Analysts must fill these gaps manually, checking indicator reputations, comparing sources, and gathering evidence. Every extra lookup consumes valuable time, increases the triage queue, and puts response service-level agreements (SLAs) at risk. While the team works to establish whether an alert is malicious, attackers gain more time to operate.

The answer isn’t necessarily another feed. It’s intelligence that brings fresh indicators and investigative context into your existing security workflows, helping SOC and MSSP teams detect threats earlier and investigate with less manual effort.

Better Threat Coverage Starts at the Source

Multiple threat intelligence feeds can give a SOC more indicators without improving visibility into emerging threats. When providers rely on overlapping public reports and third-party sources, additional subscriptions may repeat information the team already has while leaving fresh malicious infrastructure uncovered.

The problem is not only what intelligence contains, but when it becomes available. An indicator can be accurate and useful for retrospective analysis yet arrive too late to help detect an attack as it unfolds.

Public reports and shared IOC lists remain valuable, but they often document attacks after the activity has been observed and investigated. By the time findings are published, processed, and redistributed through feeds, attackers may have already abandoned the infrastructure described and moved to new domains, URLs, or command-and-control servers.

For SOC and MSSP teams, this creates a gap between malicious activity visible in telemetry and the intelligence available to recognize it. Analysts must manually investigate unfamiliar indicators, establish their reputation, and gather context, adding work to the triage queue while delaying detection and response.

More feeds don’t necessarily mean fresher intelligence or better coverage. Closing these gaps requires data collected closer to actual threat activity, with fresh indicators and investigative context that complement existing sources.

How Outdated Intelligence Puts Pressure on Your SOC

When intelligence arrives late, the SOC has to compensate with its own time and resources. Security tools have fewer relevant indicators to match against, analysts face more uncertainty, and response decisions take longer. Time spent researching one unfamiliar domain is time unavailable for the next alert.

The impact extends across three connected areas of security operations: threat detection, analyst workload, and incident response.

1. Fresh Threats Can Go Unrecognized

An attacker’s newly deployed domain or command-and-control server may already appear in network telemetry while remaining absent from the SOC’s feeds. The connection is visible, but without a matching malicious indicator, security solutions lose an opportunity to identify the infrastructure through an IOC match. Other detection mechanisms may still flag suspicious behavior, but the team lacks an additional signal to recognize the threat.

As a result, the SOC may have extensive coverage of previously reported infrastructure while missing activity involving newly observed threats. Until relevant intelligence becomes available, malicious connections may go unrecognized, giving attackers more time to operate.

2. Overlapping Intelligence Leaves Analysts Doing More Research

When an alert involves an unfamiliar indicator, analysts must establish what available intelligence cannot explain. They may need to check multiple reputation sources, examine network activity, and analyze suspicious files to gather evidence for escalation. If several feeds return overlapping information, the original question remains unresolved.

This research takes capacity away from other cases. For MSSPs, the impact can extend across multiple client queues. The cost of overlapping intelligence isn’t just missing data: it’s analyst time spent compensating for it.

3. Delayed Decisions Put SLAs and Containment at Risk

Triage and response deadlines keep approaching while analysts gather evidence. Without enough information to assess an alert, they may need to continue investigating or escalate it for deeper review, delaying the decision on how to respond.

As delays accumulate, meeting SLAs becomes harder and containment may happen later than necessary. Depending on the attack, that extra time may allow further credential theft, lateral movement, or data exfiltration. The earlier the SOC can establish malicious activity, the sooner it can move toward containment.

First-Hand Threat Intelligence: Get Fresh Indicators Before Manual Investigation

Fresh intelligence gives the SOC an opportunity to recognize malicious activity while the team can still act on it. ANY.RUN provides a direct source of that intelligence: indicators drawn from malware and phishing investigations in Interactive Sandbox and delivered through Threat Intelligence Feeds. Teams can access those findings without waiting for them to appear in public reports or circulate through third-party sources.

Security professionals examine suspicious files and URLs in Sandbox, exposing malicious network connections, malware configurations, and execution behavior. These observations provide the basis for intelligence that existing security controls can use.

The path from investigation to detection is more direct, helping reduce the gap that analysts would otherwise have to fill manually.

The dataset draws on investigations from more than 16,000 organizations and a community of over 700,000 security professionals. This contributes observations from different environments and industries, including malicious indicators that may not yet be widely available through other intelligence sources.

Intelligence Can Be Available Before Your Team Starts Investigating

ANY.RUN analysis found that up to 30% of unique malicious IOCs identified in Interactive Sandbox sessions had already been observed by ANY.RUN and were available in TI Feeds. When those indicators appeared in a new analysis, the intelligence needed to recognize them already existed.

For a SOC using that intelligence, this creates an opportunity to detect matching activity earlier. If the indicators appear in endpoint or network telemetry and matching is configured, existing security controls can flag the activity before an analyst manually submits the associated file or URL for analysis.

That earlier signal changes where the investigation begins. Instead of spending time establishing whether an unfamiliar destination is malicious, analysts can focus on validating the activity in their environment, identifying affected systems, and assessing the response required. Linked Sandbox analyses provide evidence to support those decisions.

Earlier access to relevant intelligence helps reduce the research required before the team can act. For SOCs or MSSPs facing growing queues and response deadlines, that means less time compensating for missing data and a stronger starting point for investigation and containment.

How ANY.RUN TI Feeds Add Detection Opportunities

ANY.RUN TI Feeds deliver verified malicious network indicators — including IP addresses, domains, and URLs — collected from real-world malware and phishing investigations.

Designed to complement existing security infrastructure, the feeds integrate through STIX/TAXII and API/SDK into SIEM, EDR, XDR, TIP, and other security systems without requiring changes to established detection workflows.

By adding intelligence from real-world investigations to existing detection logic, teams can identify suspicious connections, enrich alerts, and prioritize activity that might otherwise appear unfamiliar.

Each IOC is also linked to its underlying Sandbox analysis, allowing analysts to investigate the evidence behind an indicator, including malware behavior, network activity, and MITRE ATT&CK techniques.

This connection between intelligence and behavioral evidence helps security teams move beyond identifying suspicious activity to understanding the threats behind it.

From an Indicator to an Investigation: The Role of Interactive Sandbox

Threat Intelligence Feeds help security systems recognize known malicious indicators, but not every alert contains a recognizable IOC, and an indicator alone rarely explains the full incident.

Behavioral analysis helps fill this gap.

ANY.RUN’s Interactive Sandbox allows analysts to safely execute suspicious files and URLs in a controlled environment, observe their behavior, and collect evidence that reputation checks or static inspection alone may miss.

During an investigation, analysts can examine system changes, file and registry modifications, network connections, and techniques used by a sample. This provides behavioral evidence for understanding a threat beyond its indicator reputation.

These observations also help connect unfamiliar samples and activity to previously investigated threats, providing additional context for ongoing investigations.

Related Threat Context: Make Previous Investigations Work for You

An indicator found during a new investigation may have appeared in other cases before. It could be linked to activity targeting the same industry, investigated by another analyst on the team, or associated with a broader malicious campaign.

ANY.RUN’s Related Threat Context (Related analyses) – a powerful new capability in Interactive Sandbox available to enterprise users – helps analysts discover these connections without manually searching through previous investigations.

This capability also connects sandbox investigations with Threat Intelligence Lookup, allowing analysts to examine indicators against the broader ANY.RUN intelligence dataset and discover previously observed malicious activity. As a result, it helps move from analyzing a suspicious file or URL to understanding where its associated indicators have appeared before.

Related results can reveal where the same indicators have appeared:

• Within your team: revisit previous investigations and evidence collected by colleagues.

• Across your industry: explore related observations from organizations in the same sector and identify activity worth comparing.

• Across ANY.RUN Threat Intelligence: discover connections to investigations across the broader dataset, including additional indicators and related threat activity.

These connections give analysts a starting point for further investigation. Instead of gathering context from scratch, they can review previous findings, compare behaviors, and identify additional indicators.

Use Related analyses to uncover IOC connections and make more informed decisions

Discover how Related analyses improve SOC and MSSP investigations.

For example, if an IOC found in a suspicious attachment also appears in investigations involving other organizations in the same industry, those cases may provide useful leads for assessing the current threat.

Related Threat Context doesn’t establish that every related case belongs to the same campaign or replace further investigation. It provides evidence and connections that analysts can validate to build a more informed assessment.

This also helps SOC and MSSP managers reduce duplicated research across analysts and shifts, making previous investigative work easier to reuse and new findings easier to build upon.

What Better Threat Intelligence Means for SOC & MSSP Performance

Closing intelligence gaps improves more than detection. As a result, SOCs and MSSPs process alerts more efficiently, allocate analyst time, and manage incidents.

ANY.RUN customer research shows that organizations using its solutions identify up to 58% more threats overall. This result reflects the combined contribution of behavioral analysis and threat intelligence, rather than TI Feeds alone.

The operational benefits extend across security team workflows:

• Faster investigations: Indicators with an established malicious reputation and relevant previous findings give analysts a stronger starting point, reducing time spent gathering basic context.

• More confident triage: Behavioral evidence and related investigations help Tier 1 analysts assess alerts, prioritize threats, and determine which cases require escalation.

• Less duplicated work: Reusing previous analyses allows teams to avoid repeatedly investigating the same indicators and behaviors. This is particularly valuable for MSSPs managing threats across multiple clients.

• Better use of senior expertise: With less time spent on routine enrichment and research, experienced analysts can focus on threat hunting, incident response, and complex investigations.

These efficiencies help SOC and MSSP leaders manage growing alert volumes, improve resource allocation, and scale security operations without relying solely on additional headcount.

How to Identify and Close Intelligence Gaps in Your Stack

You don’t need to replace existing threat intelligence providers to improve detection. Start by evaluating how well your current sources support detection and investigation.

Consider the following questions:

• Do your feeds include indicators collected directly from real-world malware and phishing investigations?

• Can your security tools automatically match fresh intelligence against existing telemetry?

• Can analysts access behavioral evidence behind malicious indicators?

• Can they easily find previous investigations involving the same indicators?

• Can industry-specific observations and broader threat intelligence help provide context for unfamiliar threats?

These questions can reveal gaps where additional intelligence would bring value. A source that contributes new indicators, behavioral evidence, or investigative context can strengthen an existing TI stack without replacing the providers already in use.

Conclusion

Threat intelligence becomes most valuable when it helps security teams recognize malicious activity before it requires manual investigation.

TI Feeds make this possible by bringing known malicious indicators into existing security workflows, enabling earlier detection, faster triage, and more informed response decisions. By enriching security telemetry with intelligence gathered from real-world threats, organizations can reduce investigative overhead and make better use of their existing detection infrastructure.

Ultimately, the value of threat intelligence lies not in the number of indicators collected, but in how effectively that intelligence helps security teams detect threats and act on them.

About ANY.RUN

ANY.RUN develops cybersecurity solutions that help security teams investigate threats, analyze malware, and access actionable threat intelligence. Its solutions are used by more than 700,000 security professionals across 16,000+ organizations worldwide.

ANY.RUN offers Interactive Sandbox for interactive malware and URL analysis, Threat Intelligence Lookup and Threat Intelligence Reports for investigating suspicious indicators and uncovering related activity, and Threat Intelligence Feeds for integrating fresh, validated threat data into security workflows.

The company also holds SOC 2 Type II attestation, demonstrating its commitment to maintaining controls for security, availability, and data protection.

Frequently Asked Questions

The post Your Threat Intelligence Stack Has Blind Spots. Here’s How to Close Them appeared first on ANY.RUN's Cybersecurity Blog.

For SOC teams, these attacks raise important questions about the effectiveness of existing defenses, incident response costs, and the ability of SOC teams to handle evolving threats.

What October’s Attacks Reveal About US Enterprise Risk

October’s threat activity exposed several security challenges that US organizations need to address to reduce the risk of costly incidents:

• MFA alone cannot prevent account compromise: SkyW4lker, GeorgeGinx, and Mir0Auth abused legitimate Microsoft device-code authentication to gain unauthorized access without stealing passwords.

• Trusted platforms are becoming attack entry points: Fake AI campaigns and GeorgeGinx exploited familiar brands, document-sharing services, and business invitations to make phishing attempts harder to recognize.

• AI adoption introduces new security risks: Malicious AI installers and fraudulent event invitations exposed employees to credential theft, malware infections, and unauthorized account access.

• Endpoint protection can be deliberately weakened: WKLP modified Microsoft Defender exclusions and firewall rules to maintain remote access, increasing the risk of prolonged compromise and data theft.

• A single alert may hide a much larger campaign: SkyW4lker investigations revealed connected malicious infrastructure and related phishing activity, showing why organizations need visibility beyond individual indicators.

• Delayed investigations increase business exposure: When malicious activity spans multiple services and systems, security teams need to connect the evidence quickly to limit unauthorized access, financial losses, and recovery costs.

Who Attackers Targeted in October

October’s attacks primarily targeted US organizations, Microsoft 365 users, and employees relying on AI applications and trusted business platforms.

1. SkyW4lker Targets US Enterprises with Microsoft 365 Device-Code Phishing

SkyW4lker is an active phishing kit that abuses legitimate Microsoft device-code authentication to gain unauthorized access to corporate accounts without stealing passwords or bypassing MFA. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US. Monthly submissions grew from 20 in June to 200 in September.

Read full investigation

Check SkyW4lker sandbox session

The attack begins with password-protected documents disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before reaching a page that instructs them to enter a device code on Microsoft’s legitimate authentication website.

From One Phishing URL to a Full Campaign Context in Seconds

ANY.RUN’s powerful new Related Threat Context helped researchers connect SkyW4lker activity to previous sandbox investigations and uncover additional malicious infrastructure. Further analysis also revealed technical links to Gabagool, another phishing kit believed to share the same developer.

Starting with a SkyW4lker sandbox session, researchers used Related Threat Context to pivot directly into ANY.RUN’s Threat Intelligence Lookup for IP address 198.23.223.185, expanding the investigation beyond the initial phishing URL.

The Threat Intelligence results linked the IP to 203 URLs across 10 domains and 30 sandbox analyses, with related activity involving technology, government, education, finance, and consulting. Submissions came from 10 countries, including the US, Colombia, and Germany.

By connecting individual sandbox findings with wider threat intelligence, SOC teams can identify related infrastructure, collect relevant indicators for proactive detection, and investigate potential exposure without spending hours manually piecing together the evidence.

Identity risk to reduce: SkyW4lker can compromise Microsoft 365 accounts through legitimate authentication flows, putting sensitive business data at risk. Restrict unnecessary device-code authentication and use ANY.RUN’s Related Threat Context to trace connected phishing infrastructure, identify additional indicators, and strengthen detection before attackers expand their access.

2. Fake AI Campaigns Spread Malware and Steal Sessions, Raising Corporate Data Theft Risks

Cybercriminals are exploiting growing AI adoption through fake applications, malicious download pages, and fraudulent event invitations impersonating ChatGPT, Claude, and other popular services. ANY.RUN researchers identified 1,258 public sandbox analyses between April 15 and October 5, 2026, with the US ranking second worldwide in submission activity.

Read full investigation

The campaigns use different approaches to target employees. Fake AI downloads and installation guides trick users into executing malicious commands, while fraudulent event invitations redirect victims to Microsoft 365 and Google phishing pages. 45% of the analyzed activity involved paste-command attacks, exposing organizations to malware infections, credential theft, and unauthorized account access.

Investigate the Claude malware sample

Data theft risk to reduce: Fake AI campaigns can expose corporate credentials, active sessions, and sensitive business information. Organizations should establish approved AI software sources, restrict unauthorized script execution, and use Interactive Sandbox to identify malicious behavior before it leads to wider compromise.

3. GeorgeGinx Hides Device-Code Phishing Behind Trusted Adobe Links, Threatening Corporate Accounts

GeorgeGinx is an active Phishing-as-a-Service (PhaaS) operation targeting government, banking, healthcare, and IT organizations in the US. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft device-code phishing pages, potentially gaining unauthorized access to corporate accounts without stealing passwords.

Check details and gather IOCs

View sandbox session

The campaign takes advantage of trusted document-sharing workflows to conceal its phishing destinations. Using ANY.RUN’s In-Browser Data Inspection, researchers examined HTML DOM activity and HTTP requests behind an Adobe link to investigate the redirect chain.

Further investigation uncovered an administration panel on an attack server, providing additional insight into the infrastructure supporting the GeorgeGinx operation.

Account takeover risk to reduce: Trusted document-sharing domains should not automatically be treated as safe. Security teams should inspect where external links ultimately lead and analyze suspicious browser activity with ANY.RUN’s In-Browser Data Inspection. This helps expose hidden phishing destinations and reduce the risk of unauthorized access to corporate accounts.

4. WKLP Weakens Microsoft Defender, Exposing Organizations to Data Theft and Persistent Access

WKLP is a Python-based infostealer and remote access trojan (RAT) observed targeting government organizations in the US and France. It collects credentials, browser data, password-manager information, and sensitive files while giving attackers remote control over compromised endpoints.

Check details and gather IOCs

The attack uses PowerShell to launch a legitimate Python runtime disguised as the Windows process MoUsoCoreWorker.exe. WKLP adds Microsoft Defender exclusions, terminates security processes, and creates firewall rules disguised as Windows Update Service, weakening protections that would normally help detect and contain the infection.

View sandbox session

Beyond stealing data, WKLP gives attackers the ability to execute remote commands, deploy additional payloads, and access a victim’s screen, camera, microphone, and clipboard. It also uses a watchdog mechanism to restore deleted malware copies, making complete removal more difficult.

Endpoint risk to reduce: Removing WKLP’s malicious files may not be enough to stop the attack. Security teams should check for persistence mechanisms, restore modified Defender settings, and review suspicious connections. ANY.RUN’s Tier 1 reports bring together behavioral evidence and response recommendations, helping analysts identify the full scope of the infection and reduce the risk of repeated compromise.

5. Mir0Auth Uses Fake DocuSign Pages to Hijack Microsoft 365 Sessions, Putting Business Data at Risk

Mir0Auth is a phishing kit targeting Microsoft 365 authentication tokens, with activity primarily observed against US organizations. The attack begins with phishing emails containing PDF attachments that direct victims to fake DocuSign pages, eventually leading them into Microsoft’s legitimate device-code authentication process.

Check details and gather IOCs

View full attack chain

The kit uses obfuscated network communication and disguised endpoints, including /task_queue.cs, /context.go, and /window.rs, to request device codes and track authentication sessions. Once victims complete the sign-in process, attackers can obtain access tokens without stealing passwords, potentially gaining access to sensitive corporate emails and documents.

Identity risk to reduce: Stolen authentication tokens can leave corporate accounts exposed even after a password change. Organizations should review token activity and strengthen controls over device-code authentication. Behavioral analysis with ANY.RUN helps teams recognize suspicious authentication patterns and understand how phishing attempts unfold, supporting more accurate incident response and reducing the risk of data exposure.

Close the Security Gaps Exposed by October’s Attacks

October’s campaigns showed how easily attackers can hide malicious activity behind trusted applications, legitimate authentication processes, and everyday business workflows. SkyW4lker, GeorgeGinx, and Mir0Auth exploited Microsoft authentication, fake AI campaigns concealed malware and credential theft, while WKLP weakened endpoint defenses to maintain remote access.

For security leaders, the challenge is to detect these threats early, understand their full scope, and contain them before they lead to costly incidents, without increasing SOC workload or spending.

1. Expose Malicious Behavior Before It Causes Damage

Many of October’s attacks appeared legitimate at first. Fake AI installers could run genuine applications while stealing browser sessions, and trusted document-sharing links redirected employees to phishing pages.

ANY.RUN’s Interactive Sandbox lets security teams examine what suspicious files and URLs actually do, exposing hidden redirects, scripts, credential theft, and malware execution. Automated Tier 1 reports turn these findings into clear summaries and response recommendations, helping analysts move from investigation to containment with less manual effort.

2. Capture the Full Threat Picture in Seconds

Finding one malicious URL or IP address rarely tells the whole story. As the SkyW4lker investigation demonstrated, a single indicator can lead to previously discovered infrastructure and related attack activity.

ANY.RUN’s Related Threat Context connects sandbox findings with previous investigations and Threat Intelligence Lookup in a single workflow. Analysts can move directly from suspicious behavior to wider threat intelligence, drawing on real-world investigations from 16,000+ organizations to uncover related infrastructure and assess potential exposure faster.

3. Strengthen Detection with Fresh Threat Intelligence

October’s phishing campaigns also demonstrated why detecting one malicious link isn’t enough. Attackers can use multiple URLs and domains to reach victims, making it important to identify related infrastructure before more employees are exposed.

ANY.RUN’s Threat Intelligence Feeds continuously deliver fresh malicious URLs, domains, IPs, and other indicators into existing security systems. 30% of malicious IOCs from ANY.RUN customer sandbox investigations are unique, giving SOC teams additional threat data to strengthen detection and reduce reliance on manual IOC collection.

The Business Impact: Faster Response, Lower SOC Costs

Together, these capabilities help organizations improve security operations without continuously increasing resources. Enterprises using ANY.RUN report:

• 94% faster threat triage, helping teams identify malicious activity and make decisions sooner.

• 21 minutes less MTTR per incident, reducing investigation and response time.

• 30% fewer Tier 1-to-Tier 2 escalations, allowing senior specialists to focus on more complex incidents.

For CISOs, the goal is to contain more threats with the security resources already in place, reduce investigation costs, and limit the financial impact of incidents before they disrupt business operations.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 700,000 cybersecurity professionals across 16,000+ organizations worldwide.

Its Interactive Sandbox gives analysts full visibility into suspicious files, URLs, phishing pages, browser activity, network traffic, processes, and other attack behavior. Threat Intelligence Lookup helps teams investigate related infrastructure and activity, while Threat Intelligence Feeds bring fresh IOCs into existing security systems.

These capabilities help reduce repetitive investigation work, give analysts more context, and support growing investigation volumes without adding the same amount of manual effort.

Strengthen Business Resilience

The post Major Cyber Attacks in October 2026: Fake AI, Account Takeovers, and Remote Access Threaten US and EU appeared first on ANY.RUN's Cybersecurity Blog.

October’s release introduces a new powerful capability in ANY.RUN’s Interactive Sandbox– Related Threat Context. Now SOCs and MSSPs can save more time by uncovering relevant IOC connections and unlocking investigative insight with less effort. By bringing relevant intelligence directly into the workflow, analysts can easily assess their findings and decide how to respond without switching between multiple sources.

The release also expands threat coverage and detection capabilities, improving visibility into emerging threats and malicious activity. Together, these updates help SOC and MSSP teams investigate more efficiently, reduce manual effort, and make better-informed decisions with greater confidence.

Product Updates

This month’s product updates help analysts connect individual indicators with the context needed to decide what to do next. Related Threat Context surfaces relevant intelligence directly in the Interactive Sandbox, while Threat Intelligence Lookup helps explore related infrastructure, observables, and threat activity.

Related Threat Context: A Major Upgrade That Makes Every SOC Investigation Faster and Smarter

An IOC is only the starting point. To decide what to do next, analysts need to know whether it has appeared in previous investigations, is associated with activity in their industry, or connects to known threats.

With the introduction of a major new update for SOCs and MSSPs – Related Threat Context, ANY.RUN’s Interactive Sandbox takes threat investigations a step further.

For the first time, analysts can discover relevant connections to an IOC directly within their analysis workflow, bringing previously scattered intelligence closer to the moment decisions need to be made.

See how Related Threat Context works in a live Sandbox analysis

Connecting IOCs to Three Sources of Intelligence

Related analyses bring together three sources of insight, connecting current findings with intelligence that can help shape the next step.

• Team Context: Discover previous team investigations involving the same IOC and build on existing findings instead of duplicating work.
• Industry Context: See whether the IOC has appeared in analyses associated with your industry. This anonymized information provides an additional signal for prioritization, not proof that your organization is being targeted. Available to eligible internal SOCs, but not MSSPs.
• ANY.RUN Threat Intelligence: Explore related analyses, samples, infrastructure, and known threat activity through ANY.RUN Threat Intelligence Lookup.

These connections give analysts a more direct way to compare current behavior with previous observations, uncover additional IOCs, and identify promising leads for further investigation.

From IOC Discovery to Confident SOC Decisions

Consider a Tier 1 analyst investigating a suspicious URL. The sandbox reveals malicious behavior, but the analyst still needs to decide whether to close the case, investigate further, enrich it with threat intelligence, or escalate it.

Related analyses add another layer to that decision. By surfacing previous team findings, relevant industry activity, and broader threat intelligence, they help SOCs and MSSPs assess what they have found without starting separate searches from scratch.

The benefits extend across the entire team. Tier 1 analysts gain more information for triage, incident responders and threat hunters get additional leads for deeper investigation, and team leaders can make better use of existing team knowledge and Tier 2 expertise.

Related Threat Context brings threat intelligence closer to the point of investigation, helping SOCs and MSSPs turn individual IOC findings into more informed decisions and actionable next steps.

Explore how Related analyses can strengthen your SOC’s response with deeper threat context.

Threat Coverage Updates

October also brings an expansion of detection coverage, with 591 new signatures in total:

• 157 behavioral signatures
• 428 Suricata rules
• 6 YARA rules

Together, these additions extend visibility across endpoint behavior, file activity, and network communications, helping analysts identify more of the activity uncovered during real-world investigations.

157 New Behavioral Signatures

The October behavioral coverage expands ANY.RUN’s ability to recognize malicious activity observed during sandbox analysis.

Behavioral signatures complement static indicators by focusing on what suspicious software actually does during execution. This gives analysts additional signals when investigating malware, delivery chains, and other activity where a single hash or filename may not tell the whole story.

Network detection receives the largest expansion this month, with 428 new Suricata rules covering suspicious traffic associated with malware, phishing, command-and-control activity, and emerging attack infrastructure.

Three additions stand out:

• Exvicy framework HTTP activity — SID 89004358: detects HTTP activity associated with the emerging Exvicy Clickfix MaaS platform, helping identify network activity tied to social engineering campaigns.
• CLOUDHAZE C2 activity — SIDs 81001806–81001809: tracks communication attempts from the Rust-based CLOUDHAZE backdoor to its command-and-control infrastructure.
• VlnkSync HTTP activity — SID 84004770: detects network activity associated with the VlnkSync Telegram credential stealer.

These rules add network-level visibility into threats that can otherwise be difficult to distinguish from legitimate traffic, giving analysts another source of evidence during investigation.

New in Threat Intelligence Reports: KernelReaper

In October, ANY.RUN published a new Threat Intelligence Report on KernelReaper, a destructive Windows malware that can disrupt boot processes, storage, recovery mechanisms, and security controls.

The report details its behavior before and during execution, traces six additional payloads connected to the same server, and examines the infrastructure linking the samples without assuming they belong to a single malware family or threat actor.

It also provides IOCs, YARA and Sigma rules, and detection insights to help security teams identify KernelReaper and investigate related activity.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 16,000 organizations and 700,000 security professionals worldwide.

The company’s Interactive Sandbox enables SOC teams, MSSPs, and enterprise security teams to safely analyze suspicious files, URLs, phishing pages, and malware while observing attack activity in real time. Analysts can examine processes, browser activity, network traffic, persistence, credential access, and other behaviors to understand what a threat is doing.

ANY.RUN Threat Intelligence extends that investigation by helping teams connect indicators with related infrastructure, samples, campaigns, and observed activity.

ANY.RUN’s SOC 2 Type II attestation demonstrates the focus on maintaining robust security controls and protecting customer data. By bringing behavioral analysis and up-to-date threat intelligence together, the company equips security teams to investigate suspicious activity, strengthen threat detection, and respond to threats before they escalate.

The post Release Notes: Related Threat Context for Faster Than Ever SOC Triage and 590+ Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

Three days of conversations gave us a valuable opportunity to hear what security teams are focused on today, exchange ideas about evolving security operations, and discuss how malware analysis and threat intelligence can support faster and more confident decisions.

Meeting Customers and the Cybersecurity Community

This year, visitors could meet ANY.RUN at two locations: our booth in Hall 9, Stand 9-114, and in Hall 6, Stand 6-432 together with ALLNET GmbH.

It was great to reconnect with existing customers, meet new organizations, and speak directly with security professionals working with malware, phishing, incident response, and threat intelligence every day.

Many conversations focused on practical challenges familiar to modern SOC and MSSP teams:

• Reducing time spent validating suspicious files and URLs;

• Giving analysts stronger evidence for incident response decisions;

• Using fresh threat intelligence to support investigation and threat hunting;

• Improving detection against new and changing threats;

• Building security processes that meet growing enterprise and regulatory requirements.

These conversations are especially valuable because they connect technology with the reality of day-to-day security operations. They also give our team direct insight into the priorities, constraints, and workflows that security teams are dealing with across different industries and environments.

DORA, NIS2, and Security Compliance Were Part of the Conversation

Compliance and operational resilience were also recurring topics at it-sa.

For organizations operating in Europe, frameworks such as DORA and NIS2 continue to influence how security teams approach ICT risk, incident handling, supply-chain security, operational resilience, and relationships with technology providers.

As a result, organizations evaluating cybersecurity solutions increasingly look beyond individual technical capabilities. The security controls of the provider, protection of sensitive information, and the ability to support controlled enterprise workflows are also part of the discussion.

ANY.RUN has achieved SOC 2 Type II attestation and ISO 27001 certification, independently validating the controls and information security management practices behind our malware analysis and threat intelligence services.

For organizations with strict internal security and vendor requirements, these standards provide additional assurance when integrating ANY.RUN into investigation and threat intelligence workflows.

From Faster Triage and Response to Stronger Security Operations

A key topic in our conversations at it-sa was how SOC and MSSP teams can improve the entire security operations workflow, from detecting suspicious activity to validating threats, investigating incidents, and strengthening future detection.

Reducing manual work at each stage is essential to keeping investigations moving. When analysts spend too much time validating alerts, collecting indicators, or rebuilding investigation context, response decisions take longer and unnecessary escalations consume senior analysts’ time.

ANY.RUN helps teams address these challenges through connected malware analysis and threat intelligence workflows.

Validate Threats Faster and Improve Escalation Decisions

At the triage stage, ANY.RUN’s Interactive Sandbox helps analysts quickly examine suspicious files and URLs, observe malicious behavior, and collect evidence for a confident verdict.

This allows Tier 1 analysts to resolve more cases with sufficient evidence and escalate those that genuinely require deeper investigation.

The operational impact is measurable: 94% of ANY.RUN users report faster triage, while SOC workflows using ANY.RUN have demonstrated 30% fewer Tier 1 to Tier 2 escalations.

Accelerate Investigations and Response

When an alert requires deeper investigation, analysts need to understand the threat, identify related activity, and determine the potential incident scope without repeating earlier research.

ANY.RUN Threat Intelligence Lookup helps teams investigate indicators, uncover related infrastructure, and connect behavioral findings with broader threat context.

Together, behavioral analysis and threat intelligence support faster investigation decisions and clearer handoffs between SOC tiers.

Across ANY.RUN-supported workflows, 95% of SOCs report faster threat investigations, with a reported 21-minute improvement in Mean Time to Respond.

Turn Investigation Findings into Earlier Detection

The value of an investigation extends beyond resolving the immediate incident. Confirmed malicious indicators and newly identified infrastructure can also help security teams improve future monitoring.

ANY.RUN Threat Intelligence Feeds help operationalize fresh indicators in existing security systems, supporting earlier detection and reducing the need for repeated manual checks.

For SOCs, this creates a continuous process where investigation findings contribute to stronger detection. For MSSPs, it supports consistent investigation practices, better escalation quality, and more efficient security operations across customer environments.

Thank You for Meeting Us at it-sa 2026

it-sa 2026 was another great opportunity to meet the people behind the security teams we work with every day.

Thank you to everyone who stopped by our booths, shared their experience, asked questions, discussed their security challenges, or simply came to say hello. We also want to thank ALLNET GmbH for joining us at the event.

Conversations like these help us stay close to the real operational needs of SOCs, MSSPs, threat hunters, and incident response teams.

We look forward to meeting the cybersecurity community again at the next event.

About ANY.RUN

ANY.RUN helps security teams improve malware and phishing analysis across triage, investigation, incident response, threat hunting, and detection engineering.

Its Interactive Sandbox and Threat Intelligence solutions are used by more than 700,000 security professionals and 16,000 organizations worldwide. ANY.RUN has achieved SOC 2 Type II attestation and ISO 27001 certification, supporting enterprise requirements for information security and data protection.

Want to discuss how ANY.RUN can fit into your security operations? Contact our team.

The post it-sa 2026 Recap: Key Trends Shaping Security Operations appeared first on ANY.RUN's Cybersecurity Blog.

Almost every vendor offers AI-powered solutions promising faster threat detection, automated malware analysis, and smarter investigations. For SOC teams, separating real value from AI branding has become a challenge of its own.

Meanwhile, alert volumes keep growing, attacks get more complex, and analysts lose hours to repetitive investigations. Senior specialists get pulled into routine escalations, while SOC leaders are expected to cut response times without increasing budgets.

The biggest opportunity? Putting AI to work where it matters most; reducing manual effort, accelerating investigations, and uncovering threats that might otherwise go unnoticed.

Where AI Makes the Biggest Difference in SOC Operations

The greatest value of AI comes from addressing the bottlenecks that slow SOC teams down every day. From uncovering evasive attacks to making faster response decisions, the right capabilities can help analysts handle more incidents without increasing their workload.

Here’s how ANY.RUN puts AI to work across critical stages of an investigation, using a real phishing attack to show what changes for the SOC.

Uncover What Basic Automation Misses: Automated Interactivity in Action

What if the threat your SOC is looking for is hiding just one click away?

Modern phishing and malware attacks often require user interaction before revealing their malicious behavior. Embedded links, QR codes, CAPTCHA challenges, and multi-stage redirects can prevent automated analysis from reaching the actual threat.

For SOC analysts, this means more time spent manually reproducing attacks, while critical malicious activity risks going undetected.

ANY.RUN brings AI automation to malware and phishing analysis with Automated Interactivity, taking over these repetitive steps. It automatically opens attachments, follows embedded links, extracts malicious URLs hidden in QR codes, solves CAPTCHAs, and navigates multi-stage attacks to expose the full attack chain with minimal manual effort.

And here’s the best part: automation doesn’t take control away from the analyst. ANY.RUN’s Interactive Sandbox lets security professionals step in at any moment to interact with the environment, examine suspicious behavior, or guide the investigation down a specific path.

This combination of automation and hands-on control helps SOC teams handle routine investigations faster while keeping analysts focused on complex threats that require their expertise.

Real Case: From a Legitimate Adobe Link to a Hidden Phishing Attack

Let’s see how AI-powered malware analysis works in a real phishing investigation.

Check sandbox session

The analysis starts with a legitimate acrobat.adobe.com link hosting a PDF document. Inside the PDF is another link that leads further into the attack.

With Automated Interactivity enabled, the sandbox opens the document, follows the embedded URL, and continues through the attack chain without requiring the analyst to perform each action manually.

The result: ANY.RUN exposes a Microsoft OAuth phishing flow hidden behind the initial document.

Along the way, the sandbox captures suspicious URLs, network connections, and other indicators, giving analysts the evidence needed to understand the attack and investigate its potential impact.

For SOC teams, the advantage is clear: Less time spent navigating suspicious files and URLs, greater visibility into evasive threats, and more analyst capacity for investigations that require human judgment.

With API-based automated malware analysis, SOCs and MSSPs can investigate suspicious files and URLs at scale, while analysts retain the freedom to step in whenever deeper investigation is needed.

A Shortcut to the Bigger Threat Picture: Uncover Related Threats with One Click

AI-powered malware analysis can expose a threat in minutes. But what if the evidence points to something much bigger?

A malicious URL rarely tells the whole story. Analysts still need to determine whether suspicious infrastructure has appeared in previous investigations, identify related activity, and understand how far the threat might extend.

That additional research can take valuable time, especially when every alert requires another round of manual IOC lookups and correlation.

ANY.RUN’s major new upgrade, Related Threat Context, takes AI-assisted malware analysis further by bringing related threat intelligence directly into Interactive Sandbox.

Available to Enterprise clients, the capability connects findings from automated malware and phishing analysis with previous investigations and ANY.RUN Threat Intelligence. Analysts can immediately discover related activity, investigate suspicious infrastructure, and build on existing evidence without starting their research from scratch.

And with intelligence drawn from a data of 700,000+ security professionals and 16,000+ organizations, SOC teams gain access to a much wider picture of real-world threat activity.

From One Suspicious Domain to a Wider Phishing Operation

Let’s return to the OAuth phishing attack uncovered earlier.

Automated Interactivity has already exposed the malicious authentication flow. Now, Related Threat Context helps the analyst see what lies beyond the original attack.

Directly inside the malware analysis sandbox, the analyst can see 70+ related analyses available through ANY.RUN Threat Intelligence.

One indicator worth investigating is slybee[.]com.

With a click on the Lookup icon, the analyst can move directly into TI Lookup and search for domainName:”slybee.com”. The results reveal:

• 40 related analyses, connecting the domain to previous sandbox investigations.
• 8 IP addresses, 29 URLs, and 41 network connections, exposing associated infrastructure and activity.
• Threat classifications including oauth-ms-phish and skyw4lker, connecting the domain to a wider phishing campaign.
• Industry risk scores and geographic insights, including a 78% risk score for Technologies, 38% for Manufacturing, and submissions from 9 countries.

One suspicious domain has now led the analyst to infrastructure associated with SkyW4lker, a Microsoft 365 device-code phishing campaign.

And that’s the real advantage of connecting AI-powered threat investigations with broader intelligence.

Instead of ending the investigation with a malicious verdict, SOC teams can explore related infrastructure, identify additional threats, and use the findings to strengthen detection across their environment.

From AI-Assisted Investigation to Stronger SOC Detection

The value of AI in cybersecurity shouldn’t end when the sandbox finishes analyzing a sample.

When AI-assisted malware analysis is connected to threat intelligence, the findings support much more than resolving the original alert.

SOC teams use the additional context to:

• Expand threat hunting by searching for related indicators across SIEM, EDR, and network telemetry.
• Strengthen detection engineering by using validated IOCs and attack patterns uncovered through AI-assisted investigations to improve detection coverage.
• Reduce duplicated work by accessing previous investigation findings instead of researching the same indicators again.
• Improve investigation prioritization by identifying connections that deserve further analysis.

For SOC managers, this means getting more value from every investigation while reducing the time analysts spend searching for related evidence.

One investigation can now become the starting point for uncovering an entire cluster of related threats and strengthening future detection.

From Complex Evidence to Confident Decisions: AI-Powered SOC Reporting

Uncovering the attack is one challenge. Turning technical evidence into confident decisions is another.

Even after automated malware analysis reveals malicious activity, analysts still need to interpret the findings, assess potential risks, and prepare reports for further investigation or response. Across hundreds of alerts, these tasks can become a serious bottleneck for SOC teams.

ANY.RUN’s AI-powered SOC-ready Tier 1 reports accelerate SOC triage by turning complex investigation findings into clear explanations and actionable recommendations.

Generated directly from Interactive Sandbox, these reports combine technical evidence with AI-generated explanations and recommendations, helping analysts move from detection to decisions faster.

AI Summary: Understand the Threat Without Hours of Manual Analysis

A single malware or phishing investigation can produce dozens of network connections, suspicious URLs, behavioral indicators, and IOCs. But analysts need more than raw data. They need to understand what happened, why it’s dangerous, and which evidence matters most.

AI Summary turns complex sandbox findings into a structured explanation of the threat, highlighting key behaviors, threat classification, and potential impact.

Let’s return to our phishing investigation.

After the sandbox uncovers the Microsoft OAuth phishing activity, the analyst can generate a SOC-ready Tier 1 report containing an AI Summary alongside the threat verdict and supporting technical evidence.

Instead of manually reconstructing the attack from individual artifacts, Tier 1 analysts receive a clear overview they can verify against the sandbox findings.

For teams looking to use AI for faster SOC triage, this means quicker threat validation, clearer handoffs, and less time spent preparing investigation reports.

When an incident requires escalation, Tier 2 can start with documented evidence rather than repeat the initial analysis.

AI Recommendations: Turn Investigation Findings into Clear Next Steps

A malicious verdict confirms the threat. But which actions should analysts prioritize next?

ANY.RUN’s AI Recommendations provides suggested investigation and response steps based on sandbox findings, helping Tier 1 analysts determine where to focus next and whether further investigation or escalation is needed.

For our OAuth phishing investigation, AI Recommendations provides specific detection and investigation steps, including system call and process spawn analysis, with relevant MITRE ATT&CK mappings and log sources.

Rather than building a response plan from scratch, Tier 1 analysts can use these recommendations to prioritize their next steps, validate additional risks, and prepare more complete escalations when needed.

For SOC managers, this means less repetitive work, fewer unnecessary handoffs, and more senior analyst capacity for complex incidents.

MTTR Reduction with AI: Where SOC Teams Save the Most Time

For SOC leaders, MTTR reduction is one of the clearest ways to measure the impact of AI on SOC performance. Here’s how ANY.RUN addresses these delays across different stages of a real OAuth phishing investigation.

Saving minutes across these stages can add up to substantial operational gains. ANY.RUN customers report 21 minutes less MTTR per incident. For a SOC handling 100 incidents monthly, achieving the same reduction would mean approximately 35 hours of cumulative response time saved per month.

How to Measure MTTR Reduction After AI Adoption

• Establish a baseline: Measure MTTR before introducing AI-assisted investigation workflows.
• Identify bottlenecks: Track validation, scoping, decision, and escalation times to see where improvements occur.
• Compare similar incidents: Measure results by incident type and severity to avoid misleading comparisons.

The goal is to establish how much faster your SOC can move from identifying a threat to taking effective action, and how that improvement affects response capacity.

AI Cybersecurity Risks for SOC Teams: What Can Go Wrong and How to Prevent It

AI can take repetitive work off a SOC’s plate. But when its outputs influence triage and response decisions, mistakes can have serious consequences.

For SOC leaders, adopting AI means understanding its limitations and putting the right safeguards in place. Here are five risks worth addressing before relying on AI for critical investigations.

1. Inaccurate or unverifiable conclusions

AI can misinterpret technical evidence or present uncertain findings with too much confidence. Without access to the underlying data, analysts may struggle to validate conclusions, justify response decisions, or prepare reliable escalations.

How to reduce the risk: Prioritize solutions that allow analysts to verify AI-generated conclusions against observable technical evidence.

2. Overreliance on AI recommendations

Under pressure to process growing alert volumes, analysts may begin accepting AI recommendations without sufficient verification. This can lead to missed threats, inappropriate response decisions, and unnecessary escalations.

How to reduce the risk: Establish clear review requirements for critical decisions, particularly incident closure, containment, and escalation.

3. Incomplete analysis of evasive threats

Multi-stage attacks may conceal malicious behavior behind CAPTCHA challenges, QR codes, redirects, and delayed execution. If automated analysis stops before reaching the malicious stage, the resulting findings may give analysts an incomplete picture of the threat.

How to reduce the risk: Choose solutions that can navigate complex attack chains and allow analysts to intervene when deeper investigation is necessary.

4. Attacks designed to manipulate AI

Attackers can embed malicious instructions in documents, websites, or other content processed by AI systems. Known as indirect prompt injection, this technique attempts to influence AI-generated conclusions or redirect automated actions.

How to reduce the risk: Treat attacker-controlled content as untrusted, limit the actions AI systems can perform, and validate conclusions against independent technical evidence.

5. Exposure of sensitive investigation data

Suspicious files, URLs, and investigation artifacts may contain confidential business or customer information. Processing them without appropriate safeguards can create privacy, security, and compliance risks.

How to reduce the risk: Evaluate data handling policies, access controls, private analysis options, and independently assessed security practices.

How ANY.RUN Helps SOC Teams Manage AI Risks Without Sacrificing Speed

Faster investigations shouldn’t come at the expense of accuracy, visibility, or data security.

ANY.RUN combines AI-assisted malware analysis with capabilities that help SOC teams maintain control over critical investigation decisions:

• Verifiable technical evidence: AI Summary and AI Recommendations are generated from sandbox findings, allowing analysts to examine the underlying activity rather than relying solely on AI-generated conclusions.
• Human control when it matters: Automated Interactivity handles repetitive actions, while analysts can take manual control of Interactive Sandbox whenever closer examination is needed.
• Deeper visibility into evasive threats: Automated Interactivity navigates embedded links, QR codes, CAPTCHA challenges, and multi-stage attacks to help expose malicious behavior that requires user interaction.
• Privacy and compliance: ANY.RUN offers private sandbox analyses and enterprise privacy controls to protect sensitive investigation data. Its SOC 2 Type II attestation and ISO 27001 certification demonstrate a commitment to independently assessed security controls and information security management.

The goal is to get the speed benefits of AI without giving up analyst oversight. With ANY.RUN, security teams can accelerate investigations while maintaining access to technical evidence, control over response decisions, and safeguards for sensitive data.

How to Evaluate an AI Cybersecurity Solution: 5 Key Criteria

AI capabilities can look impressive in a demonstration. But for SOC leaders, the real test is how they perform under growing alert volumes, tight response deadlines, and limited analyst capacity.

Use these five criteria to evaluate the operational and business impact of an AI cybersecurity solution.

Evaluate AI by what it changes in your SOC, not how many AI features appear on a product page. Better threat coverage, shorter response times, fewer escalations, and greater analyst capacity are the outcomes worth investing in.

Make Your Next SOC Investment Count

AI in cybersecurity is creating new opportunities for SOC teams to work more efficiently, investigate threats in greater depth, and make better use of their existing resources. The key is choosing capabilities that address real operational needs and deliver results beyond individual investigations.

As threats grow more complex and security demands increase, the greatest advantage comes from combining intelligent automation, human expertise, and actionable threat intelligence. Together, they can help SOC teams build the capacity to handle growing workloads while maintaining the depth and quality of their investigations.

The next step is turning that potential into measurable improvements across your security operations.

About ANY.RUN

ANY.RUN is a cybersecurity company providing cloud-based solutions for malware analysis and threat intelligence. Trusted by 700,000+ security professionals and 16,000+ organizations, ANY.RUN helps SOC teams and MSSPs detect threats, investigate suspicious activity, and respond to incidents faster.

Its solutions include Interactive Sandbox, which combines automated malware and phishing analysis with hands-on investigation capabilities, and Threat Intelligence Lookup and Feeds, which provide actionable intelligence on emerging threats and malicious infrastructure.

With AI-powered capabilities and integrations, ANY.RUN helps security teams reduce manual investigation work, improve threat visibility, and handle growing workloads without proportionally increasing resources.

Frequently Asked Questions

The post AI-Powered Malware & Phishing Analysis for SOC Teams: Cut Workload and Speed Up Response appeared first on ANY.RUN's Cybersecurity Blog.

The ANY.RUN team identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% of submissions coming from the United States. Activity increased from 20 analyses in June to 200 in September, highlighting the growing exposure of organizations relying on Microsoft 365.

Key Takeaways

• SkyW4lker is distributed through phishing emails with a password-protected malicious attachment; the password is provided in the email body. After a chain of decoy pages, the victim reaches a page that asks for a Microsoft device code.
• The kit consists of a PHP backend and obfuscated JavaScript. Its main features are IP-based geolocation of visitors and periodic polling of the backend to check whether the victim has completed authentication.
• ANY.RUN’s powerful new capability, Related Threat Context, helped analysts accelerate the SkyW4lker investigation by instantly surfacing connections to previous sandbox analyses. This reduced manual correlation work, enabled faster expansion of the campaign cluster, and ultimately helped uncover the phishing kit’s administration panel.
• As a result, 618 analyses were identified over the past six months (as of October 21, 2026), with monthly submissions growing from 20 in June to 200 in September. They were submitted mainly by organizations in the technology, manufacturing, and government sectors, most often from the United States, India, Canada, and the United Kingdom.
• SkyW4lker shares its JavaScript modules, landing-URL format, and part of its hosting infrastructure with Gabagool, a credential phishing kit active since April 2026. We assess with high confidence that both kits were built by the same developer.
• SkyW4lker exploits routine business workflows, using contracts, invoices, and service proposals as phishing lures. By directing employees through familiar platforms and legitimate Microsoft authentication pages, attackers make malicious requests harder to distinguish from normal business activity.

SkyW4lker Threat Overview

SkyW4lker Activity Across US Organizations

The United States accounts for 47% of SkyW4lker-related sandbox submissions, more than twice the share of any other country. With the campaign exploiting legitimate Microsoft authentication processes and routine business communications, these findings raise concerns for US enterprises about how effectively existing security controls can identify suspicious activity before it leads to account compromise.

What SkyW4lker Means for Enterprise Security

SkyW4lker highlights several security risks that organizations need to account for when protecting business-critical systems and employee identities:

• Identity security gaps: Device-code phishing can succeed even when MFA is enabled, raising questions about whether existing authentication policies sufficiently restrict unnecessary access methods.
• Detection challenges: Attackers abuse legitimate Microsoft authentication flows and trusted platforms, making it harder for security teams to distinguish malicious activity from normal employee behavior.
• Broader organizational exposure: A compromised account could provide access to multiple business applications and create opportunities for further attacks against employees, customers, and partners.
• Higher response costs: Investigating suspicious authentication activity, identifying affected resources, and containing unauthorized access can increase SOC workload and incident response costs.

Technical Analysis of SkyW4lker

You can examine the full SkyW4lker attack chain in this ANY.RUN Sandbox analysis.

View analysis session and gather IOCs

The attack unfolds in three main stages:

1. The attacker sends the victim a phishing email with a password-protected attachment. Typical subjects involve commercial offers, contracts, invoices, or confidential documents. The attachment is a PDF, DOCX, or XLSX file, and the password is provided in the email body.

2. The document contains a link to a CAPTCHA page. Some variants include an additional lure page hosted on a legitimate service such as Miro, Google Sites, or Zoom, which redirects the victim to the next step.

3. Finally, the victim is directed to a phishing page that instructs them to enter a device code on Microsoft’s legitimate authentication page, potentially granting the attacker access to their Microsoft 365 account.

The phishing page relies on obfuscated JavaScript functions and separate script files. Using ANY.RUN’s In-Browser Data Inspection, analysts can examine the page’s DOM and HTTP activity to understand how these scripts operate.

The scripts keep the page in regular contact with the PHP backend and determine the location of the victim from their IP address. Within the page DOM, the main script loads additional modules, sets click handlers on buttons and builds GET requests to the PHP endpoint /session_public.php with the action parameter (start or poll).

With action=start, the script sends the geolocation and IP address of the victim and receives a session ID. After that, it sends a request with action=poll every few seconds to check whether the victim has authenticated.

The other modules of the phishing page are listed below:

A Shortcut for the Entire Investigation: From One URL Into a Bigger Threat Picture with Related Threat Context

A single phishing URL can be the starting point for uncovering an entire campaign. In the SkyW4lker investigation, identifying the malicious page was only the beginning. Analysts needed to trace related activity, identify additional infrastructure, and determine how far the campaign extended. Traditionally, connecting these findings requires repeated IOC lookups, manual correlation, and searching through previous investigations.

ANY.RUN’s major new upgrade, Related Threat Context, makes this process significantly faster and easier. By bringing connections to previous sandbox investigations and threat intelligence directly into the Interactive Sandbox, it helps analysts discover related threats, reuse existing findings, and expand investigations with fewer manual steps.

With more than 700,000 security professionals and 16,000 organizations worldwide using ANY.RUN, analysts can draw on a vast pool of real-world investigation data to uncover connections that might otherwise take considerably longer to find.

How Related Threat Context Helped Uncover More of SkyW4lker

During our SkyW4lker investigation, the new Related analyses section surfaced previous sandbox sessions sharing the same URL patterns. This gave analysts an immediate starting point for tracing related activity instead of manually searching for connections across individual investigations.

Using the distinctive PHP endpoint /session_public.php, we moved into ANY.RUN Threat Intelligence Lookup in a single click, discovered additional phishing activity, and expanded the campaign cluster.

The investigation demonstrates the practical value of Related Threat Context: less time spent searching for connections, faster discovery of related infrastructure, and more evidence available to guide the next investigation step.

Reduce Manual Triage and Strengthen SOC Investigations

The same approach can be applied to other suspicious URLs and indicators, allowing SOC teams to build on previous investigations and uncover related threat infrastructure faster.

Tier 1 analysts spend less time on repetitive IOC research, gaining more evidence to support accurate triage and escalation decisions. Tier 2 analysts receive richer investigation context, helping them focus on cases that genuinely require deeper analysis.

By connecting individual alerts to existing threat intelligence, Related Threat Context helps SOC teams shorten investigation cycles, reduce unnecessary manual work, and make better-informed response decisions.

Attribution: The Connection Between SkyW4lker and Gabagool

Each phishing page has its own backend, so the administration panel is likely to be hosted on the same domain. Further analysis of the Threat Intelligence Lookup results and data from other sources revealed an administration panel at /admin/index.php.

The CSS styles (command-center.css) suggest the following capabilities of the kit:

• Authentication with MFA via Telegram
• Dashboard with victim statistics based on the client_geo.js module
• Server management
• Generation of new links
• Live notifications about new visits to phishing links

Further investigation revealed another important finding: SkyW4lker shares several technical components with Gabagool, a credential phishing kit.

A search in ANY.RUN Threat Intelligence for the unique module paths of SkyW4lker url:”/js/client_geo.js” or url:”/js/url_helper.js” or url:”/js/endpoint.js”) also returns sandbox sessions tagged gabagool. Gabagool was first observed on 23 April 2026, two months before SkyW4lker, and has used the endpoint.js and url_helper.js modules since late April and early May. The two kits share several other features:

Moreover, some sandbox sessions tagged gabagool load the kit from directories named skywalker:

goldcreekconcrete[.]com/example/skywalker/ (sandbox session) and goldcreekconcrete[.]com/skywalker/example/ (sandbox session). On goldcreekconcrete[.]org, which also hosted Gabagool (sandbox session), the directory /skyw4lker/skydirectory/ with the same modules appeared on 29 September (sandbox session).

We therefore assess with high confidence that Gabagool and SkyW4lker are built by the same developer. Gabagool harvests logins and passwords through accounts.php, whereas SkyW4lker abuses the device-code flow through session_public.php, so we regard them as two attack modes of one platform. The identical directories on shared hosts may also point to a common operator; however, the available data does not allow us to distinguish one operator from several customers of the same platform.

How to Detect SkyW4lker and Reduce Enterprise Exposure

The SkyW4lker investigation reveals several technical indicators and attack patterns that security teams can use to identify related phishing activity. For organizations, these findings also highlight opportunities to strengthen identity security and reduce the impact of potential account compromise.

For SOC Analysts and Threat Hunters

• Hunt for SkyW4lker’s technical fingerprints. Look for requests to /session_public.php?action=start and repeated /session_public.php?action=poll calls. Check the JavaScript modules and URL patterns identified in this research to uncover related infrastructure.

• Connect phishing activity with suspicious sign-ins. Monitor Microsoft Entra ID logs for unexpected device-code authentication, particularly following suspicious emails or document-sharing requests. Correlating authentication events with phishing indicators can help identify potential account compromise.

• Expand investigations beyond individual IOCs. ANY.RUN’s newly introduced Related Threat Context puts connected sandbox analyses at analysts’ fingertips, with a one-click pivot to threat intelligence context for deeper threat hunting. In the SkyW4lker investigation, this helped expand the campaign cluster, while further analysis revealed shared infrastructure and code similarities with Gabagool.

• Investigate potential follow-on activity. When account compromise is suspected, review subsequent Microsoft 365 activity to identify affected resources, unauthorized access, and possible attempts to target other users.

For CISOs and Security Leaders

SkyW4lker demonstrates why organizations need to look beyond traditional phishing prevention and MFA when evaluating identity security. Three priorities deserve attention:

• Close authentication policy gaps. Review where device-code authentication is genuinely required. Restrict or block unnecessary use through Microsoft Entra Conditional Access to reduce opportunities for attackers to abuse legitimate authentication flows.

• Strengthen detection across email and identity systems. Ensure the SOC can connect suspicious attachments, phishing infrastructure, and unusual authentication events. Better visibility across these stages helps teams identify potential compromises before attackers expand their access.

• Reduce investigation time and escalation costs. Equip Tier 1 analysts with historical threat context and clear escalation criteria. Establish procedures for containing compromised accounts and reviewing unauthorized activity, helping Tier 2 teams focus on incidents requiring deeper investigation.

Conclusion

SkyW4lker continues to evolve, with new endpoints, changing URL patterns, and growing activity across sandbox analyses. Its connection to Gabagool suggests that the same developer is supporting both device-code and credential phishing, giving attackers different ways to compromise business accounts through shared infrastructure.

For organizations, the findings highlight a broader security challenge: attackers are increasingly exploiting legitimate authentication processes and trusted business services, making malicious activity harder to distinguish from normal operations.

As phishing kits evolve, security teams need more than traditional email filtering and MFA. Stronger identity controls, visibility into suspicious authentication activity, and access to connected threat context can help SOCs identify attacks earlier, investigate them faster, and reduce the potential impact on business operations.

About ANY.RUN

ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams detect and investigate threats, make faster decisions, and reduce the time and resources spent on incident response.

The company’s solutions include Interactive Sandbox for analyzing suspicious files, URLs, and phishing attack chains, and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. Together, these solutions help security teams uncover related threat activity, track evolving attack infrastructure, and strengthen detection with intelligence from real-world investigations.

Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data.

TTPs (MITRE ATT&CK)

IOCs

All indicators were observed in ANY.RUN analyses between 23 June and 21 October 2026.

URL patterns:

Domains hosting the phishing kit (173):

0350pvas.acs-wcst[.]com

0ff365access.mooo[.]com

0utlook0ffice365admin.twilightparadox[.]com

1355bcra.ck29material[.]com

1717emxr.acs-wcst[.]com

5200m[.]com

5375jngu.prefform[.]us

6662nyde.acs-wcst[.]com

6695lkmo.prefform[.]us

7301eqny.acs-wcst[.]com

7criccasinobonus[.]cc

aachem-za[.]co

accordhealth[.]cc

acrobat-adobe-com-4464uswc.egllo[.]com

advancedsteelbuilding[.]com

alasilla[.]com

albertamo[.]com

alfabricationinc[.]com

apexpartsdepot[.]com

apinows[.]com

atlantictriad.ignorelist[.]com

atlassgroupinc[.]com

auth-loadingdocuments[.]online

auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com

authorize.copilot.outlook.common.microsoft0365.atlarchitacts[.]com

awemode.outlookoffice365.microsoftcopilots.docshare.linnwest[.]us

azgymfloor[.]com

bandg-electrics[.]com

bennett002.mooo[.]com

bezpartien[.]online

bigbrain.chickenkiller[.]com

bloomfleldcapital[.]com

bramum[.]online

buckslu[.]org

bxcelcounselling[.]org

caine-wenier[.]com

calebchemicals[.]com

calmechc[.]net

canacedesotogroup[.]com

celestialtremor[.]org

celliottelliott-wellman[.]org

celvarioncorn[.]org

centipedtourspa[.]com

claronevents[.]com

cleggs.my03[.]com

clingard[.]pro

clubdenut[.]club

copilot.login.office365outlook.cloud.onedrive.atlarchitacts[.]com

copilots.outlook.cloud.microsoft.andersonelevators[.]com

copilots.outlook.cloud.microsoft.syrosconstructlon[.]com

coreansdmain[.]com

csr-rooflng[.]com

ctr-wooding[.]com

darap-it[.]co

detroitgardenswork[.]com

devtachsales[.]com

dguidrycardinazprofessional[.]com

docshare.auth.copilot.outlook.onedrive.common.earthlink-net[.]com

docshare.auth.copilot.outlook.onedrive.common.evergreenerg[.]com

docshare.auth.copilot.outlook.onedrive.common.northemheating[.]com

docshare.auth.copilot.outlook.onedrive.common0.evergreenerg[.]com

docshare.auth.copilot.outlookonedrive.common.northemheating[.]com

docshare.auth2026.onedrive.outlooksdocument.csr-rooflng[.]com

docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng[.]com

document.akiflx[.]com

dpincoli[.]com

dutchfarrms[.]com

eccentric-authentication[.]com

ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc[.]com

efaxdoc.auth.login.outlook.office365.tescoccontrols[.]com

efaxdoc.auth.outlook2026common.copilos26.bettylnc[.]com

efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr[.]com

efaxdoc.auth.outlook2026common.copilos26.kone-inc[.]com

efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc[.]com

efaxdoc.documents2026.docs.shared.lakeviewscustom[.]com

eurosforgroup[.]com

flow505.mooo[.]com

flow55.chickenkiller[.]com

fosterswifts[.]com

frontdesk[.]click

gcotoncovingtoncontracting[.]com

ghethim[.]com

glafondbottamconstruction[.]com

globlasumi[.]com

gregor.justdied[.]com

grincool[.]xyz

haevy-llc[.]com

hcnyecom[.]com

hivezoom[.]com

ideahom[.]world

incommecialre[.]com

innvisoin[.]net

insigthinvestments[.]com

investomind[.]biz

jacobpwpinc[.]org

jjnysnobiogtx[.]org

kilishy.qhigh[.]com

kuer[.]online

lampadasdeslgn[.]com

lawyer.cuztools[.]com

lifetimeroofsystem[.]net

linking.mefound[.]com

linogomes-pt[.]cc

lionheartsecurityservice[.]com

liyuda[.]com

login.microsoft365.outlook.copilotsoffice365.lntactpr[.]com

login.office365outlooks.microsoft.cloud-outlook.naregruop[.]com

m365cloud.login.outlook.office365.azgymfloor[.]com

maqaigiapelhani[.]cam

metlarnelaw[.]com

metrorocl.co[.]uk

mgproparties[.]com

minda-mo[.]com

mouphyweb[.]com

naregruop[.]com

nicewayrealestate[.]cc

noxband[.]com

off365acess.jumpingcrab[.]com

off365mail[.]club

office0365login.2waky[.]com

outlookdrive.microsoftonline.common.oauth2.client.buycerm[.]com

outlookoffice365.microsoftcopilots.vigilantlnc[.]com

paulecosconnect[.]com

payapp.auth.outlook2026common.copilos26.bettylnc[.]com

pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr[.]com

pdlhaelth[.]com

pdocshared.documents2026.docs.shared.ecmholdlnggroup[.]com

pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com

photosofus[.]com

plusoptlx[.]com

priorispace[.]biz

psionicsandhorses[.]net

rapid-scale[.]net

reauth.copilot.auth.outlook.mcloud365.buycerm[.]com

reauth.copilot.auth.outlook.mcloud365.myhalnc[.]com

reauth.copilot.common.outlook.mcloud365.atlarchitacts[.]com

reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras[.]com

rektham[.]online

rubinsrudman[.]com

rustlnsurance[.]com

sdocshares.auth.outlook.copilos26.general.csr-rooflng[.]com

sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com

sdocshares.authoutlooks.common.copilots2026.hathormson[.]com

seatacsmarine[.]com

sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer[.]com

shared.paymentsclouds.statementsapproved.jetbusinesscapltal[.]com

slybee[.]com

snk-s[.]org

solutions00fileptroduct[.]com

sorensenmaysflower[.]blog

statement.docdriveoauth.authorized.copilot.syrosconstructlon[.]com

statement.outlookoffice365.microsoftcopilots.calmechc[.]net

statements.outlook.office365microsoft.payment.run.stoneclty[.]com

stellarntis-fs[.]com

studeseliamechan[.]link

sunraycontractlng[.]com

sunstateaquips[.]com

swiftii.chickenkiller[.]com

tentkit[.]com

thepaybank[.]com

thewiginton[.]com

topcoatmetalsfinishing[.]com

toplinebuy[.]com

torvion[.]life

unitadrentals[.]com

unitedwirescompany[.]com

us-agricultures[.]com

vasquezmyth[.]com

westlakeproduces[.]com

whitfillsnursery[.]com

wsochares.authpayments.common.paid2026.bullochdirtwroks[.]com

wwriwashingtonenergy[.]com

zrs-wooding[.]com

The post SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises appeared first on ANY.RUN's Cybersecurity Blog.

An IP address, domain, file hash, or suspicious URL can trigger a detection, but an analyst still needs to understand what it is, whether it is connected to known malicious activity, and what happened around it. The longer it takes to build that context, the longer an alert remains unresolved.

Threat context helps shorten that gap. By enriching telemetry with real-time intelligence and behavioral evidence, security teams can move from “What is this?” to “What should we do next?” much faster.

The Problem with Investigating IOCs in Isolation

Modern SOCs have plenty of telemetry. The problem is that much of it arrives without enough context to support an immediate decision.

SOC telemetry often surfaces individual pieces of evidence: a suspicious IP connection, a potentially malicious URL in an email, or an unusual file detected on an endpoint. None of these signals provides enough information on its own to determine the scope or significance of the activity.

An analyst may need to search several intelligence sources, investigate related infrastructure, check historical activity, and potentially submit the artifact to a sandbox. For a single alert, that may be manageable. Across thousands of alerts, it becomes a significant operational burden.

The challenge becomes even greater for MSSPs, where teams need to maintain consistent investigation quality across multiple customer environments.

The answer is not simply more intelligence — it is context that reaches the analyst at the right point in the workflow.

Real-Time Intelligence Can Give an Alert a Head Start

Not every alert needs to start with a manual investigation. If an IOC has already been observed in malicious activity, that context can be applied as soon as the indicator appears in telemetry.

Threat intelligence feeds make this possible by continuously supplying security teams with known malicious indicators and the context associated with them. When connected to detection systems, they can help identify suspicious IPs, domains, URLs, and other IOCs as they appear, giving analysts an initial assessment before they begin a deeper investigation.

ANY.RUN’s Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, and URLs enriched with sandbox-based intelligence. The feeds draw on activity from more than 16,000 organizations and 700,000 security professionals, giving SOCs and MSSPs visibility into threats observed beyond their own environments.

That broader visibility can matter when attackers rotate infrastructure quickly. If an endpoint connects to a suspicious domain, the SOC can check it against current intelligence rather than waiting for an analyst to establish its history manually.

TI Feeds can be integrated into existing security infrastructure through API/SDK and STIX/TAXII, including SIEM, TIP, XDR, and other systems. Threat intelligence can therefore become part of the detection workflow rather than a separate destination analysts visit after an alert arrives.

Up to 30% of Malicious IOCs May Already Be in Your Intelligence

ANY.RUN’s internal analysis provides a useful indication of how this can work in practice.

Up to 30% of unique malicious IOCs discovered in Interactive Sandbox analyses had already been observed by ANY.RUN and were present in TI Feeds.

That means that when one of those IOCs appears in SOC or MSSP telemetry, the security system can potentially match it against existing intelligence before the analyst manually investigates the associated file or URL in the Sandbox.

This gives security teams an opportunity to identify and prioritize malicious activity earlier.

The value is not just knowing that an IOC is malicious. Existing intelligence can provide a starting point for the investigation: what has been observed, what infrastructure is associated with it, and whether the indicator has appeared in other malicious activity.

Instead of spending the first part of an investigation collecting basic context, analysts can focus on validating impact and deciding what response is appropriate.

Adding Behavioral Context to the Investigation

Threat intelligence can provide valuable context around an indicator, but analysts may still need to understand what a suspicious file, URL, or other artifact actually does. Behavioral analysis adds that evidence by executing the artifact in a controlled environment and capturing the activity it generates.

ANY.RUN’s Interactive Sandbox lets analysts investigate suspicious files and websites in isolated environments. Virtual machines start in under 10 seconds, with analysis reports available in around 40 seconds, helping SOCs and MSSPs get behavioral evidence quickly without waiting for a lengthy analysis cycle.

Reports capture processes, network connections, file and registry changes, screenshots, and MITRE ATT&CK techniques, giving analysts a detailed view of the activity behind an alert.

The results can also expand the investigation. A document that launches PowerShell and downloads another payload can reveal new hashes, domains, IPs, or other indicators. A phishing URL can expose redirects, scripts, additional domains, or downloaded files. These findings can then be investigated alongside existing threat intelligence, helping analysts connect individual artifacts to the broader activity.

Threat intelligence and behavioral analysis therefore work together: intelligence provides context from known activity, while sandbox analysis can generate new evidence about an attack, uncover additional indicators, and reveal how they are connected.

Investigate Beyond a Single IOC with ANY.RUN’s New Related Threat Context

A single IOC can point to activity far beyond the investigation where it was found. An IP address uncovered during sandbox analysis, for example, may have appeared in previous investigations, surfaced in activity targeting your industry, or already been linked to known threats.

ANY.RUN’s Related Threat Context brings these connections directly into Interactive Sandbox, giving Enterprise clients access to intelligence from a community of 700,000+ security professionals across 16,000+ organizations to help assess indicators and decide what to investigate next.

View a Sandbox analysis to see Related Threat Context in action

Related analyses give SOC teams more context around IOCs to guide response

Related Threat Context combines three sources of insight:

• Team Context: See whether your team has investigated the IOC before.

• Industry Context: Check how the IOC appears in activity across your industry.

• ANY.RUN Threat Intelligence: Discover known malicious indicators and related threat activity across the ANY.RUN ecosystem.

MSSPs can access Team Context and ANY.RUN Threat Intelligence to enrich investigations across their workflows, while Industry Context is designed for internal SOCs.

Related Threat Context also helps analysts quickly gauge how familiar an indicator is with “Never Seen Before” and “Commonly Seen” indicators.

When an IOC warrants a closer look, analysts can pivot to Threat Intelligence Lookup to explore it further or consult Threat Intelligence Reports for deeper insight into specific threats and campaigns.

The result: Less time spent chasing context across separate tools and more time understanding what an IOC means for the investigation at hand.

Better Context Can Reduce Unnecessary Escalation

The more context triage has upfront, the fewer cases need to move to senior analysts. When Tier 1 has access to current intelligence, behavioral evidence, and related investigation context, more cases can be resolved with confidence at the initial level. SOCs and MSSPs using ANY.RUN TI report a 30% reduction in Tier 1-to-Tier 2 escalations.

That does not mean eliminating escalation. It means reserving senior analyst time for cases that genuinely require deeper expertise.

When analyst capacity is under pressure, better context provided by ANY.RUN can reduce the workload on Tier 1, with a 20% decrease in Tier 1 workload.

For security leadership, those improvements translate into more capacity from the existing SOC rather than simply adding more people to handle growing alert volumes.

Connecting the Dots Across an Investigation

One of the strongest benefits of connecting sandboxing and threat intelligence is that the relationship works in both directions.

Threat Intelligence Feeds can identify an IOC discovered in telemetry as something already associated with malicious activity. When Sandbox analysis reveals additional infrastructure or indicators, those findings can be checked against the same intelligence to determine whether they are already known or require further investigation.

This creates a useful feedback loop. A suspicious attachment can lead to a domain, an IP address, additional files, and several ATT&CK techniques. Known indicators can be enriched through TI Feeds, while previously unseen indicators can be investigated further and potentially become valuable intelligence for future detection.

The same findings can then support threat hunting and detection engineering across the environment, helping analysts determine whether they are dealing with an isolated artifact or activity connected to a larger operation.

The investigation becomes iterative rather than linear: telemetry generates indicators, intelligence adds context, and analysis produces new evidence for the next investigation.

Conclusion

Threat context is most valuable when it reaches analysts early enough to influence what happens next. Real-time intelligence can enrich telemetry, sandbox analysis can reveal new evidence, and related context can connect those findings to broader threat activity.

Together, these capabilities reduce the time spent collecting and validating evidence, helping SOCs and MSSPs prioritize faster, investigate more efficiently, and make more confident response decisions.

The goal is simple: Put the right intelligence in front of analysts early enough to change the outcome of an investigation.

About ANY.RUN

ANY.RUN helps security teams investigate cyber threats and turn findings into actionable intelligence. Its solutions are used by 700,000+ cybersecurity professionals across 16,000+ organizations, including 74 of the Fortune 100.

With Interactive Sandbox, analysts can examine suspicious files and URLs in a safe, interactive environment and see malicious behavior as it unfolds.

Threat Intelligence Feeds bring malicious indicators into existing security workflows, while Threat Intelligence Lookup helps teams explore IOCs and uncover connections between threats. For a deeper view of threat actors, campaigns, and emerging activity, Threat Intelligence Reports provide additional research and analysis.

FAQ

The post Cyber Threat Context for Early Response: Enriching SOC Telemetry with Real-Time Intel from 16K Organizations appeared first on ANY.RUN's Cybersecurity Blog.

Now, all that valuable context is finally within reach!

With Related Threat Context, now available to ANY.RUN Enterprise clients, SOC and MSSP teams can immediately see these connections alongside IOCs found during Interactive Sandbox analysis and explore relevant findings. This helps Tier 1 analysts reduce time-to-triage, identify what deserves closer investigation, and make better-informed decisions about which cases to prioritize or escalate.

The Problem: Missing IOC Context Slows Down Triage

A Tier 1 analyst investigates a suspicious URL in ANY.RUN Interactive Sandbox. The analysis reveals malicious behavior and several IOCs, but the analyst still needs to decide whether to close the case, investigate further, or escalate it.

Relevant context may already exist in previous team investigations, industry-related analyses, or ANY.RUN Threat Intelligence. Yet analysts may spend time searching for it manually or make decisions without knowing it’s available.

The result is longer time-to-triage, duplicated investigations, and unnecessary Tier 2 escalations.

But not anymore!

Related Threat Context makes these connections visible directly in the Sandbox, helping analysts discover useful intelligence earlier and make faster, better-informed decisions.

The Triage Boost You’ve Been Waiting For: Related Threat Context

When ANY.RUN identifies an IOC during a sandbox analysis, Related Threat Context can surface three types of information.

• Industry Context: Shows whether an IOC has appeared in analyses associated with the organization’s industry, helping internal SOCs prioritize indicators that deserve closer investigation. Industry data is anonymized, and a match is an additional signal rather than proof of targeting. This context is unavailable to MSSPs.

• Team Context: Connects IOCs with previous team Sandbox analyses, allowing analysts to reuse existing findings, avoid duplicate investigations, and coordinate with colleagues across shifts.

• ANY.RUN Threat Intelligence: Shows when additional intelligence is available and provides a direct path to Threat Intelligence Lookup (TI Lookup), where analysts can investigate related samples, malicious infrastructure, and attack behavior.

From Analysis to Enrichment

Related Threat Context makes the transition from sandbox analysis to enrichment more visible. When an IOC has relevant history in the analyst’s industry, team investigations, or ANY.RUN TI, that context appears directly in the Interactive Sandbox and can guide the next step.

In practical terms:

Alert → Interactive Sandbox analysis → Related Threat Context → TI enrichment → Decision → Escalation or response

SOCs and MSSPs do not need to search threat intelligence first or know in advance that an IOC is worth investigating. They can see when additional context is available and decide whether it is relevant to the case.

This also gives the next analyst a clearer starting point, with related investigations and intelligence available instead of having to rebuild the context from scratch.

Turning Threat Context into Operational Value

The impact of Related Threat Context extends beyond individual investigations.

• Greater SOC efficiency: Teams can prioritize threats faster without relying on constant manual enrichment.

• Lower MTTR: Analysts can reach relevant context and make investigation decisions sooner.

• More proactive defense: Greater access to actionable threat intelligence helps teams identify related activity and strengthen detection and response.

• Higher SOC maturity: A more connected approach to analysis, intelligence, and response supports a more consistent and scalable SOC operating model.

Use Case #1: Uncover Additional Kali365 Infrastructure with Related Threat Context

A sandbox analysis may reveal only part of the infrastructure behind a phishing campaign.

Related Threat Context can help SOC and MSSP teams expand that picture by connecting the current sample with other scans and providing a starting point for further TI investigation. To access it, click the Related analyses section in the top right corner of the screen during a sandbox session.

Let’s take this Kali365-related investigation, for example. In Related analyses, security teams can see a large number of malicious scans connected through the same URL.

View analysis

Analysts can then select that URL and open it in ANY.RUN Threat Intelligence Lookup to investigate the infrastructure associated with it. To focus the search, the results can be filtered to show only malicious domains.

Check the query in TI Lookup

The next step is to compare these results with the domains already visible in the original sandbox analysis. In this case, only register[.]rsvpconnect-events[.]com appeared in the original scan. The other domains were not visible there, making them candidates for further investigation.

For example, let’s check ydgjgdbhoa[.]shifts[.]icu in TI Lookup. The search shows that the domain is associated with Kali365-related activity.

View in TI Lookup

By following these connections, the analyst discovers additional domains associated with Kali365 that were missing from the original sandbox analysis.

This gives Tier 1 concrete evidence to justify further investigation or escalation, rather than passing along the original IOC alone. The newly identified domains can be included in the case for Tier 2 to validate against internal SIEM or EDR telemetry and determine whether the related infrastructure has appeared in the organization’s environment.

The outcome: Related Threat Context helps analysts identify the next investigation steps earlier, make better-informed triage decisions, and give Tier 2 a more actionable starting point without repeating the initial research.

Use Case #2: Reduce Triage Time by Uncovering the Context Behind a Single IOC

See how Related Threat Context helps analysts move from a single IOC to the bigger threat picture.

In this example, a malicious IP discovered during a Sandbox analysis leads to related activity in ANY.RUN Threat Intelligence, revealing a recurring JavaScript → PowerShell → .NET delivery chain and giving analysts a clear direction for further investigation.

View the Sandbox session or watch the analysis on YouTube

Signals for Prioritization: Never Seen Before and Commonly Seen

Related Threat Context also provides ready-made signals that help analysts decide where to focus their attention. Instead of requiring teams to interpret raw historical data themselves, these signals immediately show whether an indicator stands out or is commonly encountered in related activity.

• Never Seen Before — the indicator has not appeared in the available related context before. This can signal that a SOC or MSSP is encountering something unusual or unique, making the indicator worth a closer look.

• Commonly Seen — the indicator appears frequently across related activity. This can help analysts deprioritize indicators that are widely observed and often represent generic or non-specific activity, such as library loading, widgets, or common network connections.

These signals are not verdicts. A Never Seen Before indicator is not automatically malicious, while a Commonly Seen indicator is not automatically harmless. Instead, they give security teams an immediate way to allocate attention and combine historical context with the object’s behavior, verdict, and other available evidence.

What Changes for Different SOC Roles with Related Threat Context?

The same context provides different value depending on where an analyst sits in the workflow.

Triage: Make the Next Decision Faster

For triage, Related Threat Context is primarily about answering questions like:

Close it? Investigate further? Enrich it in TI? Escalate it?

Teams can now make that decision with more evidence available at the point of triage instead of manually reconstructing the threat picture first.

Incident Response and Threat Hunting: Start with More Context

For deeper investigation teams, the benefit is a better starting point.

Related analyses, team knowledge, infrastructure, and TI context can accompany an escalation, allowing the next analyst to spend more time on the investigation itself rather than repeating the enrichment that came before it.

SOC Leads and Managers: Make Team Knowledge Reusable

As SOC teams grow, analysts on different shifts can encounter the same infrastructure without knowing that someone else has already investigated it.

Related Threat Context creates a visible connection between those investigations.

The team can compare the previous and current cases, involve the analyst who already has relevant knowledge, and determine whether previous findings were converted into detection, blocking, hunting, or response improvements.

CISOs and Heads of SOC: Connect the Security Workflow

For security leaders, the value is broader than enrichment.

Connected context can support faster triage, fewer escalations caused purely by uncertainty, more focused use of Tier 2 expertise, better reuse of knowledge across shifts, and stronger visibility into activity relevant to the organization’s industry.

Conclusion

An IOC is rarely the end of an investigation. It can be the starting point for understanding related activity, validating previous findings, or deciding whether a case needs deeper analysis.

Related Threat Context makes those connections visible while the analyst is already working in the Interactive Sandbox, helping turn an isolated finding into a more informed next step.

The result is a more connected investigation workflow, where sandbox analysis and threat intelligence work together to support faster, better-informed security decisions.

About ANY.RUN

ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams investigate threats, make faster and more informed decisions, and turn threat intelligence into practical actions across detection, investigation, and response.

The company’s solutions include Interactive Sandbox for enterprise malware analysis and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. That gives security teams access to continuously updated intelligence derived from live threat analysis.

Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data.

FAQ

The post Your New MTTR Shortcut — Introducing Related Threat Context: Cut Time-to-Triage with Actionable IOC Context appeared first on ANY.RUN's Cybersecurity Blog.

Among the biggest challenges SOC teams face is making sure they not only detect and investigate threats, but doing so quickly enough to make the right security decisions without overwhelming analysts or increasing operational costs.

In this article, ANY.RUN explores how better threat visibility and automation can help US-based SOCs achieve this, using a real phishing investigation and metrics to demonstrate how faster triage translates into greater ROI from existing SOC investments.

Key Takeaways

• Faster triage reduces investigation costs. A healthcare MSSP achieved 76% faster phishing triage with ANY.RUN, reducing investigation time from 30–40 to 4–7 minutes.

• Better visibility supports faster decisions. Behavioral analysis and automation help analysts identify genuine threats without lengthy manual checks.

• More cases resolved at Tier 1 improve SOC capacity. In the same customer case, the Tier 1 closure rate increased from 20% to 70%.

• Higher SOC ROI starts with existing resources. Fewer unnecessary escalations, faster investigations, and better resource utilization help teams scale efficiently.

The SOC Efficiency Challenge: What the Numbers Reveal

SOC teams face a difficult balancing act: alert volumes keep growing, but the time and resources available to investigate them remain limited. Analysts must sort through potentially harmless activity while ensuring that genuine threats don’t go unnoticed.

Recent Microsoft research highlights the scale of the problem:

According to a 2026 Microsoft and Omdia study, 42% of security alerts go uninvestigated, while 46% of respondents believe that more than half of their alerts are false positives.

This means SOC teams spend valuable time filtering out false alarms while a significant share of alerts never receive proper investigation, potentially leaving real threats undetected.

The consequences go beyond analyst fatigue. A total of 91% of surveyed security leaders reported serious security incidents caused by operational gaps.

For US-based organizations, this highlights a critical priority: reduce the time spent on false positives and routine checks to improve efficiency and get greater value from your security investments.

How Visibility and Automation Helps SOCs Increase ROI

Increasing SOC ROI starts with helping analysts make accurate decisions faster, without adding unnecessary manual work or operational costs.
It takes providing analysts with enough information to make accurate decisions for them to avoid spending unnecessary time on manual checks and switching between security solutions.

According to ANY.RUN data, two capabilities have proved to make most difference: visibility into actual threat behavior and automation of repetitive investigation steps. That’s what helps Tier 1 and Tier 2 analysts distinguish genuine threats from false positives, prioritize incidents, and decide when further investigation or response is needed:

• Identify threats faster. Interactive Sandbox reveals actual file and URL behavior, from phishing chains to malware activity, with a median threat detection time of just 14 seconds.

• Reduce manual investigation. Automated Interactivity, integrations, and API access streamline repetitive steps, helping analysts move from alert to decision faster.

• Turn findings into action. Ready-made reports and AI recommendations support informed response decisions, helping reduce unnecessary Tier 1-to-Tier 2 escalations by up to 30%.

• Detect known threats earlier. Around 30% of unique malicious IOCs in studied Sandbox sessions were already present in Threat Intelligence Feeds before investigation, allowing teams to identify some threats without separate Sandbox analysis.

These numbers are achieved through accessible, automated behavioral analysis of URL and file submissions offered by ANY.RUN.

It gives analysts the evidence they need to assess alerts and make informed response decisions. Instead of relying on static indicators or reputation scores alone, SOC teams can see what a suspicious file or URL actually does, identify malicious activity, and move from alert to verdict with fewer manual steps.

Use Case: Phishing Investigation, Done Right

In a typical phishing investigation, an analyst may need to manually extract suspicious URLs, follow redirects, and navigate CAPTCHAs before reaching the actual threat.

This real phishing investigation in ANY.RUN shows how this process can be streamlined.

View analysis

The email contains a QR code leading to a credential-harvesting page disguised as Microsoft 365. Instead of manually navigating the phishing chain, the analyst can rely on Automated Interactivity to extract the URL, follow redirects, and complete the CAPTCHA to reveal the phishing page.

Meanwhile, Interactive Sandbox automatically captures the attack behavior, network activity, and related IOCs, organizing the evidence across the process tree and other analysis tabs.

Even with a multi-step phishing chain like this, Tier 1 can get an initial verdict within seconds. Across ANY.RUN analyses, the average mean time to detect (MTTD) is just 14 seconds.

Once the analysis is complete, the analyst can generate a Tier 1 report containing the verdict, AI-generated summary, and recommended next steps. In this scenario, these recommendations can help the team look for similar phishing emails, identify users who may have opened the page, and investigate potential credential exposure.

This workflow can be further accelerated using ANY.RUN’s selection of ready-made integrations as well as API/SDK capabilities. As noted by one of ANY.RUN’s MSSP clients, this setup significantly contributes to triage speed:

Threat Intelligence adds another layer of context. Threat Intelligence Lookup helps determine whether the extracted indicators have appeared in other investigations and what behavior they were associated with. Meanwhile, Threat Intelligence Feeds deliver verified malicious IOCs into existing security workflows, supporting earlier detection of related threats.

The key outcome isn’t simply a completed analysis, but a faster, evidence-based decision.

With a confirmed verdict, enriched threat data, and a structured report, Tier 1 can determine whether to close the alert or escalate the incident. If further response is needed, the next team receives the relevant findings without having to repeat the investigation.

This approach helps SOC teams resolve more cases at Tier 1 and reserve specialist time for complex threats. Across customer workflows, ANY.RUN helps reduce Tier 1-to-Tier 2 escalations by up to 30%, improving response efficiency without increasing analyst workload.

76% Faster Triage: Measuring the Impact on SOC Operations

The phishing example shows how individual investigations can become faster and more efficient. But here’s what happens when these improvements are applied across an entire SOC:

Turning Faster Triage Into Higher SOC ROI

For US-based SOCs, increasing ROI doesn’t necessarily mean investing in more security solutions or expanding headcount. It starts with getting more value from existing resources.

By combining behavioral visibility, automation, and actionable threat intelligence, SOC teams can investigate more alerts, resolve more cases at Tier 1, and reduce the time spent on manual work and unnecessary escalations.

As the 76% faster triage example demonstrates, these operational improvements can translate into greater analyst capacity, lower investigation costs, and stronger returns on SOC investments.

About ANY.RUN

ANY.RUN provides interactive malware analysis and actionable threat intelligence for SOC teams and MSSPs. Its Interactive Sandbox, TI Lookup, and TI Feeds help organizations detect threats faster, automate investigations, and make informed response decisions.

Trusted by 16,000+ organizations worldwide and 74 of Fortune 100 companies, ANY.RUN helps security teams improve operational efficiency and maximize the value of their security investments.

FAQ

The post 76% Faster Triage: How US SOCs Increase ROI Through Visibility and Automation appeared first on ANY.RUN's Cybersecurity Blog.

That makes threat intelligence a core part of the process. It helps define what should be tested, which TTPs matter, and which attack paths are most relevant to the organization.

Let’s look at the main TLPT requirements explained in practice, where threat intelligence fits into DORA TLPT, and what teams need to get right before testing begins.

What Are the DORA TLPT Requirements?

The Digital Operational Resilience Act (DORA), established under Regulation (EU) 2022/2554, sets cybersecurity and operational resilience requirements for financial entities across the European Union.

Under DORA Article 26 TLPT, certain financial entities must carry out threat-led penetration testing at least once every three years. The DORA TLPT frequency can be adjusted depending on the entity’s risk profile and operational circumstances.

The framework is maintained by the European Central Bank (ECB), while the DORA TLPT standards were developed by the European Supervisory Authorities — EBA, EIOPA, and ESMA — in cooperation with the ECB.

The DORA TLPT scope must cover several or all critical or important functions and include the ICT systems, processes, and technologies that support them. Testing is carried out on live production systems, which is one of the main differences between TLPT and more conventional security assessments.

The detailed methodology is set out in the Regulatory Technical Standards under Commission Delegated Regulation (EU) 2025/1190. These rules define how TLPT should be scoped, prepared, executed, and followed by remediation.

How TIBER-EU Fits into DORA TLPT

The TIBER-EU framework DORA connection is straightforward. DORA sets the regulatory requirements for TLPT, while TIBER-EU provides a practical framework for carrying out threat intelligence-based red team testing.

The updated TIBER-EU framework closely follows the DORA TLPT process, covering scoping, threat intelligence, red team testing, purple teaming, and reporting.

For financial organizations, this means TLPT is not just about testing systems for weaknesses. The exercise should reflect the threats, techniques, and attack paths that are actually relevant to the organization.

The Main TLPT Phases Under DORA

The TLPT phases DORA follows are grouped into three main parts: preparation, testing, and closure. The testing phase covers both threat intelligence and active red team testing, while reporting, replay, purple teaming, remediation planning, and attestation come later in the process.

1. Preparation Phase

The preparation phase sets up the exercise. The financial entity forms the control team, defines the scope, selects the threat intelligence and red team providers, and puts the necessary risk management and communication arrangements in place.

The relevant National Competent Authority (NCA) or TLPT authority also oversees key parts of the process, including the scope and overall test setup.

Because TLPT is performed against live production systems, this phase also includes assessing the risks of the test and agreeing the controls needed to keep it safe.

2. Testing Phase

The testing phase starts with threat intelligence. The threat intelligence provider analyzes relevant threats, gathers target-specific intelligence, and develops scenarios that reflect realistic attacks against the financial entity.

Once the targeted threat intelligence report is approved, the red team uses it together with the scope specification document to prepare the red team test plan and execute the selected attack scenarios. The active red team testing phase must last at least 12 weeks.

3. Closure Phase

After active testing ends, the red team and blue team prepare their respective reports. The teams then replay the offensive and defensive actions performed during the test and carry out purple teaming to review vulnerabilities, missed detections, and other areas for improvement.

The financial entity then prepares a summary of the TLPT findings, including a high-level remediation plan. The TLPT authority reviews the required documentation as part of the attestation process.

What Threat Intelligence Does in DORA TLPT

In threat intelligence DORA TLPT, the job is to work out which threats actually matter for the financial entity being tested. That means looking at the organization’s sector, exposure, systems, and current threat activity, then using that information to guide the exercise.

This is where threat intelligence in penetration testing becomes practical. Instead of starting with generic attack scenarios, teams can focus on the threat actors, TTPs, infrastructure, and attack paths that are more likely to be relevant to that organization.

For DORA threat-led penetration testing, this intelligence helps answer a few basic questions before the red team starts: who is most likely to target the entity, what they may try to reach, how they are likely to get in, and which techniques they are using now.

The result is a test based on evidence about the organization and its current threat environment, rather than a fixed set of generic attack cases.

How ANY.RUN Can Support Threat Intelligence for DORA TLPT

Threat intelligence for TLPT needs to be specific enough to support realistic scenarios. That means analysts don’t only need high-level threat reports but also current infrastructure, malware behavior, indicators, and relationships between them.

Threat Intelligence Lookup: Investigate Relevant Threat Activity

Threat Intelligence Lookup gives teams access to threat data generated from investigations across the ANY.RUN community, used by 700,000+ security professionals and 16,000+ organizations. That gives analysts a much broader base of real-world activity to work from when researching threats for TLPT.

Instead of stopping at a single IOC, teams can investigate the wider context around it:

• related domains, IPs, URLs, and infrastructure
• malware families and samples connected to the same activity
• links between indicators seen across different investigations
• behavior associated with active campaigns
• patterns that help show whether a threat is relevant to the financial entity

For TLPT preparation, this can help turn a broad threat hypothesis into something more concrete. If a team identifies a threat actor or malware family that matters to the organization, they can dig into the surrounding infrastructure and behavior, then use that evidence to make the scenario more specific and closer to what attackers are actually doing.

Teams can also use Threat Intelligence Feeds to keep TLPT scenarios aligned with current threat activity. 30% of unique malicious IOCs discovered by ANY.RUN customers during their Interactive Sandbox investigations are already available in ANY.RUN TI Feeds, giving teams more up-to-date context when reviewing indicators and infrastructure before testing begins.

Interactive Sandbox: Add Behavioral Context to TLPT Scenarios

Threat intelligence can show which malware, infrastructure, or attack chains matter. A sandbox helps teams understand how those threats actually behave once executed.

With ANY.RUN’s Interactive Sandbox, analysts can inspect process chains, persistence, network activity, dropped files, command-and-control behavior, and MITRE ATT&CK techniques in one investigation. That gives the testing team more concrete behavioral evidence when deciding which techniques and behaviors are worth including.

For example, if a malware family is relevant to the financial entity, the team can see how it establishes persistence, what infrastructure it contacts, and which techniques appear during execution. Those details can help make the scenario closer to observed attacker behavior instead of relying only on static indicators.

The sandbox does not replace the live production testing required by DORA. It supports the research and preparation that happens before the active TLPT exercise.

Who Is Involved in a DORA TLPT?

A DORA TLPT involves several teams, each with a different role in planning, executing, or overseeing the exercise.

• Control team: A small group within the financial entity that knows the test is taking place. It coordinates the exercise, manages risk, and can intervene if testing creates an unacceptable risk to production systems.
• Threat intelligence provider: Researches the threat landscape and the financial entity itself, then develops the intelligence and scenarios that guide the test.
• Red team: Carries out the simulated attack, using the agreed scenarios to test how far an attacker could get against the organization’s critical functions.
• Blue team: The organization’s defensive team. It is not told about the exercise in advance and is expected to detect and respond as it would during a real attack.
• TLPT authority: Oversees the test through designated test managers and checks that the exercise follows the required methodology.

Once active testing is over, the red and blue teams come together for replay and purple teaming. They compare what the attackers did with what defenders saw and responded to, then use those findings to identify gaps and remediation priorities. Purple teaming is mandatory under the DORA-aligned TIBER-EU framework.

What DORA Requires from Threat Intelligence Providers

DORA is fairly specific about who can support a TLPT exercise. Under DORA Article 27 TLPT, testers are expected to have the right technical expertise, relevant experience, and enough independence to work on an exercise that may involve live production systems.

The threat intelligence provider TLPT requirements are set out in more detail in the Regulatory Technical Standards (RTS) under Commission Delegated Regulation (EU) 2025/1190. The provider should be able to show relevant experience, bring together the right mix of technical, sector, and geopolitical knowledge, and avoid conflicts of interest that could affect the exercise.

That matters because the provider is not there simply to deliver a list of indicators. They need to judge which threats are genuinely relevant to the financial entity, which details are useful for the test, and how that intelligence should be turned into something the red team can actually work with.

What Goes into a DORA Targeted Threat Intelligence Report

The targeted threat intelligence report is one of the main outputs of the TI phase. It brings together the threat information most relevant to the financial entity and gives the testing team a stronger basis for building realistic scenarios.

The report can include:

• critical or important functions in scope
• relevant threat actors and TTPs
• exposed credentials and look-alike domains
• vulnerable or exploitable systems
• malicious infrastructure linked to current activity
• malware families connected to relevant campaigns
• other technical evidence that can help shape the test

ANY.RUN can support this work by adding technical context and behavioral evidence to the threat intelligence process. Threat Intelligence helps teams connect domains, IPs, URLs, malware families, and related infrastructure, while the Interactive Sandbox shows how relevant threats behave during execution.

Together, this gives analysts a clearer picture of the activity behind the indicators — not just what is malicious, but how it operates. That context can help strengthen threat profiles, validate TTPs, and give the red team more concrete evidence when building attack scenarios.

Strengthen DORA TLPT With Better Threat Intelligence

For financial organizations, TLPT is not just a regulatory exercise. Its value depends on whether the test reflects the threats the business is actually exposed to and gives security teams something useful to act on afterward.

ANY.RUN is already used by 1,811 financial organizations, giving teams access to threat intelligence and investigation data that can support the preparation behind DORA TLPT.

With stronger threat context going into the exercise, teams can make better testing decisions, focus on the risks that matter most, and get more value from the TLPT process.

About ANY.RUN

ANY.RUN helps security teams investigate threats, analyze malware, and work with current threat intelligence. The platform is used by 700,000+ security professionals and 16,000+ organizations worldwide.

Its solutions include the Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds, giving teams access to malware behavior, related infrastructure, and fresh threat data in one environment.

The company is also SOC 2 Type II attested, reflecting established controls around security, availability, and data protection.

Frequently Asked Questions

The post DORA TLPT Requirements Explained: Where Threat Intelligence Fits appeared first on ANY.RUN's Cybersecurity Blog.