We correlated the AnubisSpy variants to Sphinx’s desktop/PC-targeting malware through the following:  Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx’s malware Similar targets (highly concentrated in Middle Eastern countries)     Figure 2: Comparison of file structure in Sphinx’s desktop/PC-targeting malware (left) and AnubisSpy (right)