ANY.RUN

🚀 𝗕𝗜𝗚 𝗡𝗘𝗪𝗦: Introducing Related Threat Context, Your New MTTR Shortcut. SOC & MSSP teams used to manually rebuild the picture around every suspicious IOC. With this new #ANYRUN update, you can see related team analyses, historical context, and industry-related activity for every IOC and uncover related infrastructure in one connected workflow. ⚡️ 𝗜𝘁’𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝘀𝗶𝗺𝗽𝗹𝗲: review the context around each indicator in the Sandbox, then pivot to TI Lookup in one click to uncover additional threat activity and give Tier 1 evidence to justify escalation. See the workflow in action and try it yourself: app.any.run/tasks/390e708f-2… 🔍 Connected context brings a whole new level of speed and clarity to triage: faster decisions, fewer uncertainty-driven escalations, more focused use of Tier 2 expertise, better knowledge reuse across shifts, and stronger visibility into industry-relevant activity. 🎉 𝗧𝗵𝗲 𝘁𝗿𝗶𝗮𝗴𝗲 𝗯𝗼𝗼𝘀𝘁 𝘆𝗼𝘂’𝘃𝗲 𝗯𝗲𝗲𝗻 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗶𝘀 𝗵𝗲𝗿𝗲. Explore Related Threat Context in your security workflows: any.run/cybersecurity-blog/r…

🚨 US SOC teams are drowning in alerts. But the real bottleneck is manual checks, fragmented evidence, and escalations without context. ❗️ Explore five pain points holding US security operations back and practical ways to make investigations faster: any.run/cybersecurity-blog/u…

❗️ A breach can start with an alert your team can’t validate fast enough. #ANYRUN TI Feeds bring fresh, investigation-backed IOCs into SIEM, SOAR and EDR workflows. ⚡️ Enrich alerts before manual investigation begins: any.run/threat-intelligence-…

🚨 The danger behind fake job interviews has once again put North Korean cyber operations in the spotlight. But how do these actors actually gain access and operate?   ⚡️ Get a rare look inside DPRK operations with hours of footage capturing attackers in action: 1️⃣ Inside the fake IT worker scheme: We recorded Famous Chollima operatives in action, revealing the fake identities, remote-access tools, and infrastructure behind their operation. Learn more: any.run/cybersecurity-blog/l…   2️⃣ An insider at work: Researchers hired IT workers into a fake DeFi startup, revealing what they did after gaining access to development environments, accounts, and code. Learn more: any.run/cybersecurity-blog/l…   3️⃣ From fake meeting to compromise: The investigation into Lazarus’s Mach-O Man malware kit reveals how fake meeting invitations lead to credential theft, browser session collection, and data exfiltration. Learn more: any.run/cybersecurity-blog/l…   ❗️ The tactics may differ, but the goal is the same: use trust to get inside a company’s systems and reach valuable data. Use these investigations to assess your exposure and strengthen detection and response to Lazarus-linked threats.

👨‍💻 NIS2 puts cybersecurity effectiveness in focus for EU organizations. Can your security stack prove it meets the standard? See how independent threat intelligence helps support compliance, strengthen security, and improve ROI 👇 any.run/cybersecurity-blog/t…

🏦 A 12-person bank SOC team was overwhelmed by alerts and couldn’t see what suspicious files did. ✅ In week one with #ANYRUN Interactive Sandbox, it processed alerts 2× faster. Email API integration automated submissions, while interactive analysis replaced environments that took a week to prepare. 🔥 Over 18 months, it stopped hundreds of ransomware and credential-theft attempts, including a loader hidden in a password-protected supplier ZIP. 🔍 #ANYRUN Threat Intelligence provided fresh IOCs, enriched context, and real-time finance-threat monitoring. 📈 See how #ANYRUN supports financial institutions: any.run/by-industry/finance/…

📈 What does it take to scale without sacrificing service quality? This US MSSP knows the answer. ⚡️ See how actionable threat intelligence helped a five-analyst SOC handle 30% more alerts while maintaining SLA quality ⬇️ any.run/cybersecurity-blog/u…

🚨 #Formbook is targeting European businesses with localized order and procurement lures. Discover how obfuscated JavaScript, PowerShell loaders, process hollowing, and browser credential theft drive this multi-stage attack. Read the full analysis 👇 any.run/cybersecurity-blog/f…

Phishing activity in the past 7 days 🐟 Track latest #phishing threats in TI Lookup: intelligence.any.run/analysi… #TopPhishingThreats

🚨 #SkyW4lker uses business-themed phishing lures and fraudulent device-code authentication to compromise M365 accounts, putting corporate identities, mailboxes, and sensitive documents at risk. Understand the threat and the signals that expose it: any.run/malware-trends/skyw4…

⚠️ Malware activity shifted toward loaders and stealers last week. #DonutLoader surged 85%, #AgentTesla climbed 65%, and #ReverseLoader gained 54%. Meanwhile, #AsyncRAT rose 28% as #Remcos and #XWorm declined. 📌 Trend to watch: growing loader activity puts more focus on the early stages of infection. For SOC teams, investigating execution chains and follow-on payloads can help identify the full scope of a threat before containment decisions are made. Monitor the malware driving today’s attacks: any.run/malware-trends/?utm_… #Top10Malware

❗️ AI can reduce repetitive SOC work, but a phishing alert can still look harmless until someone opens the file, follows the embedded link, and gets past a CAPTCHA — time Tier 1 analysts rarely have. With Automated Interactivity enabled, #ANYRUN Sandbox opens a legitimate Adobe-hosted PDF, follows its embedded URL, and exposes the Microsoft OAuth phishing flow in this #SkyW4lker case. See it in action: app.any.run/tasks/2573e1ee-3… ⚡️ #ANYRUN's new Related Threat Context then surfaces 70+ related analyses, while a SOC-ready Tier 1 Report combines the evidence with an AI Summary & Recommendations for the next steps, helping analysts make faster decisions and give Tier 2 a documented starting point instead of repeating the initial analysis. 🚀 How to turn AI capabilities into faster, evidence-backed SOC decisions: any.run/cybersecurity-blog/a…