The Anubis ransomware-as-a-service operation has listed Leadec on its data leak site. Leadec is a Stuttgart-based industrial services provider that supports production lines for automotive, aerospace, electronics and food manufacturers. The group says it stole corporate documents, employee information and material belonging to Leadec's industrial clients. The amount of data depends on where you look: more than 2 TB in Anubis's public post, and 4 TB in negotiation chats obtained by SuspectFile. The same chats show an opening demand of $6 million that later dropped to $1.5 million. Leadec has not made a public statement. No regulator filing, vendor advisory or CERT notice was among the sources for this brief, and every source here is third-party reporting on the group's own claims. The chats support the claim that a negotiation took place and what was demanded. They do not independently prove how much data was taken or what it contains.
What Happened
Anubis added Leadec (leadec-services.com) to its leak site on October 7, 2026. ThreatMon's monitoring, as reported by Undercode News, logged the listing at 23:02:43 UTC+3 that day. DeXpose, which describes Leadec as a German engineering firm, recorded the same date and quoted the group's taunt: "Will they allow this leak to happen?"
SuspectFile published the most detailed account on October 18, 2026. It said it had seen the negotiation conversation between Anubis and the victim. In that chat the demand started at $6 million and later came down to $1.5 million. SuspectFile asked Leadec for comment and had no reply by publication. As of this brief, no source shows Leadec confirming or denying an intrusion, encryption, or any effect on operations.
Leadec matters because of what it does. The company was founded in 1962, has about 22,500 employees at more than 380 locations in 16 countries, and reported revenue above €1.35 billion in 2025, according to SuspectFile. Private equity firm Triton has owned it since 2016. Its services include machinery installation and relocation, plant maintenance, automation, production IT, technical cleaning, facility management and logistics, much of it carried out inside customer factories.
What Was Taken
The sources disagree on volume, and the gap is unexplained:
- More than 2 TB: the figure in Anubis's public leak-site post (SuspectFile).
- 4 TB: the figure in the negotiation chat (SuspectFile).
SuspectFile itself says the two numbers should be kept separate because nothing available accounts for the difference. Neither figure has been verified.
The categories Anubis claims are corporate documents, employee information, and material relating to industrial clients. Leadec works on production IT, automation and plant layout for its customers, so client-related data could include technical drawings, site and facility details, and operational information about third-party manufacturing plants. That is an inference from the type of business. No source has described specific files. Undercode News stresses that a leak-site listing does not, by itself, prove compromise, exfiltration, encryption, data volume or data type.
Why It Matters
Supply chain exposure. An attack on a contractor that works inside many customer plants affects more than one company. If Leadec's data includes customer site documentation, remote-access arrangements or production IT details, then automotive and aerospace manufacturers face risk through their supplier without being breached themselves.
Anubis is active and getting more capable. DailySecu, summarising Arctic Wolf research, reports that Anubis emerged in late 2024 as a rebrand of Sphinx ransomware. It began recruiting on the RAMP forum in February 2025 and offers affiliates up to 80% of ransom proceeds. It had posted more than 90 victims on Ransomware Live by mid-2026, including 11 in June 2026 alone. Its victims are mostly in healthcare, business services, manufacturing, IT and finance, and more than half are US-based. A large German industrial target fits the manufacturing focus and extends the group's European reach.
Paying may not get the data back. Rubrik Zero Labs, cited by DailySecu, documented a "wipe mode" in Anubis that leaves file names in place but reduces their contents to 0 KB. In those cases data cannot be recovered whether or not the ransom is paid.
The demand followed the group's usual pattern. SuspectFile's report on Interim HealthCare (September 2026) showed Anubis reducing its demand from $850,000 to $500,000. The Leadec drop from $6M to $1.5M is a 75% cut, which suggests opening demands are anchors for negotiation rather than fixed prices.
The Attack Technique
For Leadec, the initial access method is not known. No source says how Anubis got into Leadec's network. What follows describes the group's documented methods in other incidents. It is not confirmed for this one.
- Initial access: Arctic Wolf (via DailySecu) attributes 2026 Anubis intrusions to stolen VPN credentials, including Cisco AnyConnect accounts, and to exploitation of CitrixBleed 2 (CVE-2025-5777, CVSS 9.3). That flaw is a memory over-read in Citrix NetScaler ADC and Gateway that can bypass authentication. Threadlinqs (medium-confidence attribution) and Anubis's own statements to SuspectFile in the Interim HealthCare case both name CitrixBleed 2 as the entry point. Threadlinqs also ties the vector to the Fairlife attack, where the group claimed about 1 TB and production stopped at all four US plants, with most back up within 11 days. Threadlinqs warns that patching does not invalidate session tokens stolen before the fix was applied.
- Lateral movement: RDP and SMB, with PsExec used for remote execution and credential theft (Arctic Wolf via DailySecu).
- Persistence through legitimate tools: Threadlinqs lists MeshAgent, ScreenConnect, Remotely, PuTTY and Total Software Deployment, plus Cloudflare Tunnels for encrypted outbound channels.
- Exfiltration: Rclone and S3 Browser (Threadlinqs).
- Defense evasion: disabling Windows Defender real-time protection, attempting to remove Sophos, using PCHunter, clearing event logs, and in some cases deleting the encryptor after it runs to limit forensic evidence (Arctic Wolf via DailySecu).
- Impact: encryption of servers, NAS and hypervisors, including backup systems in the Interim HealthCare case (SuspectFile), with wipe mode available as an option.
Relying on built-in and legitimate administration tools is the main reason this activity is hard to spot. UltraViolet Cyber's October 2026 advisory on fileless techniques makes the same general point: the binaries used for normal operations are the ones attackers reuse.
What Organizations Should Do
- Patch NetScaler and then kill existing sessions. Confirm CVE-2025-5777 is remediated on every Citrix ADC and Gateway. Then terminate all active ICA and PCoIP sessions and rotate credentials, because tokens stolen before the patch still work afterwards.
- Lock down VPN access. Require phishing-resistant MFA on Cisco AnyConnect and every other remote-access gateway. Check access logs for impossible-travel logins, logins at unusual hours, and dormant accounts that suddenly become active. Assume credentials may have been bought from initial access brokers or harvested by infostealers.
- Allowlist remote management tools. Flag any MeshAgent, ScreenConnect, Remotely, Total Software Deployment or cloudflared binary that IT has not approved. Alert on new Cloudflare Tunnel connections and on Rclone or S3 Browser running on servers.
- Watch for tampering with security tools. Alert when Defender real-time protection is turned off, when EDR or AV uninstall is attempted, when PCHunter-type tools appear, or when Windows event logs are cleared. These usually happen shortly before encryption.
- Make backups immutable and keep them off the domain. Anubis has encrypted NAS and hypervisor-hosted backups, and wipe mode can destroy data outright. Keep offline or immutable copies that domain credentials cannot reach, and test restoring from them.
- Ask your industrial service providers about this. Leadec's customers, and any manufacturer with a similar embedded contractor, should ask what site documentation, credentials and network access that contractor holds. Rotate any shared or vendor-held credentials and review third-party remote access paths into production IT and OT.
Sources: Leadec Targeted by Anubis: 4 TB of Allegedly Stolen Data and an Ini... | Anubis Targets German Engineering Firm Leadec - DeXpose | Two New Ransomware Victims Reported: Leadec and Wavecrest HFA Added... | VPN부터 원격관리도구까지 악용…아누비스 랜섬웨어 공격 방식 진화 < 긴급속보 < 이슈 < 기사본문 - 데일리시큐 | India's Ambitious Battery Recycling Regulation Leads the ... | Anubis Ransomware Attack on Fairlife via Threadlinqs | Threat Advisory: The Threat of Fileless Malware | 530 GB, 335,093 Files and Encrypted Backups: Anubis Details Attack...