Two ransomware operations posted new victims roughly an hour apart in the early hours of August 11, 2026, according to leak site monitoring attributed to the ThreatMon Threat Intelligence Team and relayed by Undercode News. The Anubis ransomware group added Cleaver-Brooks, a U.S. industrial boiler and energy equipment manufacturer, at approximately 04:03:29 UTC+3. The Genesis ransomware operation added Interim HealthCare, a national home-care provider, at approximately 03:00:43 UTC+3. Neither listing carries a victim statement, a regulator filing, or a vendor advisory at the time of writing, and neither company has publicly acknowledged an incident. That places both entries in the claimed-but-unconfirmed category, which is where Undercode's own follow-up analysis put the Cleaver-Brooks case as well. What raises the confidence floor on the Anubis side is not the listing itself but the group's track record: three weeks earlier, an Anubis leak site post against Coca-Cola's Fairlife subsidiary preceded a confirmed data theft that Coca-Cola acknowledged in writing.
What Happened
The sourcing on these two listings is thin and single-threaded, and it is worth being precise about that. Both entries trace to leak site monitoring surfaced by Undercode News, an OTHER-tier outlet, citing ThreatMon telemetry. A companion Undercode piece describes the Cleaver-Brooks claim arriving through a separate channel, a post by the account Cybersecurity News Everyday on X dated August 10, alleging unauthorized access, encryption of company data, a ransom demand, and possible data exposure. The date gap between "August 10" in that post and "August 11" in the ThreatMon timestamps is a timezone artifact: the monitoring timestamps are given in UTC+3, which crosses midnight while it is still late evening in the United States.
Undercode's second article draws the distinction explicitly and correctly. Nothing in the original post established that Anubis actually compromised Cleaver-Brooks, which systems were affected, how much data was taken, or whether a ransom demand was received. Ransomware crews and the monitoring accounts that track them routinely publish claims before victims acknowledge anything, and some of those claims never hold up. Treat Cleaver-Brooks as an alleged ransomware attack.
Genesis and Interim HealthCare are thinner still. Across all eight sources reviewed, the Genesis operation appears exactly once, in the listing report itself. There is no corroborating profile of the group's tooling, affiliate structure, or prior victimology in this source set, and no independent reporting on the Interim HealthCare claim at all. Anything asserted about Genesis capability here would be invention.
Public business records identify Cleaver-Brooks as a U.S. industrial manufacturer headquartered in Thomasville, Georgia, supplying boiler-room equipment, controls, service, and maintenance.
What Was Taken
Unknown in both cases. No volume figure, no data category, no sample publication, and no victim confirmation exists for either Cleaver-Brooks or Interim HealthCare in the available reporting. The Cybersecurity News Everyday post referenced by Undercode alleges sensitive information "may have been exposed," which is a claim about possibility rather than a finding.
The useful comparison is the Fairlife case, where the same actor's claims can be measured against what the victim eventually admitted. Anubis listed Coca-Cola and Fairlife on July 20 or 21 depending on the account, BleepingComputer describing the addition as occurring Monday and SecurityWeek dating the listing to July 20, and claimed roughly one terabyte of stolen corporate data with a negotiation deadline. Coca-Cola confirmed on July 27 that the incident "involved access by an unauthorized third party to a portion of the company's systems and taking of certain data, and a temporary suspension of production operations." The company never validated the 1 TB figure or the data categories, and declined further comment to BleepingComputer. UltraViolet Cyber reports that Anubis subsequently published the data after Coca-Cola did not meet the ransom deadline.
So the pattern from the one case with a confirmed outcome is that the theft was real and the volume claim was never independently verified. SecurityWeek makes the standing caveat plainly: extortion crews commonly exaggerate the importance of what they hold to increase pressure.
Why It Matters
Anubis is a ransomware-as-a-service operation active since December 2024, when it ran under the test name "Sphinx" before rebranding, per UltraViolet Cyber's threat advisory. It recruits affiliates on Russian-language cybercrime forums with negotiable revenue splits and multiple monetization paths beyond a single ransom, including separate data extortion and access sales programs. SecurityWeek counts roughly 100 organizations listed on the group's site.
The feature that separates Anubis from its RaaS peers is an optional wiper mode capable of permanently destroying files rather than merely encrypting them. UltraViolet's takeaway is blunt: backups alone will not save you, because the wiper can destroy files after encryption, making offline immutable backups mandatory rather than advisable. In the Fairlife intrusion the actor told BleepingComputer it had encrypted the company's Nutanix systems, "leaving no possibility of recovery."
UltraViolet also notes that Anubis victims spread across unrelated sectors with no obvious geographic boundary, which points to opportunistic targeting rather than vertical specialization. That is the honest read on a boiler manufacturer and a home-care provider appearing an hour apart on different leak sites. It is not evidence of a coordinated campaign against manufacturing and healthcare. It is evidence that two independent criminal operations were running at the same time and monetized whatever access they had, and it undercuts any assumption that a given industry is inherently lower risk.
For healthcare specifically, the Fairlife case demonstrated how a mid-sized subsidiary becomes the entry point for an enterprise-wide consequence, including an SEC disclosure obligation. A parallel healthcare disclosure this summer illustrates the sector's exposure from a different angle: Clover Health told the SEC on July 17 that it had discovered anomalous login activity on July 4, and that a threat actor reached three non-managerial health plan employee accounts through social engineering. Those accounts had access to broker-facing sales functions and member visit scheduling tools, including potential personal data and protected health information, though not corporate financial systems or claims. Clover said its rapid response contained and terminated the access.
The Attack Technique
Nothing is known about the initial access vector in either the Cleaver-Brooks or the Interim HealthCare claim. For Anubis operations generally, the two vendor sources in this set emphasize different entry points and should be read together rather than as a single answer.
UltraViolet Cyber's advisory identifies spear-phishing as the group's reliance for initial access, making email and web filtering plus user training the frontline defense, and flags privilege escalation as the behavior to watch after landing. Arctic Wolf's research, published under the title "From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks," points instead toward exploitation of the CitrixBleed 2 vulnerability for access and abuse of the Cloudflare tunneling client cloudflared for persistence and command and control. Only the navigation shell of that Arctic Wolf page was retrievable for this brief, so the technical detail behind the title could not be reviewed; the tooling names are reported at title level and readers should go to the original.
The reasonable synthesis is that Anubis affiliates use more than one route in, which is normal for an affiliate model where different operators bring different access. Defenders should not build around a single vector. In the Fairlife case the actor claimed it had been inside the environment roughly a week before Coca-Cola publicly disclosed, and BleepingComputer reported Coca-Cola notified authorities on discovery and refused to follow the attacker's negotiation instructions.
What Organizations Should Do
- Make backups immutable and offline. This is the specific countermeasure to the Anubis wiper. UltraViolet's guidance is that encryption-only recovery planning fails against an actor that can destroy files afterward. Test restores; do not assume them.
- Patch internet-facing Citrix infrastructure and audit for CitrixBleed 2 exposure. Session token theft through that class of flaw bypasses password-based controls, so rotate sessions and credentials after patching rather than patching alone.
- Hunt for unauthorized cloudflared usage. Tunneling clients running on servers that have no business reason to run them are a persistence and egress channel that looks like legitimate outbound HTTPS. Alert on the binary, not just the network pattern.
- Harden identity against social engineering, including help desk paths. The Clover Health filing shows three non-managerial accounts being enough to reach protected health information. Phishing-resistant MFA, callback verification on password and MFA resets, and least privilege on broker-facing and scheduling tools all apply.
- Segment OT from IT and rehearse the manufacturing failure mode. Fairlife suspended production at four U.S. facilities. For boiler-room controls and industrial service platforms, decide in advance what gets isolated and how production continues when the corporate network is unavailable.
- Monitor for privilege escalation and lateral movement as the detection priority. Both vendor sources place the decisive window after initial access, not at it. Assume entry and instrument for the escalation that follows.
- Have the disclosure path ready before you need it. Coca-Cola filed with the SEC on July 16 and Clover Health on July 17, both while investigations were still open. Legal, regulatory, and communications workflows should be pre-drafted rather than assembled under an extortion timer.
Cleaver-Brooks and Interim HealthCare have not commented publicly. Both listings should be tracked as claims pending confirmation, and this brief will read differently if either company files or issues a statement.
Sources: Anubis and Genesis Ransomware Strike Again as Cleaver-Brooks and In... | Coca-Cola confirms data theft in Fairlife ransomware attack | Anubis ransomware claims Coca-Cola Fairlife attack, threatens data... | Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack - S... | Clover Health reveals data breach in SEC filing | Cleaver-Brooks Ransomware Breach Claimed: Anubis Attack Raises Fres... | From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind... | Threat Advisory: The Ongoing Threat of Anubis Ransomware