Anyrun

April was another busy month for the ANY.RUN team! We continued improving our malware detection capabilities, expanded our behavior signatures, and sharpened threat intelligence, all to make your investigations faster, deeper, and even more precise.  From adding fresh Suricata rules and YARA signatures to detecting new malware behaviors, here’s what’s new at ANY.RUN this month.  Let’s […]

The post Release Notes: SDK Integration, Notifications, 1,000+ Detection Rules, and APT Reports  appeared first on ANY.RUN's Cybersecurity Blog.

The current article provides technical analysis of an emerging malware named Pentagon Stealer. The research has been prepared by the analyst team at ANY.RUN.  Key Takeaways  How We Discovered Pentagon Stealer  In early March of this year, when browsing Public submissions, the ANY.RUN team came across an interesting malware sample written in Golang.  View sandbox […]

The post Pentagon Stealer: Go and Python Malware with Crypto Theft Capabilities  appeared first on ANY.RUN's Cybersecurity Blog.

When data meets automation, two pillars of modern tech converge to create something smarter: Threat Intelligence Feeds. Real-time insights, machine-speed decisions, and a global perspective — all working together to outsmart threats before they become incidents.  ANY.RUN’s TI Feeds are structured, continuously updated streams of fresh threat data. They contain network-based IOCs — IP addresses, […]

The post How Threat Intelligence Feeds Help During Incident Response appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by Mauro Eldritch, offensive security expert and threat intelligence analyst. You can find Mauro on X.  There’s no shortage of ransomware these days. It’s everywhere, lurking in email attachments, hiding in cracked software, and making headlines almost daily. While some ransomware groups vanish or rebrand, new names step in to […]

The post PE32 Ransomware: A New Telegram-Based Threat on the Rise  appeared first on ANY.RUN's Cybersecurity Blog.

Making ANY.RUN’s products better for the benefit of businesses, organizations, and SOC teams is our top priority. To get maximum value out of our solutions, we provide them with API, a tool enabling users to integrate our services into their security infrastructure. And now, to make this process even smoother, we introduce a software development […]

The post Seamlessly Integrate ANY.RUN’s Services into Your Infrastructure via SDK appeared first on ANY.RUN's Cybersecurity Blog.

In cybersecurity, the three main types of indicators are a critical concept for threat detection and response. These main types are indicators of compromise, behavior, and attack (IOCs, IOBs, IOAs). Let’s elaborate on their essence, difference, and use.   Distinction in a Nutshell  Indicators of Compromise  IOCs are pieces of evidence that suggest that a system, […]

The post How Indicators of Compromise, Attack, and Behavior Help Spot and Stop Cyber Threats appeared first on ANY.RUN's Cybersecurity Blog.

Get Q1 ’25 Report for Free Based on real data from 15,000+ global SOC teams. Top malware types, families, and APTs Changes in threat landscape since Q4 ’24 What SOC teams need to focus on Opt in to receive news, updates, and promotions. Get free report Loading… A copy of the report has been sent […]

The post Malware Trends Report, Q1 2025: Get Your Copy appeared first on ANY.RUN's Cybersecurity Blog.

Every piece of malware leaves traces behind. Sometimes it’s a string buried deep in the code. Other times it’s a mutex, a registry key, or a network pattern. The key is knowing what to look for.  That’s exactly what malware signatures are for. They describe these recurring elements, unique strings, behaviors, or structural patterns, that […]

The post Malware Signatures: How Cybersecurity Teams Use Them to Catch Threats  appeared first on ANY.RUN's Cybersecurity Blog.

While developing our Security Training Lab educational program, we at ANY.RUN have turned to well-established theories of education, cognitive skill development, and the psychology of learning. Their foundational principles emphasize one critical truth: practice is indispensable for mastering complex skills.   In the field of cybersecurity—especially in malware analysis—the ability to apply theoretical knowledge in […]

The post Why Practice Is Key to Training Top Malware Analysts and How ANY.RUN Supports It appeared first on ANY.RUN's Cybersecurity Blog.

At ANY.RUN, we love hearing about clients’ experiences. Quality feedback helps us improve and gives new and existing users a clearer understanding of our tools in actual security scenarios.  That’s why when we spoke with Augustin Alexandrovici, who leads Cyber Intelligence Operations at Expertware, we knew we had to share our conversation.   Check out the […]

The post How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis appeared first on ANY.RUN's Cybersecurity Blog.

March was a productive and exciting month for the ANY.RUN team. We’ve been working hard to improve both our sandbox platform and Threat Intelligence services — all to help you detect threats faster and stay ahead of cybercriminals.  This month, we focused on expanding the environments available for malware analysis and making our threat detection […]

The post Release Notes: Android VM, Pre-Installed Dev Tools, TI Reports & Enhanced Detection appeared first on ANY.RUN's Cybersecurity Blog.

Linux cyber threats may be less common than Windows ones, but they can be equally if not more damaging. Defending against these requires proactive efforts. Eric Parker, a popular YouTube blogger and malware analyst, recently showed his approach to investigating and collecting intelligence on Linux malware. Here is a recap of his video.  How to […]

The post How to Hunt and Investigate Linux Malware  appeared first on ANY.RUN's Cybersecurity Blog.

In this report, we examine an Android malware sample recently collected and analyzed by our team. This malware masquerades as a banking application and is built to steal sensitive user information. During the analysis, we came across internal references to “Salvador,” so we decided to name it Salvador Stealer.  Real-time visibility into mobile malware behavior […]

The post Salvador Stealer: New Android Malware That Phishes Banking Details & OTPs appeared first on ANY.RUN's Cybersecurity Blog.

The Globee Awards is an annual competition celebrating companies in various fields, including technology-related businesses, since 2003. This year, the winners were announced on March 13, and ANY.RUN is one of them! We earned silver in the Outstanding Threat Detection and Response category.  Thank You!  It’s a pleasure to share the news with our lovely […]

The post ANY.RUN Wins Globee Awards 2025 for Outstanding Threat Detection and Response appeared first on ANY.RUN's Cybersecurity Blog.

Cyber threat intelligence is all about data: its collection, exploration and research, extracting actionable insight. If you employ any intelligence solution, it is vital to understand what data sources it relies on and what kind of information they deliver.   In ANY.RUN’s Threat Intelligence Lookup and TI Feeds, we leverage fresh data from millions of sandbox […]

The post How We Enrich TI Lookup and Feeds with Fresh Threat Data from 15,000 Organizations appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by Mohamed Talaat, a cybersecurity researcher and malware analyst. You can find Mohamed on X and LinkedIn.  In this article, we’re diving into GorillaBot, a newly discovered botnet built on Mirai’s code. It’s been spotted launching hundreds of thousands of attacks across the globe, and it’s got some […]

The post GorillaBot: Technical Analysis and Code Similarities with Mirai appeared first on ANY.RUN's Cybersecurity Blog.

It is with great pleasure and gratitude that we announce our victory at the Cybersecurity Excellence Awards 2025, an annual competition for individuals and companies that stand out in the field of information security held by a major online community Cybersecurity Insiders.  Our service, ANY.RUN Threat Intelligence Lookup, was named best among leading threat intelligence […]

The post TI Lookup Named Best Threat Intelligence Service at Cybersecurity Excellence Awards appeared first on ANY.RUN's Cybersecurity Blog.

Malware analysis is a promising yet competitive career path, where education must be taken seriously to stand up against ever-evolving threats. The demand for such professionals has never been higher, but the requirements and expectations are not low either.   A specific mindset and a number of well-developed soft skills are no less vital than a […]

The post Decoding a Malware Analyst: Essential Skills and Expertise appeared first on ANY.RUN's Cybersecurity Blog.

It’s here! The news security teams have been waiting for: ANY.RUN now fully supports Android OS in its interactive sandbox!  Now, you can investigate Android malware in a real ARM-based sandbox, exactly as it would behave on an actual mobile device. No more blind spots or unreliable analysis.  With this release, ANY.RUN allows SOC teams, […]

The post Expose Android Malware in Seconds: ANY.RUN Sandbox Now Supports Real-Time APK Analysis  appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN sandbox just got even more powerful thanks to a new pre-installed development software set in its virtual machines (VMs).  Building on our existing pre-installed sets, we’re introducing this new option to give researchers even more flexibility and advanced tools for analyzing highly specific and complex malware inside the sandbox.  With this update, before launching an analysis session, users […]

The post New Pre-Installed Dev Tools for Deep Sandbox Malware Analysis  appeared first on ANY.RUN's Cybersecurity Blog.