Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity.
The release brings a more connected Threat Intelligence Lookup experience, broader threat coverage, and new research on active campaigns and emerging malware, giving analysts more context to investigate threats, reduce manual work, and act with greater confidence.
Product Updates
This month’s product update focuses on making threat intelligence easier to investigate and act on. Threat Intelligence Lookup now gives analysts a clearer path from a single indicator to related infrastructure, relevant observables, and the next step in the investigation.
New Connections Block in TI Lookup for Faster Threat Investigation
Threat Intelligence Lookup now makes it much easier to move from a single indicator to the wider network context around it. Instead of piecing together separate results, analysts can quickly follow related observables, focus on what matters, and move from a TI query to the next investigation step with less manual work.
The Domains, IPs, and URLs tabs have also been updated to make related observables easier to explore and pivot between. Whitelisted data is hidden by default, helping analysts focus on potentially relevant activity without legitimate infrastructure crowding the results.
Analysts can also export filtered results in JSON, so selected observables can be reused for retrohunting, checked against SIEM/NDR data, added to blocking workflows, or passed to Detection Engineering for further action.
Instead of stopping at a verdict or a list of indicators, analysts can now use TI Lookup to:
- pivot faster between URLs, domains, and IPs;
- focus on malicious and unknown relationships with less noise;
- uncover related infrastructure and build a clearer investigation picture;
- prepare a relevant set of observables for retrohunting and further analysis;
- move findings into blocking and detection workflows without rebuilding the dataset manually.
For SOC and security leaders, the value goes beyond saving analysts a few clicks. Connections shortens the path from a suspicious indicator to an actionable set of findings, reducing manual correlation and helping teams move faster into retrohunting, blocking, and detection updates. That supports lower time per case, higher analyst throughput, faster Time-to-IOC and Time-to-Block, lower MTTD and MTTR, and stronger detection coverage.
Threat Coverage Updates
Detection got a major boost this month, with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules added across ANY.RUN. Together, they strengthen coverage from malware execution and file analysis to phishing, network activity, and command-and-control traffic.
New Behavior Signatures
The latest signature additions focus on malware families analysts are likely to encounter across real-world investigations, from loaders and stealers to RATs, ransomware, and mobile threats. Coverage now extends across Windows, Linux, macOS, and Android, giving analysts more context directly from observed behavior during analysis.
New Suricata Rules
Network visibility also got a substantial update, with 559 new Suricata rules added to detect suspicious traffic patterns tied to phishing, malware delivery, and command-and-control activity. The new rules help surface malicious behavior directly from network traffic and give analysts more context around how threats communicate and spread.
Highlights include:
- Phish to RMM campaign related URL pattern (SID: 85008225): Detects webpage lures disguised as Adobe Reader installer pages that lead to infection with RMM software.
- FlowerStorm HTTP activity observed (SID: 84004196): Identifies HTTP activity associated with the FlowerStorm phishing-as-a-service platform.
- OnyxC2 HTTP activity observed (SID: 84004406): Detects command-and-control check-in attempts linked to OnyxC2 malware-as-a-service activity.
New Threat Intelligence Reports
ANY.RUN published three new Threat Intelligence Reports, covering active phishing operations, remote-access abuse, and newly observed malware. Available to TI Lookup Premium subscribers, the reports combine technical analysis with IOCs, hunting queries, infrastructure context, and MITRE ATT&CK mapping to help analysts investigate and act on threats faster.
1. US-First RMM Phishing Campaign
The US-First RMM Phishing Campaign report uncovers a fake-document campaign that tricks victims into installing legitimate RMM software for remote access. What first looked like a Canada-focused tax lure turned out to be part of a broader operation spanning 46 countries, with 45% of observed activity associated with the United States.
The report traces the campaign’s reusable phishing kit, rotating infrastructure, password-protected delivery chain, and abuse of tools such as GoTo Resolve, LogMeIn Rescue, ScreenConnect, and ConnectWise.
2. Mirage2FA: A Phishing Service That Steals Microsoft 365 Sessions in Real Time
The Mirage2FA report analyzes an active phishing-as-a-service operation targeting Microsoft 365 accounts through AiTM techniques. ANY.RUN researchers examined 1,249 sandbox sessions and linked the campaign to 9,332 potential compromise events across 4,532 potential victims, with 63.7% of identified victims located in the United States.
The report explores Mirage2FA’s browser-based stagers, recurring /xls/ loader pattern, WebSocket-based authentication relay, and session-cookie theft, as well as the infrastructure and recurring LINX markers that connect the operation to LinX Coders.
3. OVERLORD RAT, CRPX0, and TRIBACK Loader
The ANY.RUN Threat Brief covers three distinct threats with very different capabilities: a cross-platform RAT, a modular stealer-ransomware framework, and an in-memory Windows loader.
The brief highlights OVERLORD RAT’s encrypted WebSocket C2 and IDE task abuse, CRPX0’s credential theft, crypto-stealing, and ransomware capabilities, and TRIBACK Loader’s DLL sideloading and memory-resident execution. It also includes hunting queries, IOCs, and MITRE ATT&CK mappings for each threat.
About ANY.RUN
ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 16,000 organizations and 700,000 security professionals worldwide.
Its Interactive Sandbox helps SOC teams, MSSPs, and enterprise security teams safely analyze suspicious files, URLs, phishing pages, and malware while observing the attack chain in real time. Analysts can inspect processes, browser activity, network traffic, persistence, credential access, and other behaviors to understand what a threat is doing and respond faster.
ANY.RUN’s Threat Intelligence turns data from real-world sandbox investigations into actionable context for threat hunting, detection, and incident response. Teams can pivot across indicators, uncover related infrastructure, connect individual findings to wider campaigns, and bring fresh threat data into existing security controls.
ANY.RUN is SOC 2 Type II attested, reflecting its commitment to strong security controls and customer data protection. By combining behavioral analysis with current threat intelligence, ANY.RUN helps security teams investigate threats faster, improve detection coverage, and contain malicious activity before it causes wider impact.
0 comments