# RMM-ber this ransomware. [Research Saturday]

Page: https://stenobird.com/podcast/cyberwire-daily-454880/rmm-ber-this-ransomware-research-saturday
Text version: https://stenobird.com/podcast/cyberwire-daily-454880/rmm-ber-this-ransomware-research-saturday.md
Podcast: [CyberWire Daily](https://stenobird.com/podcast/cyberwire-daily-454880)
Published: 2026-09-05T07:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/440/notes
Audio file: https://pdst.fm/e/pdrl.fm/85df76/traffic.megaphone.fm/CYBW7108874282.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/rmm-ber-this-ransomware-research-saturday
Duration seconds: 1191

## Resource

Ismael Valenzuela, Vice President of Labs, Threat Research and Intelligence at Arctic Wolf, sits down with Dave to discuss their work tracking Anubis. Arctic Wolf Labs details a series of 2026 Anubis ransomware intrusions, revealing affiliates using stolen VPN credentials and exploiting CitrixBleed 2 to gain initial access. Attackers then blended into legitimate IT activity by deploying RMM tools, using RDP and PsExec for lateral movement, stealing credentials, and establishing tunnels and proxies for persistence and exfiltration. The research highlights a repeatable attack chain defenders can disrupt before encryption, from suspicious remote access and unauthorized RMM deployment to credential theft, security-tool tampering, and ransomware execution. The research and executive brief can be found here: ⁠From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks Learn more about your ad choices. Visit megaphone.fm/adchoices

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/rmm-ber-this-ransomware-research-saturday/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cyberwire-daily-454880/rmm-ber-this-ransomware-research-saturday.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.