ANY.RUN
@anyrun_app

Interactive Sandbox & Threat Intelligence trusted by 16K+ SOC & MSSP teams. Triage and respond to phishing & malware faster: app.any.run/?utm_source=x

any.run/?utm_source=x&utm_ca…
Joined February 2017
1,934 Photos and videos
Pinned Tweet
ANY.RUN
@anyrun_app
Sep 15
🔥 15 trends shaping today’s cyber threat landscape. 📢 Our H1 2026 Cyber Risk Report reveals the attack paths putting the most pressure on daily SOC operations. 🎯 Explore the risks, their impact, and mitigation playbooks. Full report: any.run/cybersecurity-blog/h…
3
10
3,154
🚨 42% of security alerts go uninvestigated. That's a serious challenge for US SOCs. Faster Tier 1 workflows and automation help teams handle more cases and increase ROI. Explore how to speed up triage by 76% 👇 any.run/cybersecurity-blog/i…

76% Faster Triage: How US SOCs Increase ROI

Discover how US SOCs achieve 76% faster triage, reduce analyst workload, and maximize ROI from existing security investments.

any.run
1
4
444
❗ On paper, this financial organization looks just like its sector. In practice, it faces different threats. The banking sector leans on phishing, while this organization mostly faced malicious code. ⚡ See the numbers from 74,086 analyses: any.run/cybersecurity-blog/t…
1
3
503
Phishing activity in the past 7 days 🐟 Track latest #phishing threats in TI Lookup: intelligence.any.run/analysi… #TopPhishingThreats
3
7
984
🚨 Detect it early: #CLOUDHAZE is a signed Rust implant distributed through fake PDF-tool Google Display ads, with high activity targeting US users. 586 ads from two verified advertisers on calendar and template sites led victims to download an implant that runs without admin rights. ❗️ Three signed samples had zero AV detections at the time of analysis. See the analysis & collect #IOCs: app.any.run/tasks/d033300c-1… ⚠️ CLOUDHAZE executes C2 commands and hijacks Chrome search. Since February, the operator has used brands including GalacticPDF, LuminaRead, Ironbark, QuartzLine, PageGlass, and PageStone across six C2 generations with new domains. Track activity and uncover related infrastructure in TI Lookup: intelligence.any.run/analysi… #ExploreWithANYRUN
1
5
16
1,119
#ANYRUN TI Feeds turn IOCs into continuous monitoring by streaming fresh, validated indicators and behavior-based threat data into your security stack. 💡 #IOC: SHA256: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 835800058050be37366478c662f73d7fcb93a2669e44f98664546fbc8ee6c7ca 74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124 C2: westbeavers[.]com healskills[.]com motherotters[.]com
1
2
443
⚠️ #IronChain uses elevated privileges & kernel-level components to weaken security controls before encrypting files. It can disrupt Windows systems and leave organizations facing data loss and extended downtime. 👨‍💻 How to detect it before damage occurs: any.run/malware-trends/ironc…
2
6
1,004
❗ When a suspicious link lands in a QRadar SOAR incident, how many manual steps stand between the alert and a verdict? ⚡️ With #ANYRUN integration there is nothing to copy, upload, or paste: the whole case runs inside the incident. See how #ANYRUN fits your IBM QRadar SOAR workflow: any.run/integrations/ibm-qra…
4
7
974
⚠️ Last week's malware activity showed a clear contrast: #AsyncRAT dropped nearly 30%, while #DonutLoader jumped 48% and #Grandoreiro continued its upward trend. #Romulus also entered the picture as one of the week's most active threats. 📌 Trend to watch: familiar threats continue to dominate, but new entries can quickly become significant. SOC teams need to validate detection coverage for newly observed families without losing focus on persistent threats. Monitor the malware driving today’s attacks: any.run/malware-trends/?utm_… #Top10Malware
8
13
1,575
🚨 #WKLP, a new Python stealer/RAT targeting government organizations in the US and France, steals credentials and browser data, abuses Microsoft Defender exclusions, and connects to relay[.]wklp-searcher[.]xyz for remote operator commands. It adds files, paths, and Python processes to Defender exclusions, creates firewall rules disguised as Windows Update Service, and terminates security processes and services. 👨‍💻 Explore the full chain and collect #IOCs: app.any.run/tasks/750d876b-f… WKLP downloads files from an attacker-controlled GitHub repository and an embedded Python archive, then disguises Python 3.13 as MoUsoCoreWorker.exe before launching the final client[.]py payload: wklpcs2.exe ➡️ PowerShell ➡️ renamed Python runtime ➡️ client[.]py #ExploreWithANYRUN 1/3 🧵
2
10
30
2,656
⚠️ Beyond credentials and browser data, #WKLP targets crypto wallets, password-manager data, and screenshots. Operators can deploy additional payloads, exfiltrate files, and control the victim’s screen, camera, microphone, keyboard, and clipboard. It streams victims’ screens through legitimate Meshcast and uses a watchdog to restore deleted malware copies. ❗️ The malware attempts to obtain Chromium keys through a debugging mechanism and uses NSSDecryptor to decrypt Firefox logins. Stolen data is packed into an AES-256 ZIP archive and sent to GoFile. Failed transfers are stored in an obfuscated SQLite retry queue. 🔍 Pivot from #IOCs, track related activity and evolution in TI Lookup: intelligence.any.run/analysi… #ExploreWithANYRUN 2/3 🧵
1
3
2
619
#ANYRUN TI Feeds turn IOCs into continuous monitoring by streaming fresh, validated indicators and behavior-based threat data into your security stack. 💡 #IOC: SHA256: 073a0534e219b8460acd5a50d891fe23e07369a8a20c29033f5aa2ca22fe8aec 6652be38c965c65a6e5c2de2448f3a9c32211e8e58eabf8a9281c423694efbbb 430a6ca5e157dacd526e40ff7364e0b837b7de76c69c21bc68e103f72c773205 01c32d0737432240adcf0bbc1d32327f0976d3a1e1427774bc8febc8f1c031110fcc32d73854f8a72b9ac2e0b98198f1082f628f4855e87122c11014977f9535 URL: raw[.]githubusercontent[.]com/wklp/ relay[.]wklp-searcher[.]xyz #ExploreWithANYRUN 3/3 🧵
3
4
329
❓ If you could fix one thing in your SOC, what would it be? ⚡ We’d start with how fast it learns about new attacks: a late start slows every step. Real-time threat intelligence makes that start early. Freshness, uniqueness, and quality decide how much it pays off.
1
1
4
882
Here is how to choose the right threat intelligence solution 👇 any.run/cybersecurity-blog/e…

Enterprise Threat Intelligence Buying Guide

Learn how to choose enterprise threat intelligence by evaluating quality, integrations, scalability, privacy, workflows, and ROI.

any.run
1
1
325
⚠️ With or without AI, phishing causes a massive damage to critical US industries. #ANYRUN data shows exposure above 70% in finance and manufacturing. A mitigation approach: expose a chain with Interactive Sandbox and widen the view with TI Lookup.
1
2
6
943
What else CISOs should know and do about phishing in US industries👇 any.run/cybersecurity-blog/p…

Phishing Risk Across 5 Key US Industries: 2026 Data

Explore phishing risk across 5 key US industries and learn how faster detection and threat visibility help mitigate attacks.

any.run
1
1
374
📈 For MSSPs, adding 10 clients should grow revenue—not multiply workload. The hidden bottleneck: handoffs and manual IOC checks slow triage, escalate routine cases, and consume senior analyst time. See what breaks first and how to fix it 👇 any.run/cybersecurity-blog/m…

MSSP Growth: How to Scale Investigations Without Adding More Work

Learn how MSSPs can handle more clients, alerts, investigations, and SLA demands without letting analyst workload and delivery costs grow at the same pace.

any.run
1
4
874
🚨 We identified #Skyw4lker, a Device Code #phishing campaign mostly active against US orgs in manufacturing, technology, and healthcare. Victims receive a password-protected decoy doc framed as a contract or service proposal, then move from a lure on sites[.]google[.]com into MS authentication, exposing M365 token access without direct password theft. ❗️ The phishing page uses obfuscated JavaScript and a PHP backend to create a victim session, collect IP/geolocation, and keep polling until the flow completes. See the full attack chain and collect #IOCs in #ANYRUN Sandbox: app.any.run/tasks/371eeef8-8… ⚡️ Strengthen phishing detection in your SOC with #ANYRUN: any.run/use-case/phishing/?u… #ExploreWithANYRUN
2
11
32
2,485
🔍 The same domain also hosts an admin panel, giving analysts another pivot point beyond the phishing URL. Trace related activity, uncover reused infrastructure, and track evolution in TI Lookup: intelligence.any.run/analysi…
1
1
5
530
💡 #ANYRUN TI Feeds turn IOCs into continuous monitoring by streaming fresh, validated indicators and behavior-based threat data into your security stack: any.run/threat-intelligence-… #IOC: flow505.mooo[.]com/accessible/admin/index.php hxxps[:]//flow505[.]mooo[.]com/accessible/assets/php/endpoints/session_public.php?action=start&ip=<IP>&ip_address=<IP>&country= <Country-Code>&country_code= <Country-Code>&IP[ip]=<IP>&IP[country]=<Country-Code>&city=<City>®ion=<Region>&timezone=<Timezone>&isp=<ISP>&org=<ORG>&org_type=<IP-Org-Type> hxxps[:]//flow505[.]mooo[.]com/accessible/assets/php/endpoints/session_public.php?action=poll&session_id=<ID> hxxps[:]//flow505[.]mooo[.]com/accessible/<ID>?<Random> hxxps[:]//flow505[.]mooo[.]com/accessible/assets/js/client_geo.js hxxps[:]//flow505[.]mooo[.]com/accessible/assets/js/url_helper.js

Threat Intelligence Feeds: live IOCs for SOC teams - ANY.RUN

Fresh, noise-free IOCs enriched with sandbox analysis from 700K analysts. Malware behavior, C2 maps, MITRE ATT&CK TTPs included.

any.run
3
565
🚨 U.S. authorities disrupted North Korean laptop farms, according to the DOJ: 40+ locations, ~187 laptops and KVM devices seized. ❗️ A major risk for companies is what these farms enable: fake identities can operate as trusted insiders with access to systems, source code, and internal processes.   Learn how these operations work from the inside in our Lazarus APT IT worker investigation, covering what fake workers do after hiring, their tooling, and day-to-day workflow: any.run/cybersecurity-blog/l…
8
12
1,230
Load more