Release Notes: System Updates, New YARA and Suricata Rules, Signatures, and More

Hello, cybersecurity enthusiasts! 

January may often feel like a slow month, but at ANY.RUN, we’ve been hard at work behind the scenes, focusing on system and threat coverage updates. 

As the new year kicked off, our team dived straight into fine-tuning the platform, optimizing performance, and strengthening detection capabilities. 

Now that February is here, let’s take a look at what we’ve been up to and how these updates enhance your malware-hunting experience. 

System Updates: Keeping Things Running Smoothly 

In January, we focused on making ANY.RUN’s Interactive Sandbox and Threat Intelligence Lookup faster, more stable, and overall better for you. 

Our team has been fixing bugs, fine-tuning the system, and optimizing performance so that everything runs like clockwork. These aren’t the kind of changes you immediately notice, but they make a big difference in keeping your malware analysis smooth and hassle-free. 

While January was all about optimizations, stay tuned as we have plenty of exciting updates coming your way soon! 

Threat Coverage Updates 

We continued expanding ANY.RUN’s detection capabilities and strengthening its ability to identify emerging threats. This included adding new malware signatures, refining YARA rules, and enhancing Suricata rule sets to keep up with evolving attack techniques. 

New Malware Signatures 

We’ve introduced new signatures to detect a wide range of malware families. Here are some of the threats we now cover: 

Try advanced malware analysis with ANY.RUN 



Get 14-day trial


New YARA Rules 

To improve our malware classification and detection precision, we’ve added YARA rules for the following: 

YARA + Signatures 

For even more precise detections, we’ve combined YARA rules and malware signatures to cover: 

APT Detection Updates 

Our threat intelligence team has improved detection capabilities for several APT groups, focusing on domain-related threats: 

  • Patchwork APT 
  • Ducktail APT 
  • Sidewinder APT 
  • ScreenConnect 

Suricata Rule Updates 

We’ve also strengthened our network-based detection capabilities by adding 5,578 new Suricata rules. Notable additions include focused detections for phishing kits such as: 

Helping Businesses Stay Ahead of Cyber Threats 

Businesses can’t afford to fall behind the constantly evolving cyber threats. Attackers are getting smarter, using new techniques to bypass defenses and target organizations with phishing kits and malware.  

That’s why we’re always refining ANY.RUN’s detection capabilities and analysis tools. From spotting emerging malware families to improving APT detection, we’re making sure security teams have the insights they need to stop threats before they cause real damage. 

Cybercriminals adapt fast, but let’s always stay one step ahead. More updates, more improvements, and better ways to protect your business are on the way. Stay tuned! 


ANY.RUN cloud interactive sandbox interface

Sandbox for Businesses

Discover all features of the Enterprise plan designed for businesses and large security teams.



About ANY.RUN

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search, and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.

Request free trial of ANY.RUN’s services → 

The post Release Notes: System Updates, New YARA and Suricata Rules, Signatures, and More appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Meet the Hired Guns Who Make Sure School Cyberattacks Stay Hidden

An investigation into more than 300 cyberattacks against US K–12 schools over the past five years shows how schools can withhold crucial details from students and parents whose data was stolen.

Security Latest – ​Read More

Google Patches 47 Android Security Flaws, Including Actively Exploited CVE-2024-53104

Google has shipped patches to address 47 security flaws in its Android operating system, including one it said has come under active exploitation in the wild.
The vulnerability in question is CVE-2024-53104 (CVSS score: 7.8), which has been described as a case of privilege escalation in a kernel component known as the USB Video Class (UVC) driver.
Successful exploitation of the flaw could lead

The Hacker News – ​Read More

Microsoft Patches Critical Azure AI Face Service Vulnerability with CVSS 9.9 Score

Microsoft has released patches to address two Critical-rated security flaws impacting Azure AI Face Service and Microsoft Account that could allow a malicious actor to escalate their privileges under certain conditions.
The flaws are listed below –

CVE-2025-21396 (CVSS score: 7.5) – Microsoft Account Elevation of Privilege Vulnerability
CVE-2025-21415 (CVSS score: 9.9) – Azure AI Face Service

The Hacker News – ​Read More

Microsoft SharePoint Connector Flaw Could’ve Enabled Credential Theft Across Power Platform

Cybersecurity researchers have disclosed details of a now-patched vulnerability impacting the Microsoft SharePoint connector on Power Platform that, if successfully exploited, could allow threat actors to harvest a user’s credentials and stage follow-on attacks.
This could manifest in the form of post-exploitation actions that allow the attacker to send requests to the SharePoint API on behalf

The Hacker News – ​Read More

Microsoft Will Remove the Free VPN That Comes With Windows Defender Soon

The feature will no longer be available starting Feb. 28. Microsoft wants to focus on “new areas that will better align to customer needs.”

Security | TechRepublic – ​Read More

Anthropic claims new AI security method blocks 95% of jailbreaks, invites red teamers to try

VentureBeat/Ideogram


The new Claude safeguards have already technically been broken but Anthropic says this was due to a glitch — try again.Read More

Security News | VentureBeat – ​Read More

Hackers Hide Malware in Fake DeepSeek PyPI Packages

Malicious DeepSeek packages on PyPI spread malware, stealing sensitive data like API keys. Learn how this attack targeted developers and how to protect yourself.

Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News – ​Read More

‘Constitutional Classifiers’ Technique Mitigates GenAI Jailbreaks

Anthropic says its Constitutional Classifiers approach offers a practical way to make it harder for bad actors to try and coerce an AI model off its guardrails.

darkreading – ​Read More