YARA or Sigma rule is emitted.

7. Sources

• ransomware.live, "Ransomware: anubis named Leadec (DE)", https://www.ransomware.live/id/TGVhZGVjQGFudWJpcw==, published 2026-10-07
• ransomware.live, "Ransomware: anubis named Nachlass Nord (DE)", https://www.ransomware.live/id/TmFjaGxhc3MgTm9yZEBhbnViaXM=, undated in source
• ransomware.live, "Ransomware: anubis named Gaedke & Partner Steuerberatung (DE)", https://www.ransomware.live/id/R2FlZGtlICYgUGFydG5lciBTdGV1ZXJiZXJhdHVuZ0BhbnViaXM=, undated in source
• ransomware.live, "Ransomware: anubis named Prelys Courtage (FR)", https://www.ransomware.live/id/UHJlbHlzIENvdXJ0YWdlQGFudWJpcw==, undated in source
• ransomware.live, "Ransomware: bravox named MITC AG (CH)", https://www.ransomware.live/id/TUlUQyBBR0BicmF2b3g=, undated in source (separate group, included for corpus context only)

8. Adverse Trace position

We assess this as a low-severity item for the EMEA financial services client base, rising to moderate only where Leadec is a direct or material ICT supplier. The listing is a single-source operator claim republished by an indexer, with no technical corroboration, no sample and no data evidence; anubis has no MITRE ATT&CK profile in our reference data, so we treat the group's identity and tradecraft as unconfirmed and will not attribute capability to it. We will monitor for a Leadec statement, a regulator notification, or a second independent source, and we will reissue this advisory if any of those appear or if anubis publishes data samples. Clients that contract Leadec directly should treat the P1 supplier-status check as the immediate action and report back so we can scope the exposure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.