Pinned Tweet
🚀 𝗕𝗜𝗚 𝗡𝗘𝗪𝗦: Introducing Related Threat Context, Your New MTTR Shortcut.
SOC & MSSP teams used to manually rebuild the picture around every suspicious IOC. With this new #ANYRUN update, you can see related team analyses, historical context, and industry-related activity for elated infrastructure in one connected workflow.
⚡️ 𝗜𝘁’𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝘀𝗶𝗺𝗽𝗹𝗲: review the context around each indicator in the Sandbox, then pivot to TI Lookup in one click to uncover additional threat activity and give Tier 1 evidence to justify escalation.
See the workflow in action and try it yourself: app.any.run/tasks/390e708f…
🔍 Connected context brings a whole new level of speed and clarity to triage: faster decisions, fewer uncertainty-driven escalations, more focused use of Tier 2 expertise, better knowledge reuse across shifts, and stronger visibility into industry-relevant activity.
🎉 𝗧𝗵𝗲 𝘁𝗿𝗶𝗮𝗴𝗲 𝗯𝗼𝗼𝘀𝘁 𝘆𝗼𝘂’𝘃𝗲 𝗯𝗲𝗲𝗻 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗶𝘀 𝗵𝗲𝗿𝗲. Explore Related Threat Context in your security workflows: any.run/cybersecurity-…
SOC & MSSP teams used to manually rebuild the picture around every suspicious IOC. With this new #ANYRUN update, you can see related team analyses, historical context, and industry-related activity for elated infrastructure in one connected workflow.
⚡️ 𝗜𝘁’𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝘀𝗶𝗺𝗽𝗹𝗲: review the context around each indicator in the Sandbox, then pivot to TI Lookup in one click to uncover additional threat activity and give Tier 1 evidence to justify escalation.
See the workflow in action and try it yourself: app.any.run/tasks/390e708f…
🔍 Connected context brings a whole new level of speed and clarity to triage: faster decisions, fewer uncertainty-driven escalations, more focused use of Tier 2 expertise, better knowledge reuse across shifts, and stronger visibility into industry-relevant activity.
🎉 𝗧𝗵𝗲 𝘁𝗿𝗶𝗮𝗴𝗲 𝗯𝗼𝗼𝘀𝘁 𝘆𝗼𝘂’𝘃𝗲 𝗯𝗲𝗲𝗻 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗶𝘀 𝗵𝗲𝗿𝗲. Explore Related Threat Context in your security workflows: any.run/cybersecurity-…
1
4
6
2,810
🚨 #SkyW4lker puts US companies at risk: 46% of 618 related analyses came from the US.
This Microsoft 365 device-code #phishing campaign enables account access without passwords — even with MFA.
Catch the warning signs before accounts are compromised 👇
any.run/cybersecurity-…
This Microsoft 365 device-code #phishing campaign enables account access without passwords — even with MFA.
Catch the warning signs before accounts are compromised 👇
any.run/cybersecurity-…
0
3
10
911
The IOC on your screen may already have a threat history. Now, uncovering it is easier than ever with new Related Threat Context 🚀
Achieve even faster triage & enrichment with related team analyses, industry observations, and direct path to threat intel: any.run/cybersecurity-…
Achieve even faster triage & enrichment with related team analyses, industry observations, and direct path to threat intel: any.run/cybersecurity-…
0
1
4
787
Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysis/looku…
#TopPhishingThreats
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysis/looku…
#TopPhishingThreats
0
4
6
1,286
⚠️ #ToxicPanda banking trojan hides behind fake Android updates, then abuses Accessibility services to control devices and intercept authentication data.
Discover how its staged delivery facilitates financial fraud — and how to detect it: any.run/malware-trends…
Discover how its staged delivery facilitates financial fraud — and how to detect it: any.run/malware-trends…
0
5
13
1,287
❗ How to speed up incident response in Google SecOps?
#ANYRUN’s Interactive Sandbox takes a file or URL from alert to verdict without leaving Google SecOps: fewer escalations, faster containment.
⚡️ Integrate and get verdicts in every alert: any.run/integrations/g…
#ANYRUN’s Interactive Sandbox takes a file or URL from alert to verdict without leaving Google SecOps: fewer escalations, faster containment.
⚡️ Integrate and get verdicts in every alert: any.run/integrations/g…
0
3
10
977
⚠️ RAT families showed contrasting activity trends last week. #Romulus climbed 32% while #AsyncRAT dropped 35%, with #Remcos and #XWorm also declining. Meanwhile, #FormBook gained nearly 40%.
📌 Trend to watch: declining activity among leading RATs doesn't mean every family is should assess detection gaps at the family level rather than assume lower volumes mean reduced exposure.
Monitor the malware driving today’s attacks: any.run/malware-trends…
#Top10Malware
📌 Trend to watch: declining activity among leading RATs doesn't mean every family is should assess detection gaps at the family level rather than assume lower volumes mean reduced exposure.
Monitor the malware driving today’s attacks: any.run/malware-trends…
#Top10Malware
0
7
11
1,936
🚨 #Formbook is Back with Regional Lures. A localized business-order lure targets European users and manufacturing orgs, delivering Formbook through an in-memory chain and persisting as SystemUpdate_*.
👨💻 See the full attack chain and collect #IOCs in #ANYRUN Sandbox: app.any.run/tasks/29a05eb9…
🚀 With #ANYRUN's new Related Threat Context, analysts can explore activity beyond the original sample in one connected workflow. In this case, another document themed malicious archive used similar JS lure — a useful lead for identifying related threats.
#ExploreWithANYRUN 1/3 🧵
👨💻 See the full attack chain and collect #IOCs in #ANYRUN Sandbox: app.any.run/tasks/29a05eb9…
🚀 With #ANYRUN's new Related Threat Context, analysts can explore activity beyond the original sample in one connected workflow. In this case, another document themed malicious archive used similar JS lure — a useful lead for identifying related threats.
#ExploreWithANYRUN 1/3 🧵
1
7
18
1,680
🔗 Execution chain: JavaScript ➡️ hidden PowerShell ➡️ AES-protected .NET payload ➡️ hollowed aspnet_compiler.exe ➡️ #Formbook in rekeywiz.exe
❗️ The loader bypasses execution policy and retries injection through a watchdog, while leaving clear detection markers: SystemUpdate_ps_*.lnk persistence, C:\Temp\ps_*.ps1, and powershell.exe spawning aspnet_compiler.exe without arguments. Suricata flagged Formbook C2 check-ins and a request to a .top domain.
#ExploreWithANYRUN 2/3 🧵
❗️ The loader bypasses execution policy and retries injection through a watchdog, while leaving clear detection markers: SystemUpdate_ps_*.lnk persistence, C:\Temp\ps_*.ps1, and powershell.exe spawning aspnet_compiler.exe without arguments. Suricata flagged Formbook C2 check-ins and a request to a .top domain.
#ExploreWithANYRUN 2/3 🧵
1
2
1
541
#ANYRUN TI Feeds turn IOCs into continuous monitoring by streaming fresh, validated indicators and behavior-based threat data into your security stack.
💡 #IOC:
hlushkova[.]top
58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10
a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95
1aa47ce02867f847227839b60d396ca96dac60372b0cd26b78b71a34473bb079
9683514cc99c80e7021849da4e9bd65d00c6d477f478589ea9aef522daed3c72
🔍 Additional IOCs uncovered in TI Lookup through Related Threat Context:
93248da1a4ef6df7b13ecda6c3d91d4d3a49efd4ed1034acd1217e790fc90783
477381fcad2a224fc4070d9fbcd4d5c4f8169fcf0904398bda8f29d6f9fab6a0
806d430c036e3bcb5b05b14eaf7423fdad2fcea67dae7a4beef545ffd864da52
6416f6c353c7e687190fab84c8e8802b0139fb98f44b8e6ae79099fd27884b9b
a44cad7e7d26a0f0284ceb2e9a10a964d9e7ab44ab74b22464eb2f836af3d90a
#ExploreWithANYRUN 3/3 🧵
💡 #IOC:
hlushkova[.]top
58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10
a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95
1aa47ce02867f847227839b60d396ca96dac60372b0cd26b78b71a34473bb079
9683514cc99c80e7021849da4e9bd65d00c6d477f478589ea9aef522daed3c72
🔍 Additional IOCs uncovered in TI Lookup through Related Threat Context:
93248da1a4ef6df7b13ecda6c3d91d4d3a49efd4ed1034acd1217e790fc90783
477381fcad2a224fc4070d9fbcd4d5c4f8169fcf0904398bda8f29d6f9fab6a0
806d430c036e3bcb5b05b14eaf7423fdad2fcea67dae7a4beef545ffd864da52
6416f6c353c7e687190fab84c8e8802b0139fb98f44b8e6ae79099fd27884b9b
a44cad7e7d26a0f0284ceb2e9a10a964d9e7ab44ab74b22464eb2f836af3d90a
#ExploreWithANYRUN 3/3 🧵
0
2
4
585
❗️ Developers are actively being targeted with fake AI tools that compromise business accounts and steal browser sessions. One observed chain began in a shared ChatGPT chat, moved through a custom GPT and a Google Sites page, then used a ClickFix-style prompt that silently e.
Explore the custom GPT chain analysis: app.any.run/tasks/cb647046…
📋 Full analysis of the latest fake AI cases, #IOCs, and detection context: any.run/cybersecurity-…
Explore the custom GPT chain analysis: app.any.run/tasks/cb647046…
📋 Full analysis of the latest fake AI cases, #IOCs, and detection context: any.run/cybersecurity-…
2
6
15
1,965
❗ Higher SOC ROI starts with faster triage.
#ANYRUN automates the routine steps and shows real threat behavior, so analysts reach a verdict without manual checks.
⚡️ See how a healthcare MSSP cut phishing triage by 76% with #ANYRUN: any.run/cybersecurity-…
#ANYRUN automates the routine steps and shows real threat behavior, so analysts reach a verdict without manual checks.
⚡️ See how a healthcare MSSP cut phishing triage by 76% with #ANYRUN: any.run/cybersecurity-…
0
1
2
839
🛡️ #CybersecurityAwarenessMonth is a good time to look at the business risk MFA and password hygiene do not cover: a hire who is not who they claim to be.
🚨 This month, the US DOJ announced that the FBI searched 40+ Texas residences used as North Korean laptop farms and seized vices.
🔍 We saw how such schemes work from the inside. Explore what fake workers do after hiring, their tooling, and their day-to-day workflow: any.run/cybersecurity-…
🚨 This month, the US DOJ announced that the FBI searched 40+ Texas residences used as North Korean laptop farms and seized vices.
🔍 We saw how such schemes work from the inside. Explore what fake workers do after hiring, their tooling, and their day-to-day workflow: any.run/cybersecurity-…
1
2
6
1,116
🆕 How to Cut Triage Time When a Single IOC Reveals a Broader Campaign
🎉 Instead of manually rebuilding context around every IOC, your analysts can now immediately identify the behavioral pattern in #ANYRUN Sandbox and investigate the related activity in #ANYRUN Threat nected workflow and turn findings into detection logic.
Take this sandbox analysis of a malicious .exe as an example: app.any.run/tasks/00279254…
1️⃣ Once the analysis is complete, open Related analyses in the top-right corner and explore all the IOCs. Select a malicious IP address found in the session.
2️⃣ A TI Lookup search shows related scans dating back to July, submitted from different sources but sharing similar network activity. Reviewing just a few of them reveals a recurring delivery chain: JavaScript ➡️ PowerShell ➡️ .NET payload
To go deeper, pivot to related IPs and domains to uncover additional IOCs, infrastructure, and detection opportunities beyond the original sample 🔍
✅ Now available to #ANYRUN Enterprise clients, Related Threat Context shows whether an IOC is a fresh signal or part of widespread activity, adding historical context and industry-related activity directly to Sandbox analysis to help analysts decide what to prioritize, investigate, or escalate.
⚡️ Bring relevant context into every investigation to speed up triage, reduce duplicate work, and lower MTTR. Learn more about Related Threat Context: any.run/cybersecurity-…
🎉 Instead of manually rebuilding context around every IOC, your analysts can now immediately identify the behavioral pattern in #ANYRUN Sandbox and investigate the related activity in #ANYRUN Threat nected workflow and turn findings into detection logic.
Take this sandbox analysis of a malicious .exe as an example: app.any.run/tasks/00279254…
1️⃣ Once the analysis is complete, open Related analyses in the top-right corner and explore all the IOCs. Select a malicious IP address found in the session.
2️⃣ A TI Lookup search shows related scans dating back to July, submitted from different sources but sharing similar network activity. Reviewing just a few of them reveals a recurring delivery chain: JavaScript ➡️ PowerShell ➡️ .NET payload
To go deeper, pivot to related IPs and domains to uncover additional IOCs, infrastructure, and detection opportunities beyond the original sample 🔍
✅ Now available to #ANYRUN Enterprise clients, Related Threat Context shows whether an IOC is a fresh signal or part of widespread activity, adding historical context and industry-related activity directly to Sandbox analysis to help analysts decide what to prioritize, investigate, or escalate.
⚡️ Bring relevant context into every investigation to speed up triage, reduce duplicate work, and lower MTTR. Learn more about Related Threat Context: any.run/cybersecurity-…
0
3
11
1,358
⚡ Cut the manual steps between alert & verdict. That way, new clients bring more revenue, not more manual work.
#ANYRUN helps MSSPs do it: analysis runs on its own and fresh IOCs arrive where analysts already work.
❗️ Find where your analysts lose time: any.run/cybersecurity-…
#ANYRUN helps MSSPs do it: analysis runs on its own and fresh IOCs arrive where analysts already work.
❗️ Find where your analysts lose time: any.run/cybersecurity-…
0
1
4
934
🚨 42% of security alerts go uninvestigated. That's a serious challenge for US SOCs.
Faster Tier 1 workflows and automation help teams handle more cases and increase ROI.
Explore how to speed up triage by 76% 👇
any.run/cybersecurity-…
Faster Tier 1 workflows and automation help teams handle more cases and increase ROI.
Explore how to speed up triage by 76% 👇
any.run/cybersecurity-…
0
1
4
882
❗ On paper, this financial organization looks just like its sector. In practice, it faces different threats.
The banking sector leans on phishing, while this organization mostly faced malicious code.
⚡ See the numbers from 74,086 analyses: any.run/cybersecurity-…
The banking sector leans on phishing, while this organization mostly faced malicious code.
⚡ See the numbers from 74,086 analyses: any.run/cybersecurity-…
0
1
3
852
Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysis/looku…
#TopPhishingThreats
Track latest #phishing threats in TI Lookup: intelligence.any.run/analysis/looku…
#TopPhishingThreats
0
3
9
1,355