Anyrun

July brought another set of threat coverage updates designed to help security teams work faster and with more confidence. ANY.RUN added 42 behavior signatures, 11 YARA rules, and 703 Suricata rules, giving SOCs broader visibility across files, malware behavior, and network activity.  We also published new threat intelligence and technical research on active malware and phishing campaigns. […]

The post Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules appeared first on ANY.RUN's Cybersecurity Blog.

Cyber risk is increasing, but so is the cost of managing it. More than 514,000 cybersecurity job listings appeared in the US between May 2024 and April 2025, while the mean annual wage for an information security analyst reached $132,510.  Even after the budget is approved, hiring can take three to six months, with additional time […]

The post The US CFO’s Playbook: How to Reduce Cyber Risk Without Scaling SOC Team in a Tight Labor Market appeared first on ANY.RUN's Cybersecurity Blog.

Email gateways, endpoint controls, and file-centric sandboxing remain essential layers of defense. But many of today’s phishing attacks unfold in ways they weren’t designed to fully expose.  How do you build resilience against modern phishing if it has outgrown your SOC’s investigation workflows? Rethinking Phishing Investigations in Modern SOCs  While initial investigation workflows were designed around malicious files and processes, […]

The post Building Resilience Against AiTM Phishing: What SOC Leaders Should Know appeared first on ANY.RUN's Cybersecurity Blog.

SOCs face constant pressure to detect and respond to threats faster. Heavy workloads, limited threat visibility, and disconnected tools can delay action, increasing the risk of financial loss and operational disruption.  ANY.RUN helps more than 15,000 security teams reduce these delays with fresh threat intelligence, interactive analysis, contextual enrichment, and analyst-curated reporting.  Here’s how your SOC can handle incidents more […]

The post Faster Incident Response: How ANY.RUN Helps SOCs Cut MTTR by Up to 21 Minutes per Case appeared first on ANY.RUN's Cybersecurity Blog.

Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code.  This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 […]

The post Kali365 Targets US Organizations with Data Theft via Device Code Phishing  appeared first on ANY.RUN's Cybersecurity Blog.

An original threat intelligence investigation uncovering how trusted government infrastructure became an attack channel, placing banking organizations and public-sector systems at risk while revealing previously undocumented infrastructure relationships and actionable mitigation guidance for security leaders.  ANY.RUN analysts have uncovered an active PhantomEnigma campaign abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. Trusted emails and legitimate […]

The post Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware  appeared first on ANY.RUN's Cybersecurity Blog.

Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the US, Europe, and other regions. By combining trusted platforms, anti-bot checks, and convincing login pages, ithelps attackers steal credentials while delaying detection and response. For security leaders, that increases the risk of account takeover, fraud, data exposure, and higher incident response costs. ANY.RUN […]

The post ​​Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk​ appeared first on ANY.RUN's Cybersecurity Blog.

State of Cybersecurity in the US  American organizations are processing more malware submissions than ever, and the mix keeps shifting under their feet. Phishing kits that hijack multi-factor authentication now sit alongside decades-old ransomware, commodity RATs sold for the price of a streaming subscription, and loaders built to slip payloads past EDR undetected. For CISOs […]

The post US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data appeared first on ANY.RUN's Cybersecurity Blog.

Cybersecurity programs often grow over time through new policies, controls, and technologies. The challenge for CISOs is making sure these pieces work together and support the risks that matter most to the business.  NIST CSF 2.0 provides a practical structure for doing that. It helps US organizations understand their current security posture, define clear priorities, and […]

The post NIST CSF 2.0 Practical Guide: Building a Modern Security Program for Risk Management in the US Companies appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to […]

The post Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN  appeared first on ANY.RUN's Cybersecurity Blog.

Phishing pages don’t sit still anymore. They redirect, load scripts, harvest credentials through dynamic forms, and rebuild their DOM after the initial load — and most URL analysis workflows still only see the finish line, not the race. This June, ANY.RUN closed that gap directly inside the Interactive Sandbox and extended its automation reach with […]

The post Release Notes: In-Browser Data Inspection, Torq Integration, and 1,100+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

For a US automotive manufacturer working with more than 200 active vendors, supplier file intake had become a growing security and cost challenge. That pressure is especially high in manufacturing, where SOC teams carry an average workload 18% higher than teams in other industries. By introducing behavioral sandboxing and threat intelligence, the company made triage […]

The post Closing the Supplier Security Gap: How a US Manufacturer Cut Third-Party Risk and Doubled SOC Triage Speed appeared first on ANY.RUN's Cybersecurity Blog.

Lack of alert context makes it difficult for Security Operations Centers (SOC) to distinguish actual threats from false positives. ANY.RUN’s integration with the Torq AI SOC Platform bridges this gap by delivering conclusive malware & phishing verdicts and actionable intelligence.   The result for your team is faster incident resolution, reduced alert fatigue, and proactive threat detection.  ANY.RUN & Torq […]

The post ANY.RUN & Torq Integration: Scale Triage & Respond with Confidence appeared first on ANY.RUN's Cybersecurity Blog.

A Security Operations Center rarely struggles because it lacks alerts. It struggles because every alert creates work: validate the indicator, understand the behavior, check whether the threat is known, determine its scope, decide whether to escalate, contain the incident, and make sure the same attack is easier to detect next time. When these steps depend […]

The post From Alert Enrichment to Confident Response: How ANY.RUN Powers Every SOC Workflow appeared first on ANY.RUN's Cybersecurity Blog.

EvilTokens can hide serious account takeover risk from your SOC through “ghost” code that appears only after browser-side decryption.  As a result, static URL analysis may miss the most important part of the attack, leaving teams with incomplete evidence, slower triage, and longer exposure to a potential Microsoft 365 compromise.  Full browser-level inspection closes this gap by revealing […]

The post EvilTokens: How “Ghost” Code Threatens US and European Businesses appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN has been recognized as the Best Security Investigation Platform 2026 at the Cybersecurity Stars Awards by The Hacker News.  This award reflects our dedication to building solutions that make a real impact on daily security operations.  At ANY.RUN, we help SOC and MSSP teams worldwide streamline threat investigation workflows through confident decision-making, full malware and phishing visibility, and actionable insights thataccelerate incident investigations and response.  We thank our global community of security professionals for continuously trusting our solutions and supporting our growth!  Reinforcing Our Position as a Market […]

The post The Hacker News Recognizes ANY.RUN as the Best Security Investigation Platform 2026  appeared first on ANY.RUN's Cybersecurity Blog.

 A SOC is where every second counts. Amidst a flood of alerts, false positives, and ever-short time, analysts face the daily challenge of identifying what truly matters — before attackers gain ground.  That’s where alert triage comes in: the essential first step in detecting, prioritizing, and responding to threats efficiently. Done right, it defines the […]

The post Faster Triage, Clearer Evidence, Lower Risk: A SOC Guide to Better Alert Handling appeared first on ANY.RUN's Cybersecurity Blog.

Modern URL phishing relies on dynamic pages, credential harvesting flows, client-side scripts, and layered redirect chains. But most SOC workflows are still built around static analysis, making them blind to most of these tactics.  ANY.RUN changes this forever with in-browser data inspection.  The new technology takes URL analysis to the next level by bringing static and dynamic analysis into one single workflow. Now, […]

The post The New Standard for URL Analysis: Closing Phishing Blind Spots with In-Browser Data Inspection  appeared first on ANY.RUN's Cybersecurity Blog.

Three cities, three cybersecurity conferences, and plenty of conversations with security professionals across Europe.  Over the past few weeks, the ANY.RUN team joined Infosecurity Europe in London, CONFidence Conference in Kraków, and C1b3rWall Congress in Ávila. While every event had its own focus, the discussions pointed in the same direction: security teams need faster investigations, […]

The post From Infosecurity Europe to CONFidence and C1b3rWall: What Security Teams Are Prioritizing in 2026 appeared first on ANY.RUN's Cybersecurity Blog.

Talk to any threat hunter long enough, and beneath the polished case studies and conference talks, the same frustrations surface. Hunting is supposed to be proactive. In practice, it often feels reactive. You are chasing whispers of activity through log noise, querying SIEM fields that barely reflect real attacker behavior and writing detections against technique descriptions that […]

The post Intelligence-Driven Threat Hunting: How SOCs Find What Alerts Miss appeared first on ANY.RUN's Cybersecurity Blog.