Anyrun

Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD, a company dedicated to threat intelligence and hunting, Heiner García from NorthScan, a threat intelligence initiative uncovering North Korean IT worker infiltration, and ANY.RUN, the leading company in malware analysis and threat intelligence. The article was written by Mauro and Heiner. In this article, we’ll uncover an entire North Korean infiltration operation aimed […]

The post Smile, You’re on Camera: A Live Stream from Inside Lazarus Group’s IT Workers Scheme  appeared first on ANY.RUN's Cybersecurity Blog.

 Phishing kits usually have distinct signatures in their delivery methods, infrastructure, and client-side code, which makes attribution fairly predictable. But recent samples began showing traits from two different kits at once, blurring those distinctions.  That’s exactly what ANY.RUN analysts saw with Salty2FA and Tycoon2FA: a sudden drop in Salty activity, the appearance of Tycoon indicators inside Salty-linked chains, and eventually single […]

The post Salty2FA & Tycoon2FA Hybrid: A New Phishing Threat to Enterprises  appeared first on ANY.RUN's Cybersecurity Blog.

November was a packed month for detection coverage. We rolled out new behavioral insights, broadened our visibility across multiple threat families, and strengthened rulesets at every layer. On top of that, our analysts uncovered and documented a new phishing wave targeting Italian organizations through malicious PDF attachments, now fully mapped in a dedicated TI report.  Let’s walk through […]

The post Threat Coverage Digest: New Malware Reports and 5K+ Detection Rules  appeared first on ANY.RUN's Cybersecurity Blog.

Stealers, loaders, and targeted campaigns dominated November’s activity. ANY.RUN analysts examined cases ranging from PNG-based in-memory loading used to deploy XWorm to JSGuLdr, a three-stage JavaScript-to-PowerShell loader pushing PhantomStealer.  Alongside these public cases, three Threat Intelligence Reports detailed new activity across Windows, Linux, and Android, including loader-enabled hijackers, Tor-based cryptotrojan communication, Linux ransomware in Go, MaaS stealers, and a WhatsApp-propagating campaign […]

The post Major Cyber Attacks in November 2025: XWorm, JSGuLdr Loader, Phoenix Backdoor, Mobile Threats, and More  appeared first on ANY.RUN's Cybersecurity Blog.

Alert overload is one of the hardest ongoing challenges for a Tier 1 SOC analyst. Every day brings hundreds, sometimes thousands of alerts waiting to be triaged, categorized, and escalated. Many of them are false positives, duplicates, or low-value notifications that muddy the signal.   When the queue never stops growing, even experienced analysts start losing clarity, missing […]

The post How to See Critical Incidents in Alert Overload: A Guide for SOCs and MSSPs  appeared first on ANY.RUN's Cybersecurity Blog.

In many SOCs, phishing analysis still follows the same old pattern: manually pull apart URLs, inspect attachments by hand, take screenshots, collect indicators one by one… and hope nothing slips through in the process. It’s careful work, but slow.  A sandbox flips that workflow on its head.  Every step analysts normally handle themselves is condensed into […]

The post Detected in 60 Seconds: How to Identify Phishing with a Malware Sandbox  appeared first on ANY.RUN's Cybersecurity Blog.

Some attacks smash the door open. LOLBins just borrow your keys and walk right in.  They’re tricky because tools everyone trusts suddenly start doing things that don’t match their usual job; loading odd-looking modules, decoding files that shouldn’t need decoding, or quietly handing work off to hidden PowerShell scripts. At first glance it all feels […]

The post LOLBin Attacks Explained with Examples: Everything SOC Teams Need to Know  appeared first on ANY.RUN's Cybersecurity Blog.

Scaling as a managed security provider can be a mixed blessing. Growth comes with more revenue, but also with increasingly high demands related to maintaining SLAs, quality, and compliance. For MSSPs in healthcare, this pressure is intensified by regulations like HIPAA and NIS2, along with the striking cost of a single mistake.  This was a […]

The post Healthcare MSSP Cuts Phishing Triage by 76% and Launches Proactive Defense with ANY.RUN  appeared first on ANY.RUN's Cybersecurity Blog.

How many real threats hide behind the noise your SOC faces every day?  When hundreds of alerts demand attention at once, even the best analysts start to lose focus. The nonstop pressure to react to everything drains energy, clouds judgment, and opens the door to real risk.  Teams using ANY.RUN have already flipped that script:  […]

The post Solve Alert Fatigue, Focus on High-Risk Incidents: An Action Plan for CISOs  appeared first on ANY.RUN's Cybersecurity Blog.

Eric Parker, a recognized cybersecurity expert, has recently released a video on ClickFix attacks, their detection, analysis, and gathering threat intelligence. Here is our recap highlighting the key points and practical advice. ClickFix as the Signature Threat of 2025 In 2025 the internet saw a sharp surge in a deceptively simple but highly effective social-engineering […]

The post ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers  appeared first on ANY.RUN's Cybersecurity Blog.

Big news from the ANY.RUN team; we’ve just been named the 2025 “Trailblazing Threat Intelligence” winner at the Top InfoSec Innovators Awards!  This recognition means a lot to us because it celebrates what we care about most: helping analysts, SOC teams, and researchers access live, actionable threat intelligence that makes a real difference in investigations […]

The post ANY.RUN Wins Trailblazing Threat Intelligence at the 2025 Top InfoSec Innovators Awards appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN’s malware analysis and threat intelligence products are used by 15K SOCs and 500K analysts. Thanks to flexible API/SDK and read-made connectors, they seamlessly integrate with security teams’ existing software to expand threat coverage, reduce MTTR, and streamline performance.  Here’s how ANY.RUN’s solutions can transform your security.  Interactive Sandbox: Detect Evasive Phishing & Malware  ANY.RUN’s […]

The post Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More  appeared first on ANY.RUN's Cybersecurity Blog.

October brought another strong round of updates to ANY.RUN, from a new ThreatQ integration that connects our real-time Threat Intelligence Feeds directly into one of the industry’s leading TIPs, to hundreds of new signatures and rules that sharpen network and behavioral detection.  With 125 new behavior signatures, 17 YARA rules, and 3,264 Suricata rules, analysts can now spot emerging threats […]

The post Release Notes: ANY.RUN & ThreatQ Integration, 3,000+ New Rules, and Expanded Detection Coverage  appeared first on ANY.RUN's Cybersecurity Blog.

Each cyberattack leaves behavioral evidence. A malware sandbox provides the secure environment analysts need to study that activity and uncover hidden tactics.  Teams using sandbox analysis report measurable gains:  Behavior-based visibility gives SOCs the upper hand against stealthy attacks. Let’s see how sandbox security works, and why it has become essential for modern threat detection.  […]

The post What is a Malware Sandbox? Everything SOC Analysts and CISOs Need to Know  appeared first on ANY.RUN's Cybersecurity Blog.

Phishing campaigns and ransomware families evolved rapidly this October, from fake Google Careers pages and ClickUp redirect chains to Figma-hosted credential theft and LockBit’s move into ESXi and Linux systems. ANY.RUN analysts also uncovered TyKit, a reusable phishing kit hiding JavaScript inside SVG files to steal Microsoft 365 credentials across multiple sectors.  Each of these […]

The post Major Cyber Attacks in October 2025: Phishing via Google Careers & ClickUp, Figma Abuse, LockBit 5.0, and TyKit  appeared first on ANY.RUN's Cybersecurity Blog.

No SOC is perfect, but it’s possible to overcome frequent shortcomings and achieve measurable results by introducing one essential component of modern cybersecurity operations: threat intelligence.  Organizations using ANY.RUN’s TI solutions report the following results:  Quality, real-time threat intelligence helps SOCs tackle their toughest challenges. More on that below.  #1. Low Detection Rates  As attackers […]

The post 5 SOC Challenges and How Threat Intelligence Solves Them  appeared first on ANY.RUN's Cybersecurity Blog.

Here at ANY.RUN, we know how crucial threat intelligence is for ensuring strong cybersecurity, especially in organizations.  This year, our efforts in promoting this data-driven approach to solving the needs of businesses were praised at CyberSecurity Breakthrough Awards. ANY.RUN was recognized as the Threat Intelligence Company of the Year 2025.  New Milestone on the Way […]

The post ANY.RUN Recognized as Threat Intelligence Company of the Year 2025   appeared first on ANY.RUN's Cybersecurity Blog.

Fresh, actionable IOCs from the latest malware attacks are now available to all security teams using the ThreatQ TIP. ANY.RUN’s Threat Intelligence Feeds integrate seamlessly with the platform, enabling SOCs and MSSPs to boost detection rates, expand threat coverage, and streamline response.   Here’s how you can benefit from it.  Real-Time Visibility of the Current Threat […]

The post ANY.RUN & ThreatQ: Boost Detection Rate, Turbocharge Response Speed  appeared first on ANY.RUN's Cybersecurity Blog.

 A SOC is where every second counts. Amidst a flood of alerts, false positives, and ever-short time, analysts face the daily challenge of identifying what truly matters — before attackers gain ground.  That’s where alert triage comes in: the essential first step in detecting, prioritizing, and responding to threats efficiently. Done right, it defines the […]

The post No Threats Left Behind: SOC Analyst’s Guide to Expert Triage  appeared first on ANY.RUN's Cybersecurity Blog.

Not long ago we reported a spike in phishing attacks that use an SVG file as the delivery vector. One striking detail was how the SVG embeds JavaScript that rebuilds the payload with XOR and then executes it directly via eval() to redirect victims to a phishing page.  A quick look at the indicators we […]

The post Tykit Analysis: New Phishing Kit Stealing Hundreds of Microsoft Accounts in Finance  appeared first on ANY.RUN's Cybersecurity Blog.