North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign

North Korean threat actors behind the ongoing Contagious Interview campaign have been observed dropping a new JavaScript malware called OtterCookie.
Contagious Interview (aka DeceptiveDevelopment) refers to a persistent attack campaign that employs social engineering lures, with the hacking crew often posing as recruiters to trick individuals looking for potential job opportunities into

The Hacker News – ​Read More

Cyberhaven says it was hacked to publish a malicious update to its Chrome extension

The data-loss startup says it was targeted as part of a “wider campaign to target Chrome extension developers.”

© 2024 TechCrunch. All rights reserved. For personal use only.

Security News | TechCrunch – ​Read More

Deepfakes, Quantum Attacks Loom Over APAC in 2025

Organizations in the region should expect to see threat actors accelerate their use of AI tools and mount ongoing “harvest now, decrypt later” attacks for various malicious use cases.

darkreading – ​Read More

Hackers Are Hot for Water Utilities

The US water sector suffered a stream of cyberattacks over the past year and half, from a mix of cybercriminals, hacktivists, and nation-state hacking teams. Here’s how the industry and ICS/OT security experts are working to better secure vulnerable drinking and wastewater utilities.

darkreading – ​Read More

Defining & Defying Cybersecurity Staff Burnout

Sometimes it feels like burnout is an inevitable part of working in cybersecurity. But a little bit of knowledge can help you and your staff stay healthy.

darkreading – ​Read More

Record-breaking ransoms and breaches: A timeline of ransomware in 2024

From LoanDepot to Evolve Bank and Blue Yonder, these ransomware attacks affect tens of millions of people.

© 2024 TechCrunch. All rights reserved. For personal use only.

Security News | TechCrunch – ​Read More

Release Notes: New Search Operators in TI Lookup, MISP Integration, Multi-admin Support 

As we wrap up 2024, we’re excited to share the final release notes of the year, and they’re packed with updates you’re going to love! 

This December, we’ve shared some great news with our ANY.RUN community. From new wildcards and search operators in TI Lookup to the launch of our MISP instance and an upgraded Teamwork feature, we’ve been working to make your workflows smoother and more collaborative.  

And of course, we’ve expanded our threat coverage to ensure you’re ready to tackle whatever comes next.  

Let’s dive in! 

New Wildcards and Search Operators in ANY.RUN’s TI Lookup 

Searching through massive amounts of cyber threat data isn’t exactly fun. It can be frustrating when small variations in domain names or IP addresses make it hard to connect the dots. That’s why we’ve updated Threat Intelligence Lookup (TI Lookup) with new wildcards and search operators to give you more control and flexibility when crafting queries. 

Before this update, TI Lookup allowed you to use the basic operators AND along the wildcard *, which work great for flexible searches.  

In December, we’ve expanded this functionality by adding new wildcards and operators to make threat intelligence even more versatile. 

What’s new? 

  • OR: The OR operator broadens your search by including results where at least one of the specified conditions is met.  
Example of a query with OR search operator inside TI Lookup 
  • NOT: The NOT operator excludes results matching specific conditions, narrowing your search to focus on relevant entries. 
  • Parentheses (): They group conditions to ensure your query processes operators in the correct order, enabling precise, complex searches. 
  • Question mark (?): Acts as a placeholder for a single character or none, making it perfect for handling variable strings. 
  • Dollar sign ($): Ensures your search term appears at the end of a string, useful for pinpointing entries with specific endings. 
  • Caret (^): Makes sure your search term appears at the beginning of a string, ideal for narrowing searches to items starting with specific patterns. 

For more details, check out the guide to using wildcards and operators

Get 50 free requests in TI Lookup
to enrich your threat investigations 



Contact us


MISP Integration: A New Option for Threat Intelligence Sharing 

We’re excited to share that in December, we introduced our own MISP instance, providing access to Indicators of Compromise (IOCs) from ANY.RUN’s Threat Intelligence Feeds. This new feature brings even greater collaboration and efficiency to threat intelligence sharing. 

MISP (Malware Information Sharing Platform) is a free, open-source tool that streamlines the sharing of threat intelligence, enabling organizations to exchange data, identify compromises, and automate correlations. 

MISP attributes dashboard in Elastic Search 

With ANY.RUN’s MISP instance, you can: 

  • Access TI Feeds: Get real-time streams of malicious IPs, URLs, domains, ports, file names, and hashes from ANY.RUN’s Interactive Sandbox. The IOCs are pulled from different sources, including network activities and malware configurations. 
  • Integrate with security tools: Connect ANY.RUN’s MISP instance to your SIEM, XDR, or other tools via API. 
  • Improve threat detection: Enrich your IOCs with ANY.RUN’s data for a clearer understanding of threats. 
  • Generate IDS rules: Export attributes in NIDS-compatible formats for use in IDS/IPS or NGFW systems. 
ANY.RUN offering demo feeds samples in STIX and MISP formats 

You can test ANY.RUN’s MISP and STIX feeds by getting a free demo sample or contacting us

New Teamwork Feature: Multiple Admin Support  

We’re excited to announce a powerful December update to ANY.RUN’s Teamwork feature, designed to simplify team management and improve collaboration for organizations of all sizes. 

Team owners can now assign admin roles to team members, with no limits on the number of admins.  

Admins have the following capabilities: 

  • Enable or disable Single Sign-On (SSO) for the team. 
  • Invite or remove team members as needed. 
  • Manage licenses for team members, including access to features like TI Lookup. 

Besides, admins can assign or revoke admin rights, ensuring flexible and efficient management. 

This update was driven by feedback from our customers, who needed a way to share responsibilities within their teams. Here’s how it can help: 

  • Delegation: If a team owner is unavailable (e.g., on vacation), responsibilities can easily be handed over to admins. 
  • Time zone flexibility: Large teams operating in different time zones can now have admins based in various regions, improving responsiveness and workflow efficiency. 

How to start using this feature  

Team owners can assign admin roles in the Teamwork section under Licenses. Once set up, admins can immediately start managing the team and sharing responsibilities. 


ANY.RUN cloud interactive sandbox interface

What is Enterprise plan?

Discover all features of the Enterprise plan
and learn about its Team Management capabilities



Threat Coverage Updates

In December, we expanded our detection capabilities, adding 58 new malware signatures, introducing advanced YARA rules, and further improving our machine learning (ML) models to keep up with evolving threats. 

Signatures 

We’ve introduced 58 new signatures targeting a diverse range of malware families. Here are some of them: 

APT Detection Updates 

We’ve enhanced our detection capabilities for several known APT attacks: 

  • SimpleHelp, BugSleep, and PortStarter are now comprehensively monitored. 

New YARA Rules 

5 new YARA rules were added this month for more precise detection: 

Suricata Rule Updates 

This month, we’ve significantly expanded our Suricata rule collection by adding 5,159 new rules, enhancing our detection accuracy across a variety of threats.  

These updates include focused detections for phishing kits, such as: 

Automated Interactivity Enhancements 

We’ve fine-tuned our automated interactivity clicker, making it smarter. These updates mean it’s now even better at interacting with malware samples, accurately simulating how real users might behave. 

With these improvements, detecting complex threats just got easier. We made sure you get even more reliable results for your investigations. 

About ANY.RUN  

ANY.RUN is a leading provider of a cloud-based malware analysis sandbox for effective threat hunting. Our service lets users safely and quickly analyze malware without the need for on-premises infrastructure. ANY.RUN is used by organizations of all sizes, including Fortune 500 companies, government agencies, and educational institutions.

With ANY.RUN you can: 

  • Detect malware in seconds
  • Interact with samples in real time
  • Save time and money on sandbox setup and maintenance
  • Record and study all aspects of malware behavior
  • Collaborate with your team 
  • Scale as you need

Get a 14-day free trial of ANY.RUN’s Interactive Sandbox →

The post Release Notes: New Search Operators in TI Lookup, MISP Integration, Multi-admin Support  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia

The threat actor known as Cloud Atlas has been observed using a previously undocumented malware called VBCloud as part of its cyber attack campaigns targeting “several dozen users” in 2024.
“Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formula editor (CVE-2018-0802) to download and execute malware code,” Kaspersky researcher Oleg

The Hacker News – ​Read More

The Paper Passport Is Dying

Smartphones and face recognition are being combined to create new digital travel documents. The paper passport’s days are numbered—despite new privacy risks.

Security Latest – ​Read More

Russia, Ukraine, China, and More: The Nations at the Center of the Cybercrime Epidemic 

Cyble | Cybercrime threats

Overview

Cyberattacks on a country’s critical infrastructure have become a growing malicious trend globally. The surge in cybercrime threats and its growing impact on national security, businesses, and individuals has led experts to closely examine which regions face the most cyberattacks.  

A recent study from the World Cybercrime Index (WCI) compiled by an international team of researchers, shed light on the most targeted countries, ranking them based on the severity of cyberattacks, the skill of the perpetrators, and the professionalism of the cybercriminals involved. 

As of 2024, these countries face the highest levels of cybercrime threats, driven by a complex mix of geopolitical factors, technological infrastructure, and economic conditions. This blog explores the top 10 countries that are most impacted by cyberattacks and why they are at the forefront of the global cybersecurity challenge. 

10. India: A Victim of Cybercrime Amid Rapid Digitalization 

India ranks tenth in the global cybercrime index, experiencing an uptick in cyberattacks due to its rapid digital transformation. The country’s massive online population and growing e-commerce sector make it an appealing target for cybercriminals. Phishing scams, financial fraud, and ransomware attacks are common in India, with both individuals and organizations being affected. The Indian government has been working to bolster cybersecurity, but the increasing maliciousness of cybercriminals presents an ongoing challenge for the country. 

Read also: https://cyble.com/resources/research-reports/india-threat-landscape-report-2024/ 

9. Brazil: A Growing Cybercrime Hotspot in Latin America 

Brazil, the largest economy in Latin America, has witnessed a surge in cyberattacks, particularly those targeting its financial sector and government institutions. Brazil’s growing digital economy has made it an attractive target for cybercriminals involved in fraud, data breaches, and ransomware. The WCI places Brazil ninth, citing its vulnerability to cybercrime despite efforts to improve cybersecurity regulations. Cybercriminal groups operating in Brazil often specialize in online fraud, identity theft, and other forms of financial cybercrime. 

Read also: https://cyble.com/blog/goatrat-android-banking-trojan-variant-targeting-brazilian-banks/ 

8. United Kingdom: A Rising Cyberattack Target 

The United Kingdom faces major cybersecurity threats, ranking eighth on the WCI. As a major financial and technological hub, the UK is often targeted by both cybercriminals and state-sponsored actors. Ransomware attacks and data breaches have been particularly impactful, with high-profile incidents affecting public and private sector organizations. The UK government has increased its efforts to combat cybercrime, but the country remains a target due to its global standing and the increasing digitization of its economy. 

7. North Korea: Cyber Warfare and Financial Theft 

North Korea’s cybercriminal activities are well-documented, with the country’s state-sponsored hackers playing a prominent role in cyberwarfare and financial cybercrime. The regime has been linked to several high-profile cyberattacks, including the infamous WannaCry ransomware attack and attacks on South Korean entities.  

North Korea’s cyber units, such as Lazarus Group, are involved in stealing funds through cybercrime to finance the country’s regime. Their targets are often financial institutions, cryptocurrency exchanges, and government agencies, making North Korea a critical player in the global cybercrime arena. 

6. Romania: A Hotbed for Cybercrime Groups 

Romania is a big player in the global cybercrime ecosystem, ranking sixth on the WCI. The country is home to several notorious cybercriminal groups involved in ransomware attacks, data theft, and financial fraud.  

Romanian hackers are known for their technical expertise and ability to deploy malware across multiple sectors. The Romanian government has made efforts to crack down on cybercrime, but the country remains a hotbed for cyberattacks on countries worldwide, particularly targeting financial institutions and online businesses. 

Read also: https://cyble.com/blog/romania-urges-energy-sector-of-proactive-scanning-amid-lynx-ransomware-threat/ 

5. Nigeria: A Leading Hub for Cybercrime in Africa 

Nigeria has earned a place on the list of the top cyberattack countries due to its increasing involvement in online fraud, scams, and cybercrimes. Known for its widespread involvement in “419” fraud (advance-fee fraud) and cyber scams targeting both individuals and corporations globally, Nigeria’s cybercriminal activities are a growing concern. The country is also home to highly organized cybercrime groups, some of which use cybersecurity tools to launch phishing campaigns and steal sensitive data. The lack of sufficient cybersecurity infrastructure and regulatory enforcement contributes to the persistent cybercrime problem in Nigeria. 

4. United States: A Prime Target and Source of Cyberattacks 

The United States is not only a major source of cyberattacks but also one of the most heavily targeted nations globally. As the world’s largest economy and a hub for technological innovation, the U.S. faces an array of cyberthreats, from cybercriminals seeking financial gain to nation-state actors pursuing espionage objectives. 

The U.S. has witnessed high-profile cyberattacks, including those targeting critical infrastructure, government agencies, and multinational corporations. Ransomware attacks, data breaches, and election interference campaigns are just a few examples of the cybercrimes affecting the U.S., positioning it as one of the countries most impacted by cyberattacks. 

Read also: https://cyble.com/resources/research-reports/us-threat-landscape-report-a-time-of-growing-peril/ 

3. China: A Major Player in Cyber Espionage 

China ranks third in the global cybercrime rankings, largely due to its involvement in large-scale cyber espionage operations. The country has been accused of conducting numerous cyberattacks aimed at stealing intellectual property and accessing sensitive government and corporate data across the globe. 

Chinese cybercriminals are notorious for their high level of technical skill and have been linked to various attack methods, including Advanced Persistent Threats (APT). China’s rapid technological growth and its economic prominence have made it both a source and a victim of cyberattacks, making it one of the top cyberattack countries. 

2. Ukraine: A Geopolitical Hotspot for Cyberattacks 

Ukraine is another country that faces immense cybercrime threats. Since the 2014 annexation of Crimea, Ukraine has been subject to numerous state-sponsored cyberattacks, primarily from Russia. The country has been the target of ransomware attacks and power grid disruptions, making it a prominent example of cyberwarfare in the 21st century. 

The WCI ranks Ukraine second due to its vulnerability to cyberattacks, especially amid ongoing political tensions and military conflicts with Russia. Ukrainian government agencies, critical infrastructure, and businesses have been the focus of cyber attackers.  

Read also: Hackers Target Ukrainian Army with Fake Military Apps to Siphon Authentication and GPS Data 

1. Russia: The Epicenter of Cybercrime 

Russia remains the undisputed leader in terms of cybercriminal activity. Ranked number one on the World Cybercrime Index, Russia has been a hub for various cybercrime types, including state-sponsored attacks, ransomware campaigns, and hacking for espionage purposes.  

The country’s role in cyberattacks on countries globally, particularly targeting political opponents, is well-documented.  

Read also: Russian State Hackers Biggest Cyber Threat to US, UK and EU Elections 

The troubling nature of cybercriminal operations in Russia, coupled with their expertise in developing malware, makes the nation a constant threat to others. 

Conclusion: The Global Fight Against Cybercrime 

As we move into 2025, cyberattacks on countries are increasingly impacting vital sectors like government, finance, and healthcare. Countries such as Russia, Ukraine, China, and the United States are at the forefront of this growing global issue. To combat these threats, governments, organizations, and cybersecurity experts must collaborate to strengthen defenses and proactively monitor cybercriminal activities.  

Cyble, a leader in AI-powered cybersecurity, is playing an important role in this effort. Cyble offers multiple threat intelligence platforms that offer real-time monitoring, which processes vast amounts of dark web data and provides actionable insights. By leveraging AI-driven platforms like Cyble, organizations and government sectors can protect their infrastructure and respond to cyberattacks more effectively, helping to ensure a more secure future. 

References 

The post Russia, Ukraine, China, and More: The Nations at the Center of the Cybercrime Epidemic  appeared first on Cyble.

Blog – Cyble – ​Read More