ANY.RUN
@anyrun_app
Empowering businesses with proactive security solutions: Interactive Sandbox,
TI Lookup and Feeds. Sign up:
192 Following 34.3K Followers
🚨 #CSuite# is hitting tech, government, and manufacturing, with 60% of its victims from the US
The operation blends device-code #phishing#, M365 session theft, and RMM abuse.
See how CSuite works and what SOC teams should watch for:
Show more
⚡ The gap between having threat intelligence and using it effectively is where most SOCs lose time.
#ANYRUN# and @elastic Security are hosting a webinar on making it a working part of daily operations.
📅 Wed, September 30
Stay for live Q&A. Register:
Show more
Phishing activity in the past 7 days 🐟
Track latest #phishing# threats in TI Lookup:
#TopPhishingThreats#
🕵️ #RatonRAT# uses BAT scripts for execution and cleanup, and scheduled tasks or Active Setup for persistence.
It targets credentials and sensitive data, giving attackers remote access to compromised systems ❗️
How to detect and reduce exposure:
Show more
⚠️ RAT activity shifted last week, with #Remcos# up over 40% and #SilentNet# nearly doubling. #AgentTesla#, #Quasar#, and #DonutLoader# also moved higher, while #AsyncRAT# and #XWorm# declined.
📌 Trend to watch: growth is moving between established threats rather than following one clear leader. For SOC teams, these shifts can quickly reshape detection and investigation priorities.
Monitor the malware driving today’s attacks:
#Top10Malware#
Show more
🤝 We’re at @rootedcon Valencia 2026!
Come say hi to the #ANYRUN# team and talk about the real work behind SOC & MSSP growth 💪
#RootedVLC#
⚠️ For MSSPs, Tier 2 efficiency starts before Tier 2 even opens the ticket.
See where handoffs slow MSSP response and how to fix it:
When your Tier 1 escalates the case, how much context actually travels with the ticket?
Show more
“Nothing happened this month.”
For an MSSP, that can still mean hundreds of investigations, faster decisions, fewer escalations, and new threat intel.
The challenge? Making that visible to clients.
How to turn everyday SOC activity into proof of value 👇
Show more
🏭 A case that exposes the limits of automated defenses from a leading German manufacturer.
A phishing email passed automated mail gateway filters and static antivirus. The decryption password was hidden inside the PDF, out of reach for any scanner. What stopped it from becoming a wider incident was having the full attack context.
⚡ #ANYRUN# Interactive Sandbox provided the full chain: Outlook → browser → malware execution. The team removed the email from all mailboxes before it spread.
The case became an internal training reference. Read the full story:
Show more
⚡ Threat intelligence loses its value when it doesn't reach analysts at the point of decision.
We're hosting a webinar with @elastic Security on making TI a seamless part of SOC operations, not a separate research step.
❗ Stay for live Q&A. Register:
Show more
⚡ Fast, precise alert triage needs seamless context right where you work.
#ANYRUN’s# integration with @SentinelOne adds live threat intel & sandbox verdicts directly into your workspace.
Accelerate your daily incident response and eliminate extra work 👇
Show more
⚡ How to reduce alert overload in Cortex XSOAR with #ANYRUN#.
#ANYRUN# integration allows XSOAR playbooks to submit suspicious files and URLs to Interactive Sandbox automatically — verdicts and behavioral context land in the incident without analyst involvement. TI Lookup enriches indicators from within the incident. TI Feeds keep detection current as infrastructure rotates.
🎯 Analysts focus on high-priority incidents without the manual overhead that slows them down. More use cases:
Show more
Phishing activity in the past 7 days 🐟
Track latest #phishing# threats in TI Lookup:
#TopPhishingThreats#
🚨 #PhantomStealer# is a MaaS infostealer spread via business-themed phishing lures.
It uses JS, WMI, hidden PowerShell, and in-memory execution to steal browser data, creating risks of account takeover and data theft.
Full analysis and detection tips:
Show more
✈️ We’re heading to @rootedcon to talk about real SOC & MSSP work, with growth in mind.
Meet our team to see how #ANYRUN# can support day-to-day security operations and the outcomes your business depends on.
📆 September 18. See you in Valencia! #RootedVLC#
Show more
🎬 "Are you living two lives, Mr. Anderson?"
Time to meet Mr. Benito and watch the Famous Chollima team fall apart — in the video he confronts Mr. Anderson directly about forged documents.
⚠️ Read the full investigation →
Show more
🎉 Last week at DEF CON 34, our friends @MauroEldritch and @0xfigo presented the 2nd episode of "Smile, You're on camera" investigation, exposing DPRK IT workers scheme.
🔥 And #ANYRUN# is the part of it.
📖 Read the full undercover investigation:
Show more
🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit.
@BirminghamCyber & @north_scan used #ANYRUN# Sandbox to capture weeks of Famous Chollima activity inside a fake startup.
👀 How not to let a spy in? See full story and videos:
Show more
