Anubis Ransomware Hits Coca-Cola's Fairlife, Steals Data

Originally published on CyberNetSec.

Executive Summary

On July 27, 2026, The Coca-Cola Company confirmed that its dairy subsidiary, Fairlife, suffered a ransomware attack that involved data exfiltration by an unauthorized third party. The attack, claimed by the Anubis ransomware-as-a-service (RaaS) group, led to a temporary suspension of operations at Fairlife's U.S. manufacturing plants. The threat actors claim to have stolen 1 TB of data. While Coca-Cola has restored most production capacity and does not anticipate a material financial impact, the incident underscores the significant operational disruption and data security risks posed by modern ransomware campaigns, particularly those targeting the manufacturing and food and beverage sectors.

Threat Overview

The incident was first disclosed in a Form 8-K filing on July 16, 2026, after Fairlife was forced to halt production. The subsequent confirmation on July 27 revealed the data theft component of the attack. The Anubis group, which has claimed responsibility, is a known RaaS operator that employs a multi-faceted extortion model. This includes traditional file encryption, data theft for double extortion, and selling network access to other threat actors. Security researchers note that Anubis has previously leveraged stolen credentials and exploited critical vulnerabilities like CitrixBleed2 (CVE-2025-5777) for initial access (T1190). The attack on Fairlife disrupted its four U.S. plants, though its Canadian operations were unaffected.

Technical Analysis

The attack on Fairlife followed a typical double-extortion ransomware playbook:

1. Initial Access: While the specific vector for this attack is unconfirmed, Anubis's known TTPs suggest it was likely through stolen credentials (T1078) purchased from an initial access broker or exploitation of a public-facing vulnerability like CitrixBleed2.
2. Execution & Persistence: Once inside, the actors likely used tools like Cobalt Strike to establish a foothold and maintain persistence.
3. Discovery & Lateral Movement: The attackers would have performed network reconnaissance to identify high-value targets, such as file servers, databases, and domain controllers. Lateral movement was likely achieved using techniques like Remote Desktop Protocol (T1021.001).
4. Collection & Exfiltration: Before deploying the ransomware, the actors collected and exfiltrated approximately 1 TB of data (T1567.002) to an actor-controlled server. This data is then used as leverage in extortion demands.
5. Impact: Finally, the Anubis ransomware payload was deployed across the network, encrypting servers (T1486) and causing the production shutdown.

Impact Assessment

The primary impact was the temporary suspension of production across Fairlife's U.S. facilities, representing a significant operational disruption. Although Coca-Cola stated that product availability was not materially affected due to existing inventory, a prolonged shutdown could have had severe supply chain consequences. The theft of 1 TB of data poses a long-term risk, as it could contain sensitive intellectual property, employee PII, financial records, or customer information. While Coca-Cola does not expect a material financial impact, the costs associated with incident response, system restoration, and enhanced security measures will be substantial. The incident also causes reputational damage and highlights the vulnerability of critical manufacturing supply chains.

IOCs — Directly from Articles

The source articles mention CitrixBleed2 (CVE-2025-5777) as a past entry vector for the Anubis group, but no specific IOCs for the Fairlife attack have been released.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns that could indicate Anubis-related activity:

Type	Value	Description
URL Pattern	/oauth/idp/logout.html	Associated with CitrixBleed2 exploitation attempts against NetScaler ADC and Gateway appliances.
Process Name	msiexec.exe, rundll32.exe	Often used by ransomware operators to launch malicious payloads or perform lateral movement.
Network Traffic Pattern	Outbound connections to known TOR exit nodes or budget hosting providers.	Frequently used for C2 communications and data exfiltration.
Log Source	VPN authentication logs	Look for multiple failed login attempts followed by a successful login from an unusual location, indicating credential stuffing or theft.

Detection & Response

• Monitor for Citrix Vulnerabilities: Actively scan for and monitor Citrix NetScaler ADC and Gateway appliances for signs of compromise related to CitrixBleed2 or other vulnerabilities. Use Network Traffic Analysis to look for anomalous traffic patterns from these devices.
• Detect Lateral Movement: Monitor for unusual RDP sessions between workstations and servers, or server-to-server. Use EDR tools to detect the use of tools like PsExec or suspicious use of wmic.
• Behavioral Analysis: Implement EDR rules that detect common ransomware behaviors, such as the rapid modification or deletion of files, disabling of security services, or deletion of volume shadow copies (vssadmin delete shadows). This aligns with D3-PA: Process Analysis.
• Data Exfiltration Alerts: Configure alerts for large volumes of data being transferred out of the network, especially from file servers or database servers, to unknown destinations.

Mitigation

• Patch Management (M1051): Prioritize patching of internet-facing appliances like Citrix gateways. The exploitation of known vulnerabilities remains a primary access vector for ransomware groups.
• Network Segmentation (M1030): Segment the IT network from the Operational Technology (OT) network to prevent a ransomware attack on corporate systems from impacting production lines. Isolate critical servers in secure zones.
• Immutable Backups: Maintain offline, immutable backups of critical data and systems. Regularly test restoration procedures to ensure a swift recovery from a destructive attack.
• Credential Hardening: Enforce Multi-factor Authentication (M1032) for all remote access and privileged accounts. Implement a Strong Password Policy to defend against brute-force and password spraying attacks.