ANY.RUN

Empowering businesses with proactive security solutions: Interactive Sandbox,
TI Lookup and Feeds. Sign up:

[ANY.RUN @anyrun_app]

🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit.

@BirminghamCyber & @north_scan used #ANYRUN Sandbox to capture weeks of Famous Chollima activity inside a fake startup.

👀 How not to let a spy in? See full story and videos: https://t.co/IOUZmZEjJQ

[ANY.RUN @anyrun_app]

🚨 An RMM #phishing campaign spans 46 countries with 44% of activity in the US. Legitimate signed RMM software as payload: no malware verdict, no AV flag.

⚡️ #ANYRUN exposes the delivery chain and expands IOCs into the wider campaign: https://t.co/Zmg1017iZd

[ANY.RUN @anyrun_app]

⚡ Reactive security hurts resilience.
#ANYRUN gives enterprise SOCs and MSSPs a different operational model, where detection is continuously fueled by fresh intelligence.

See how to build intelligence-driven threat monitoring with #ANYRUN 👇
https://t.co/MO9gWmH7yp

[ANY.RUN @anyrun_app]

🔎 What changed in #ANYRUN this August?

A new Connections experience in TI Lookup helps analysts uncover related infrastructure faster ⚡

Plus, 656+ new rules and fresh research on active campaigns.

See how these updates strengthen your SOC response 👇
https://t.co/q1wv2HLrXr

[ANY.RUN @anyrun_app]

🚨 Typosquatting packages on PyPI are targeting 𝗿𝗲𝗾𝘂𝗲𝘀𝘁𝘀, one of the most widely used Python packages. Catch them before compromise.

Attack timeline: 3 hours ago, a new PyPI account was registered. One hour later, four packages were published: 0requests, py-0requests, py-1requests, and py-2equests.

⚠️ On import, each package:
– collects env vars prefixed SECRET / API / TOKEN / KEY
– sends them over a raw TCP socket
– spawns a reverse shell hook

The callback currently points to 127.0.0.1, so the payload is staged, not armed, but the host is read from TS_HOST. One update could switch exfiltration to a live C2 channel and turn it into an active supply-chain threat ❗️

👨‍💻 Full behavior analysis and IOCs in #ANYRUN Sandbox: https://t.co/wmT4bjqbo5

📌 All packages on PyPI: https[:]//pypi[.]org/user/preet780/

A mistyped dependency in a CI/CD pipeline can be enough to leak credentials. Catch it before the package becomes a real compromise with #ANYRUN: https://t.co/rc55Cne7cF

[ANY.RUN @anyrun_app]

⚠️ Infostealers circulate at high volume across US organizations and can feed into ransomware intrusions.

❗ Law enforcement disruptions don't shrink demand. When Lumma Stealer was disrupted in 2025, Remus Stealer emerged as a direct technical successor within weeks. Criminal demand migrates, not diminishes, and the new generation adds session cookie theft that bypasses MFA outright.

Do not treat a stealer detection as a contained incident 🚨

See how #ANYRUN's behavioral evidence and Threat Intelligence help prevent incidents: https://t.co/N7uj4zql1X

[ANY.RUN @anyrun_app]

💡 #ANYRUN TI Feeds turn IOCs into continuous monitoring by streaming fresh, validated indicators and behavior-based threat data into your security stack.

📋 IOCs:
Phishing Landing:
txg-verification-common-endpoint-v4-vzfg-com[.]us-east-1[.]linodeobjects[.]com
flowport[.]us-mia-1[.]linodeobjects[.]com
smoft-common-rt-6709[.]us-east-1[.]linodeobjects[.]com
gingerbeaulieu0785[.]workers[.]dev
xmsoft-common-v-883-com[.]us-southeast-1[.]linodeobjects[.]com
msoff-common-v-pqc-77-com[.]us-east-1[.]linodeobjects[.]com
mxoff-common-v-823qc-com[.]us-east-1[.]linodeobjects[.]com
msoff-common-v-pqc-com[.]us-east-1[.]linodeobjects[.]com
nand[.]b29e185437704fe0a494f89f[.]workers[.]dev
msoff-standard-v-pqc-com[.]us-east-1[.]linodeobjects[.]com
bridgeflow098[.]us-mia-1[.]linodeobjects[.]com
lib-0568[.]website-us-southeast-1[.]linodeobjects[.]com

Polling Host:
panel[.]bcarl24[.]icu
Dauntingmoon[.]online

[ANY.RUN @anyrun_app]

🚨 We uncovered #N0va, a new phishkit targeting organizations in North America and Europe across government, technology, consulting, and healthcare.

❗️ It splits its infrastructure across compromised legitimate sites and shared/cloud hosting, including Cloudflare Workers and Linode Object Storage.

Observed lures: Microsoft Security, Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, Adobe Sign.

⚠️ N0va uses Device Code phishing to obtain access and refresh tokens through legitimate Microsoft authentication, then moves toward PRT-based SSO access via token exchange and device registration. The risk is fragmented visibility: no single layer shows the full attack.

👨‍💻 #ANYRUN Sandbox helps reveal browser behavior, extract IOCs, and pivot to related activity faster. Review the analysis sessions and improve your detection coverage:
🔹 Microsoft-themed lure: https://t.co/xaV5IuAjJS
🔹 DocuSign-themed lure: https://t.co/cZB106qvpk

💬 Find IOCs in the comments and let us know which detection layer would give you the earliest signal.

🔍 Track N0va activity and uncover related infrastructure in TI Lookup: https://t.co/aVno9dNKoi

⚡️ Strengthen your SOC, detect complex threats faster, and boost team performance with #ANYRUN: https://t.co/FbaYwM84XU

[ANY.RUN @anyrun_app]

⚠️ Active in August 2026. Three widespread PhaaS kits tracked by #ANYRUN:
🔹 #Sneaky2FA intercepts M365 session cookies in real time across nearly 100 identified phishing domains: https://t.co/ar56XLpCaj

🔹 #Kali365 captures OAuth tokens after genuine MFA, with AI-generated lures in 15 languages and 34 brand templates: https://t.co/gRco2LbhZd

🔹 #EvilTokens uses compromised M365 accounts that pass SPF, DKIM & DMARC, then captures OAuth tokens valid for up to 90 days: https://t.co/V5sE5eF1Ir

🔍 See live data on each kit and keep your detections current.

[ANY.RUN @anyrun_app]

📉 MSSP margins disappear one investigation at a time.

Manual enrichment, unnecessary escalations, and stale threat data add analyst time to every case ⏳

How to cut friction, reduce MTTR by up to 21 min/case, and give your team room to scale 👇
https://t.co/xJhR4iUIhh

[ANY.RUN @anyrun_app]

🚨 US & EU organizations faced a new wave of high-impact attacks in August.

From M365 session hijacking to remote-control malware and fake IT hires, attackers targeted trusted business systems and workflows.

Close the gaps these attacks exposed 👇
https://t.co/j4sG0enMo1

[ANY.RUN @anyrun_app]

⚠️ Phishing targeting US companies passes static analysis and produces clean verdicts, which is harder to detect.

#ANYRUN closes the visibility gap and builds a consistent investigation process ⚡

🎯 Improve phishing detection in your SOC: https://t.co/7kgKvqJOWK

[ANY.RUN @anyrun_app]

Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: https://t.co/qg6D10jsiv

#TopPhishingThreats

[ANY.RUN @anyrun_app]

🚨 #Makop Ransomware targets vulnerable perimeters, demanding an average $15,000 extortion payment.

Businesses face severe operational downtime and massive data recovery costs ⚠️

Here's how SOC teams can detect and mitigate this threat: https://t.co/erzuutjL9p

[ANY.RUN @anyrun_app]

⚡️ Reduce MTTD to 15 seconds per case in your SOC. Sign up now to detect complex malware & phishing threats early: https://t.co/hIKngnkvE1

[ANY.RUN @anyrun_app]

🎯 We added and updated 39 Suricata rules based on real attacker behavior observed in the wild. Explore the examples and strengthen your detection.

#ANYRUNSuricataChangelog 08/24 – 08/30/2026
Here are 10 examples 👇
89004269 | STEALER [https://t.co/5F3kh2e7mb] Phantom Stealer Exfil via Telegram Bot API (bot8993270741).
Example analysis session: https://t.co/RdLRU23boQ

89004270 | RAT [https://t.co/5F3kh2e7mb] SnakeBite CnC Check-in observed.
Example analysis session: https://t.co/ZORcg2zTtS

89004272 | RAT [https://t.co/5F3kh2e7mb] Evolution RAT CnC Check-in observed.
Example analysis session: https://t.co/DWID4WjUA6

89004277 | RAT [https://t.co/5F3kh2e7mb] Win32/Generic TCP-packet chain observed.
Example analysis session: https://t.co/SbyIYYZiju

89004278 | STEALER [https://t.co/5F3kh2e7mb] Win32/Generic Steam-targeted stealer.
Example analysis session: https://t.co/q6inJQrFWe

89004286 | LOADER [https://t.co/5F3kh2e7mb] MSIL/Generic TCP-packet chain observed.
Example analysis session: https://t.co/NnPO24AwBI

89004287 | LOADER [https://t.co/5F3kh2e7mb] Win32/Generic CnC check-in observed.
Example analysis session: https://t.co/gOdJlBv8Zk

84004470 | STEALER [https://t.co/5F3kh2e7mb] V20-Stealer related Telegram DDR observed (/kahagqhkakneh).
Example analysis session: https://t.co/jbxZIyCnha

84004471 | STEALER [https://t.co/5F3kh2e7mb] V20-Stealer beacon activity observed (/gate?mode=beacon).
Example analysis session: https://t.co/jbxZIyCnha

84004490 | PHISHING [https://t.co/5F3kh2e7mb] Adobe Lure observed on GitHub Pages M2.
Example analysis session: https://t.co/QW3wqc2Rq4

Explore the complete ruleset: https://t.co/cotArEFEZI

[ANY.RUN @anyrun_app]

⚠️ Growth wasn't limited to a single malware category last week. RATs, stealers, loaders, and even ransomware all moved higher, led by #Medusa, #AsyncRAT, #XWorm, and #DCRat.

📌 Trend to watch: when multiple malware types accelerate together, defenders should expect a broader range of attack scenarios rather than a spike in one specific threat.

Monitor the malware driving today’s attacks: https://t.co/GRZMEh5pi4

#Top10Malware

[ANY.RUN @anyrun_app]

⚠️ As attacker infrastructure changes, intelligence needs to reach detection just as fast.  

⚡ #ANYRUN TI Feeds deliver fresh IOCs via STIX/TAXII to enrich alerts, trigger playbooks, and block threats faster.  

🔥 Keep your detection current with TI Feeds: https://t.co/366sP6tMii

[ANY.RUN @anyrun_app]

🚨A US-first phishing campaign is rotating domains, hosting, and RMM tools to evade detection.

The infrastructure changes, but the delivery chain is the same.

⚡#ANYRUN exposed its patterns and linked persistent indicators to cases across 46 countries: https://t.co/3f0ScozkIZ

[ANY.RUN @anyrun_app]

#IOCs:

𝗡𝗲𝘁𝘄𝗼𝗿𝗸

172.111.138[.]100:2030 — C2

172.111.138[.]100:4444 — C2

Supports@consultant[.]com — contact in the lock screen

𝗦𝗛𝗔-𝟮𝟱𝟲

c91b3c9193856742bfcc9c525b9ed560348a06e3af092488bbddc0738cc48512 — ZIP lure

d03bdd70830a6f32c867f0828ce7c03cac0a8a780451d3229e28efdbb9f7e478 — VBS

133e284c9cb037492977eb57922c8cf6a9b08a5976f2ba9fb75a8db30e903cab — PowerShell unpacker

89b1de66d7d1de064aeff04663c7b19e7f7f77b81d2bfe54f0b069048e6eeafb — SnakeBiteAgent

bb03da5388d849432c3fc2c99e61fc61137079dcfb997df7f0482b511d89d17e — 2nd build

576ccc6db6f07dbb136d3524b6379716a6e1f9904d7dde55a40e2ac06571aea1 — sb_SnakeBiteAgent.exe

04dc4ea3fe73c57b55d4588fa999e4778ec8fe9c6b6c93485e18f5a8f8d441fd — the base64 blob it was decoded from

5181b1853fc24a248560593b70819c580ec864e8a124ca5885e5e97bb70bbe27 — Startup shortcut

𝗣𝗮𝘁𝗵𝘀

%LOCALAPPDATA%\Microsoft\Windows<rand><rand>.exe — the implant

%TEMP%<rand>.ps1 — unpacker, deleted straight after use

%APPDATA%\Microsoft\SBKeylog.dat — offline keylog

%APPDATA%\Microsoft\SBFirstRun.dat — first-run date

%APPDATA%\Microsoft\sb_lock_state.flag — lock state #1

%TEMP%\sb_lock_state.flag — lock state #2

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup<rand>.url

%TEMP%\sb_* — module scratch files:

sb_av.ps1
sb_chat_box.vbs
sb_bw_
sb_bh_
sb_login_
sb_hist_
sb_br_profile_

𝗛𝗼𝘀𝘁 𝗼𝗯𝗷𝗲𝗰𝘁𝘀

Global\SBAgent* — mutex

HKCU\Software\SB[a-z]{6} — registry

[ANY.RUN @anyrun_app]

𝗪𝗲 𝘂𝗻𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝗻𝗲𝘄 .𝗡𝗘𝗧 𝗥𝗔𝗧 — 𝗦𝗻𝗮𝗸𝗲𝗕𝗶𝘁𝗲𝗔𝗴𝗲𝗻𝘁. An implant pulled from a business-themed ZIP, which hands the attacker full remote control, credential access, and persistent surveillance.

⚠️ 274 methods with no obfuscation and nothing encrypted on the wire.

C2 communication uses a TCP-based protocol. Each message is sent as a single line in the 𝗦𝗕𝟲𝟰|<𝗯𝗮𝘀𝗲𝟲𝟰(𝘁𝗲𝘅𝘁)> format. Responses from the C2 server contain the same text without the SB64 wrapper.

👨‍💻 Execution chain, C2 protocol and detection recommendations are listed in the visuals. See the analysis sessions:

🔸 https://t.co/VB12zBgeyR

🔸 https://t.co/DMwoGwbTXm

🚀 Strengthen your SOC with #ANYRUN: https://t.co/BzFsf7Ho6h