For an MSSP, a quiet month can be a good month. No ransomware outbreak. No major account compromise. No business disruption. But it can also create an awkward conversation with the client: What exactly did we pay for this month? The problem is not that the SOC did nothing. Quite the opposite. Analysts may have […]
The post How MSSPs Can Prove Their Value When “Nothing Happened” appeared first on ANY.RUN's Cybersecurity Blog.
Choosing an enterprise threat intelligence solution is about more than just data volume or integrations. The right provider should deliver relevant intelligence, fit existing workflows, and help security teams investigate threats faster. While SOCs may prioritize rapid investigation and enrichment at scale, MSSPs may focus more on multi-tenancy and customer separation. This enterprise threat intelligence […]
The post Enterprise Threat Intelligence Buying Guide: How to Choose the Right Solution appeared first on ANY.RUN's Cybersecurity Blog.
Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. Let’s look at how this unified workflow eliminates context switching, accelerates incident response, and drives higher ROI by transforming alerts into […]
The post ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response appeared first on ANY.RUN's Cybersecurity Blog.
ANY.RUN has released its H1 Cyber Risk Report, built on unique data from real-world submissions analyzed in the ANY.RUN Interactive Sandbox from January to June 2026 by over 700,000 analysts and 16,000 SOC teams. The report highlights 15 key trends and explains what these changes mean for analysts, SOC teams, MSSPs, and business decision-makers. With […]
The post 6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs appeared first on ANY.RUN's Cybersecurity Blog.
We’re excited to share that ANY.RUN has once again been recognized by G2 as a leader in malware analysis. In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN […]
The post ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings appeared first on ANY.RUN's Cybersecurity Blog.
Security teams in the manufacturing sector face persistent operational demands. Recent ANY.RUN data shows their workloads are roughly 22% higher than those in other major industries. To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing […]
The post 15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser […]
The post HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures appeared first on ANY.RUN's Cybersecurity Blog.
Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. The release brings a more connected Threat Intelligence Lookup experience, broader threat […]
The post Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates appeared first on ANY.RUN's Cybersecurity Blog.
As MSSPs take on more clients, alert volumes grow fast. Analyst capacity usually doesn’t. That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, […]
The post Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction appeared first on ANY.RUN's Cybersecurity Blog.
August’s attacks showed how quickly trusted business activity can turn into risk. Across the US and Europe, attackers abused Microsoft 365 sessions, legitimate remote-management tools, business-themed files, and even hiring processes to reach corporate systems. The result was a mix of account takeover, persistent attacker control, credential exposure, and insider risk that often looked legitimate […]
The post Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk appeared first on ANY.RUN's Cybersecurity Blog.
With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. Legitimate services and tools used in daily workflows across corporate America are increasingly abused to deliver phishing […]
The post US Finance Under Phishing Pressure: What the SOC Data Reveals? appeared first on ANY.RUN's Cybersecurity Blog.
As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. The attackers impersonate trusted organizations and document types to trick victims into […]
The post A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign appeared first on ANY.RUN's Cybersecurity Blog.
The infiltration of North Korean IT workers into American and European organizations has evolved into a sophisticated operation that bypasses traditional security perimeters. By using forged identities and AI-assisted workflows, these operatives successfully transition from external applicants to trusted insiders. Recent investigations highlight that this scheme is no longer limited to the private sector, posing […]
The post North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs appeared first on ANY.RUN's Cybersecurity Blog.
One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? ANY.RUN Threat Intelligence has the answer. Threat Intelligence: Thinking Ahead […]
The post Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security appeared first on ANY.RUN's Cybersecurity Blog.
Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. ANY.RUN research shows that 63.7% of identified victims are in the US, with Technologies, Manufacturing, and Education among the most targeted industries. The operation has generated thousands of compromise events between 2024 and 2026, including stolen […]
The post Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US appeared first on ANY.RUN's Cybersecurity Blog.
Threat monitoring serves as the vital connective tissue of modern security operations. It ensures that every function from triage to response operates effectively. To meet evolving threat challenges, SOC teams and MSSPs must transition from simple log collection to a proactive, intelligence-driven framework. ANY.RUN’s Threat Intelligence provides the essential solutions to power this transformation across […]
The post Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction appeared first on ANY.RUN's Cybersecurity Blog.
Supply chain vulnerabilities represent a growing attack surface for US and EU organizations. With advanced threat tactics on the rise, reducing Mean Time to Detect (MTTD) and Respond (MTTR) is essential. ANY.RUN integrates directly into the SOC workflows as an investigative layer, providing fast malware analysis and threat intelligence to help security teams boost their […]
The post Supply Chain Security: How ANY.RUN Helps US and EU Enterprises Prevent Incidents appeared first on ANY.RUN's Cybersecurity Blog.
Editor’s note: This work is a collaboration between Mauro Eldritch from BCA LTD (follow Mauro on X), a company dedicated to threat intelligence and hunting, Heiner García from NorthScan (follow Heiner on X), a threat intelligence initiative uncovering North Korean IT worker infiltration, and ANY.RUN, the leading company in malware analysis and threat intelligence. The […]
The post Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup appeared first on ANY.RUN's Cybersecurity Blog.
ChongLuaDao protects over 200 million users from cybercrime, having detected more than 1.4 million malicious websites since 2020. Rapid processing of community reports is essential to their operations. In our recent conversation, ChongLuaDao co-founder Hieu Ngo told us how ANY.RUN plays an integral role in the project’s infrastructure, helping it power thousands of safety checks […]
The post Safeguarding 200M Users: How ChongLuaDao Scales Threat Validation with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.
July 2026 showed how trusted business workflows can quickly turn into account takeover, data exposure, fraud, and persistent access. ANY.RUN observed attacks that put cloud accounts, financial processes, sensitive data, and business continuity at risk across the US, Europe, and Brazil. Here are the major attacks from July, the business risks they exposed, and the […]
The post Major Cyber Attacks in July 2026: US and EU Organizations Hit by Phishing, RATs, and Stealers appeared first on ANY.RUN's Cybersecurity Blog.
