RMM-ber this ransomware.

Arctic Wolf Labs details a series of 2026 Anubis ransomware intrusions where affiliates gained initial access via stolen VPN credentials and exploitation of CitrixBleed 2, then blended into legitimate IT activity by deploying RMM tools, using RDP and PsExec for lateral movement, stealing credentials, and establishing tunnels/proxies for persistence and exfiltration, with the research outlining detectable TTPs defenders can interrupt before encryption.