Anyrun

Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser […]

The post HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures appeared first on ANY.RUN's Cybersecurity Blog.

Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. The release brings a more connected Threat Intelligence Lookup experience, broader threat […]

The post Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.

As MSSPs take on more clients, alert volumes grow fast. Analyst capacity usually doesn’t. That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, […]

The post Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction appeared first on ANY.RUN's Cybersecurity Blog.

August’s attacks showed how quickly trusted business activity can turn into risk. Across the US and Europe, attackers abused Microsoft 365 sessions, legitimate remote-management tools, business-themed files, and even hiring processes to reach corporate systems. The result was a mix of account takeover, persistent attacker control, credential exposure, and insider risk that often looked legitimate […]

The post Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk appeared first on ANY.RUN's Cybersecurity Blog.

With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. Legitimate services and tools used in daily workflows across corporate America are increasingly abused to deliver phishing […]

The post US Finance Under Phishing Pressure: What the SOC Data Reveals? appeared first on ANY.RUN's Cybersecurity Blog.

As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. The attackers impersonate trusted organizations and document types to trick victims into […]

The post A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign appeared first on ANY.RUN's Cybersecurity Blog.

The infiltration of North Korean IT workers into American and European organizations has evolved into a sophisticated operation that bypasses traditional security perimeters. By using forged identities and AI-assisted workflows, these operatives successfully transition from external applicants to trusted insiders. Recent investigations highlight that this scheme is no longer limited to the private sector, posing […]

The post North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs appeared first on ANY.RUN's Cybersecurity Blog.

One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? ANY.RUN Threat Intelligence has the answer. Threat Intelligence: Thinking Ahead […]

The post Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security appeared first on ANY.RUN's Cybersecurity Blog.

Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. ANY.RUN research shows that 63.7% of identified victims are in the US, with Technologies, Manufacturing, and Education among the most targeted industries. The operation has generated thousands of compromise events between 2024 and 2026, including stolen […]

The post Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US appeared first on ANY.RUN's Cybersecurity Blog.

Threat monitoring serves as the vital connective tissue of modern security operations. It ensures that every function from triage to response operates effectively. To meet evolving threat challenges, SOC teams and MSSPs must transition from simple log collection to a proactive, intelligence-driven framework. ANY.RUN’s Threat Intelligence provides the essential solutions to power this transformation across […]

The post Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction appeared first on ANY.RUN's Cybersecurity Blog.

Supply chain vulnerabilities represent a growing attack surface for US and EU organizations. With advanced threat tactics on the rise, reducing Mean Time to Detect (MTTD) and Respond (MTTR) is essential. ANY.RUN integrates directly into the SOC workflows as an investigative layer, providing fast malware analysis and threat intelligence to help security teams boost their […]

The post Supply Chain Security: How ANY.RUN Helps US and EU Enterprises Prevent Incidents appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD (follow Mauro on X), a company dedicated to threat intelligence and hunting, Heiner García from NorthScan (follow Heiner on X), a threat intelligence initiative uncovering North Korean IT worker infiltration, and ANY.RUN, the leading company in malware analysis and threat intelligence. The […]

The post Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup appeared first on ANY.RUN's Cybersecurity Blog.

ChongLuaDao protects over 200 million users from cybercrime, having detected more than 1.4 million malicious websites since 2020. Rapid processing of community reports is essential to their operations. In our recent conversation, ChongLuaDao co-founder Hieu Ngo told us how ANY.RUN plays an integral role in the project’s infrastructure, helping it power thousands of safety checks […]

The post Safeguarding 200M Users: How ChongLuaDao Scales Threat Validation with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.

July 2026 showed how trusted business workflows can quickly turn into account takeover, data exposure, fraud, and persistent access. ANY.RUN observed attacks that put cloud accounts, financial processes, sensitive data, and business continuity at risk across the US, Europe, and Brazil. Here are the major attacks from July, the business risks they exposed, and the […]

The post Major Cyber Attacks in July 2026: US and EU Organizations Hit by Phishing, RATs, and Stealers appeared first on ANY.RUN's Cybersecurity Blog.

July brought another set of threat coverage updates designed to help security teams work faster and with more confidence. ANY.RUN added 42 behavior signatures, 11 YARA rules, and 703 Suricata rules, giving SOCs broader visibility across files, malware behavior, and network activity.  We also published new threat intelligence and technical research on active malware and phishing campaigns. […]

The post Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules appeared first on ANY.RUN's Cybersecurity Blog.

Cyber risk is increasing, but so is the cost of managing it. More than 514,000 cybersecurity job listings appeared in the US between May 2024 and April 2025, while the mean annual wage for an information security analyst reached $132,510.  Even after the budget is approved, hiring can take three to six months, with additional time […]

The post The US CFO’s Playbook: How to Reduce Cyber Risk Without Scaling SOC Team in a Tight Labor Market appeared first on ANY.RUN's Cybersecurity Blog.

Email gateways, endpoint controls, and file-centric sandboxing remain essential layers of defense. But many of today’s phishing attacks unfold in ways they weren’t designed to fully expose.  How do you build resilience against modern phishing if it has outgrown your SOC’s investigation workflows? Rethinking Phishing Investigations in Modern SOCs  While initial investigation workflows were designed around malicious files and processes, […]

The post Building Resilience Against AiTM Phishing: What SOC Leaders Should Know appeared first on ANY.RUN's Cybersecurity Blog.

SOCs face constant pressure to detect and respond to threats faster. Heavy workloads, limited threat visibility, and disconnected tools can delay action, increasing the risk of financial loss and operational disruption.  ANY.RUN helps more than 15,000 security teams reduce these delays with fresh threat intelligence, interactive analysis, contextual enrichment, and analyst-curated reporting.  Here’s how your SOC can handle incidents more […]

The post Faster Incident Response: How ANY.RUN Helps SOCs Cut MTTR by Up to 21 Minutes per Case appeared first on ANY.RUN's Cybersecurity Blog.

Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code.  This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 […]

The post Kali365 Targets US Organizations with Data Theft via Device Code Phishing  appeared first on ANY.RUN's Cybersecurity Blog.

An original threat intelligence investigation uncovering how trusted government infrastructure became an attack channel, placing banking organizations and public-sector systems at risk while revealing previously undocumented infrastructure relationships and actionable mitigation guidance for security leaders.  ANY.RUN analysts have uncovered an active PhantomEnigma campaign abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. Trusted emails and legitimate […]

The post Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware  appeared first on ANY.RUN's Cybersecurity Blog.