Recently, we hosted a webinar exploring the everyday challenges SOC teams face and how ANY.RUN helps solve them. From low detection rates to alert fatigue, poor coordination, and infrastructure overhead, our team outlined a practical action plan to tackle it all. 

Missed the session? Here are the key highlights in this quick recap. 

1. Increasing Detection Rate 

Challenge: Malware is getting trickier. Fileless techniques, multi-stage payloads, and threats that hide behind user interactions are slipping past traditional tools. This leaves SOC teams blind to critical risks. 

Solution: ANY.RUN tackles this head-on by giving analysts a fully interactive sandbox environment. You don’t just watch malware from a distance but also engage with it like a real user. Open files, enter passwords, click suspicious links, whatever it takes to trigger the full execution chain. 

One real-world case shows exactly why this is so important. 

View analysis session here 

A phishing email came through with an SVG attachment and a password hidden in the message body. Opening the SVG revealed a fake document with a link to download a PDF. That triggered a download of a ZIP archive; one that could only be extracted by manually entering the earlier password. 

Inside we found an executable file. When run, ANY.RUN flagged it immediately as AsyncRAT, a remote access trojan capable of spying on and controlling infected systems. 

Without interactivity, none of this would have unfolded. A fully automated tool wouldn’t have clicked the link, copied the password, or opened the archive. The attack would’ve gone undetected. 

More importantly, the sandbox gave the team: 

• A full process breakdown, showing exactly how the malware executed 

• Network activity visibility, helping block C2 communication before data exfiltration 

• Malware configuration (MalConf), revealing hardcoded domains and other indicators 

2. Accelerating Alert Triage and Incident Response 

Challenge: When a threat gets past initial defenses, every second counts. The longer it takes to triage an alert or respond to an incident, the higher the risk of malware spreading, systems being compromised, and costly damage being done. 

Solution: ANY.RUN provides real-time visibility into malware behavior; no waiting for the sandbox session to end. SOC teams can spot malicious activity the moment it begins, with some malware families being identified even in under 40 seconds. 

View analysis session here 

In one case, a suspicious executable was submitted. Within just 18 seconds, ANY.RUN identified it as RedLine Stealer, an infostealer known for targeting credentials and sensitive data. 

That rapid detection enabled the security team to take immediate action, cutting off further exposure and containing the threat before it spread. 

3. Streamlining Training and Onboarding

Challenge: Most security tools come with a steep learning curve. New hires, especially junior analysts, often need months of training before they can contribute meaningfully. That slows down onboarding and increases your team’s dependency on a handful of experts. 

Solution: ANY.RUN’s intuitive interface and interactive analysis experience make it a powerful learning environment even for less experienced team members. 

New analysts work directly with real threats in a controlled, visual sandbox environment. Features like Script Tracer and AI Summary break down even complex threats into clear, understandable steps. 

View analysis session here 

In one case, a junior analyst explored a sample involving malicious scripting. By opening the Script Tracer, they followed each function call and saw how the attack unfolded line by line. No guesswork. No external tools. 

And with the AI Summary, they quickly reviewed the session’s key events, including dropped files, command-line activity, and network behavior, all explained in plain terms. 

What the sandbox offered for junior specialists: 

• Hands-on practice with real malware builds confidence and accelerates learning 

• Step-by-step script analysis simplifies complex attacks into teachable moments 

• Automated summaries make onboarding easier and less resource-intensive 

4. Addressing Infrastructure Maintenance 

Challenge: Maintaining local infrastructure for malware analysis can be a huge drain on time, budget, and IT resources. From server upkeep to licensing and hardware limitations, scaling your operations becomes a logistical challenge, especially across global or hybrid teams. 

Solution: ANY.RUN eliminates that overhead with a fully cloud-based sandbox platform. There’s no setup, no hardware dependency, and no waiting around for installations or updates. Everything runs in the browser. 

Your team can launch pre-configured virtual machines (Windows, Linux, or Android) in seconds, whether they’re in the office or halfway across the world. There’s no cap on the number of analyses, and you can scale instantly by adding users without touching infrastructure. 

In fact, one of our enterprise clients, Expertware, reduced their IOC extraction and investigation turnaround time by over 50% after switching to ANY.RUN, all without deploying a single server. 

Read interview details here: How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis 

Key benefits of the sandbox: 

• Zero setup required: Fully browser-based, ready to go from day one 

• Unlimited analysis: No hardware limits, no bottlenecks 

• Pre-configured VMs: Supports cross-platform investigations (Windows, Linux, Android) 

5. Improving Team Coordination 

Challenge: Even the best tools fall short when teams can’t work together efficiently. In many SOCs, communication gaps between analysts, team leads, and managers lead to duplicated work, missed alerts, and delays in decision-making. 

Solution: ANY.RUN’s built-in Teamwork Mode is designed to make collaboration effortless no matter if your team works in the same office or across time zones. You can create different teams, assign roles, manage access, and track progress, all from a single interface. 

You also get full control over privacy settings. Make all submissions private by default or customize access levels for each user based on their role. That means sensitive data stays protected without compromising collaboration. 

Learn more about the Teamwork Mode here: ANY.RUN Teamwork Mode Updates 

6. Freeing up Analysts for More Important Tasks

Challenge: Manual analysis takes time, and relying on human input for every alert doesn’t scale. But the alternative, fully automated tools, often miss threats that require user interaction to activate, like phishing pages behind CAPTCHAs or payloads inside password-protected files. 

Solution: ANY.RUN bridges that gap with Automated Interactivity, a unique feature that emulates real user behavior inside the sandbox. It clicks, types, solves CAPTCHAs, and opens files, just like a real analyst would, ensuring full detonation of the threat and speeds up investigations. 

That means even in automated mode, your team doesn’t miss threats that rely on tricking the user into doing something first. 

View automated interactivity session here 

In this session, the sandbox was given a phishing URL. It required a CAPTCHA check to reach the final malicious page; something most tools would skip. But with Automated Interactivity, ANY.RUN solved the CAPTCHA, reached the phishing content, and flagged the threat immediately. 

7. Gaining Better Visibility into Emerging Threats 

Challenge: One of the biggest challenges for SOCs today is staying ahead of threats. When you don’t have enough intel, or worse, outdated intel, you’re forced to react instead of prepare. That slows down your defenses and increases your exposure. 

Solution: ANY.RUN’s Threat Intelligence Lookup (TI Lookup) gives your team access to a constantly updated database of real-world Indicators of Compromise (IOCs), Action (IOAs), and Behavior (IOBs), collected from hundreds of thousands of sandbox analyses performed by SOC teams across 15,000 businesses. 

With over 40 filterable parameters, your team can create advanced queries to uncover patterns, spot repeat offenders, and enrich investigations with up-to-date threat data. 

Let’s have a look at the following TI Lookup query:  

threatName:”telegram” AND (threatName:”phishing” OR threatName:”possible-phishing”) AND (domainName:”*.glitch.me”) 

This query helps to collect intel on phishing threats that host malicious pages on the glitch.me domain and use Telegram for exfiltration. 

After hitting enter and see fresh threat samples and indicators that match our request. This includes IPs, URLs, domains, and links to sandbox analyses of actual phishing attacks. 

That’s how in seconds we gained over a hundred new indicators that can enrich our defense infrastructure.  

By having just one or two artifacts, you can quickly connect them to the threats, attacks, and campaigns behind them.  

Our database is constantly updated with unique indicators because the data comes from the latest sandbox analyses globally. 

As a result, your team gains: 

• Fast, flexible search to find IOCs by threat name, behavior, domain, file type, and more 

• Fresh, actionable data sourced from real sandbox detonations globally 

• Subscription-based monitoring to stay informed on new threats matching saved queries 

ANY.RUN’s TI Lookup turns passive intel into an active advantage, giving your team the context they need to protect your business from evolving threats. 

8. Expanding Threat Monitoring and Detection Capabilities 

Challenge: Many detection systems rely on outdated or generic threat feeds. The result is missed attacks, wasted time chasing false positives, and a growing gap between what your team sees and what attackers are actually doing in the wild. 

Solution: ANY.RUN’s Threat Intelligence Feeds (TI Feeds) deliver fresh, high-confidence IOCs straight from live sandbox investigations submitted by over 15,000 companies around the world. These feeds include metadata-rich indicators linked to real execution behavior and attack chains. 

Test and integrate TI Feeds from ANY.RUN  

The feeds are available in widely supported formats (STIX, MISP) and integrate via the TAXII protocol, making it easy to plug directly into your SIEM, SOAR, or XDR platform. 

What your team gains: 

• Enriched detection systems supplemented with data from active malware campaigns 

• Unique indicators for identifying emerging malware pulled from memory dumps, Suricata alerts, and internal categorization 

• Context-aware intel with IOCs tied to sandbox sessions, giving full visibility into how the threat behaves, which is essential for timely and effective incident response 

Solve Your SOC Challenges with ANY.RUN 

Security teams today are under constant pressure to detect more, react faster, and do it all with limited resources. ANY.RUN is built to help modern SOCs meet those demands with speed, precision, and clarity. 

ANY.RUN helps your team reduce effort, increase impact, and stay ahead of evolving threats with the tools they actually need. 

Ready to see the difference for yourself? 

Start your ANY.RUN trial to see how our services can contribute to your security→ 

About ANY.RUN 

ANY.RUN supports over 15,000 organizations across industries such as banking, manufacturing, telecommunications, healthcare, retail, and technology, helping them build stronger and more resilient cybersecurity operations.  

With our cloud-based Interactive Sandbox, security teams can safely analyze and understand threats targeting Windows, Linux, and Android environments in less than 40 seconds and without the need for complex on-premise systems. Combined with TI Lookup, YARA Search, and Feeds, we equip businesses to speed up investigations, reduce security risks, and improve team’s efficiency. 

The post How SOC Teams Save Time and Effort with ANY.RUN: Action Plan  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Welcome to this week’s edition of the Threat Source newsletter. 

I’ve discovered that being a rent guarantor for someone is an involved experience. While I’m glad that I can help out a loved one secure a better rental property, the process of verifying my identity and ability to cover any missed payments required handing over far more personal and financial data than I was comfortable with. 

I asked the agent about their information security policies and cybersecurity posture. I was relieved to hear that they delete all the personal data within two weeks of processing, but I was concerned that the person dealing with my dossier didn’t think that they were at risk of a cyber attack. They believed that because they had a low online profile and their organisation was small, they didn’t present as a target. 

Not wanting to jeopardise my position as a guarantor, I didn’t argue further beyond offering a few words of advice. The truth is that everyone is a target. Many criminals do not discriminate; they seek to compromise anyone and see how they can make money from a compromise once access is achieved. Sophisticated criminals research their targets and their wider ecosystem of suppliers and partners in depth to identify potential weak points. It only takes a moment’s inattention for anyone to fall for a phishing or social engineering scam. 

Cybersecurity training needs to reinforce the fact that anyone can be a victim of a cyber attack. No matter how careful you might be, how insignificant you think that you might be, an attack can still catch you off guard. The good news is that by ensuring basic cyber hygiene, we can make a lot of progress towards preventing harm. 

Impressing on users the need to install updates promptly, the importance of having end-point protection and using multi-factor authentication is not a panacea, but it is a basic foundation upon which more advanced protection can be built. 

Good cybersecurity begins with an awareness of the threat, an acknowledgement that we are all at risk, and knowing the potential consequences. Nobody is too insignificant, too small or too well hidden to escape the risk of cyber attack. Suitable protection follows from reflecting on what is at risk and what could possibly go wrong.

The one big thing 

Talos has uncovered a destructive attack on Ukrainian critical infrastructure involving a new wiper malware, “PathWiper,” deployed through a legitimate endpoint administration framework. Talos attributes this attack to a Russia-linked APT actor, underscoring the persistent threat to Ukraine’s infrastructure amid the ongoing war. 

Why do I care? 

This attack highlights the sophisticated tactics of state-sponsored threat actors and the risks critical infrastructure entities face, which could have global implications for cybersecurity and geopolitical stability. 

So now what? 

Organizations, particularly those managing critical infrastructure, should strengthen their endpoint security, monitor for unusual administrative activity, and stay informed on evolving threats to mitigate potential risks.

Top security headlines of the week

New Chrome Zero-Day Actively Exploited; Google Issues Emergency Out-of-Band Patch 
The high-severity flaw is being tracked as CVE-2025-5419 (CVSS score: 8.8), and has been flagged as an out-of-bounds read and write vulnerability in the V8 JavaScript and WebAssembly engine. (The Hacker News) 

Vanta bug exposed customers’ data to other customers 
Compliance company Vanta has confirmed that a bug exposed the private data of some of its customers to other Vanta customers. The company told TechCrunch that the data exposure was a result of a product code change and not caused by an intrusion. (TechCrunch) 

Data Breach Affects 38K UChicago Medicine Patients 
UChicago Medicine released a statement that the data of 38K patients may have been exposed by a third-party debt collector’s system breach. The exposed data may include SSNs, addresses, dates of birth, medical information, and financial account information. (UPI)

Can’t get enough Talos? 

Fake AI installers target businesses. Catch up on the ransomware and malware threats Talos discovered circulating in the wild and masquerading as legit AI tool installers. Read the blog or listen to our most recent Talos Takes to hear Hazel and Chetan, the author, discuss the blog more in-depth.

Talos at Cisco Live 2025. From sessions featuring a live IR tabletop session to learning how to outsmart identity attacks, there’s plenty of Talos to keep you going in San Diego next week. Browse sessions Talos is participating in, and we’ll see you there!

Upcoming events where you can find Talos 

• Cisco Live U.S. (June 8 – 12) San Diego, CA 
• REcon (June 27 – 29) Montreal, Canada 
• NIRMA (July 28 – 30) St. Augustine, FL 
• Black Hat USA (Aug. 2–  7) Las Vegas, NV

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91   
MD5: 7bdbd180c081fa63ca94f9c22c457376   
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details  
Typical Filename: IMG001.exe  
Detection Name: Simple_Custom_Detection 

SHA 256: 
9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
Typical Filename: VID001.exe 
Detection Name: Simple_Custom_Detection 

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 
MD5: 8c69830a50fb85d8a794fa46643493b2  
Typical Filename: AAct.exe  
Claimed Product: N/A  
Detection Name: PUA.Win.Dropper.Generic::1201 

Cisco Talos Blog – ​Read More

• Cisco Talos observed a destructive attack on a critical infrastructure entity within Ukraine, using a previously unknown wiper we are calling “PathWiper”. 
• The attack was instrumented via a legitimate endpoint administration framework, indicating that the attackers likely had access to the administrative console, that was then used to issue malicious commands and deploy PathWiper across connected endpoints. 
• Talos attributes this disruptive attack and the associated wiper to a Russia-nexus advanced persistent threat (APT) actor. Our assessment is made with high confidence based on tactics, techniques and procedures (TTPs) and wiper capabilities overlapping with destructive malware previously seen targeting Ukrainian entities.  
• The continued evolution of wiper malware variants highlights the ongoing threat to Ukrainian critical infrastructure despite the longevity of the Russia-Ukraine war. 

---

Proliferation of PathWiper 

Any commands issued by the administrative tool’s console were received by its client running on the endpoints. The client then executed the command as a batch (BAT) file, with the command line partially resembling that of Impacket command executions, though such commands do not necessarily indicate the presence of Impacket in an environment.

The BAT file consisted of a command to execute a malicious VBScript file called ‘uacinstall.vbs’, also pushed to the endpoint by the administrative console: 

C:WINDOWSSystem32WScript.exe C:WINDOWSTEMPuacinstall.vbs

Upon execution, the VBScript wrote the PathWiper executable, named ‘sha256sum.exe’, to disk and executed it: 

C:WINDOWSTEMPsha256sum.exe 

Throughout the course of the attack, filenames and actions used were intended to mimic those deployed by the administrative utility’s console, indicating that the attackers had prior knowledge of the console and possibly its functionality within the victim enterprise’s environment.

PathWiper capabilities 

On execution, PathWiper replaces the contents of artifacts related to the file system with random data generated on the fly. It first gathers a list of connected storage media on the endpoint, including: 

• Physical drive names 
• Volume names and paths 
• Network shared and unshared (removed) drive paths 

Although most storage devices and volumes are discovered programmatically (via APIs), the wiper also queries ‘HKEY_USERSNetwork<drive_letter>| RemovePath’ to obtain the path of shared network drives for destruction. 

Once all the storage media information has been collected, PathWiper creates one thread per drive and volume for every path recorded and overwrites artifacts with randomly generated bytes. The wiper reads multiple file systems attributes, such as the following from New Technology File System (NTFS). PathWiper then overwrites the contents/data related to these artifacts directly on disk with random data: 

• MBR 
• $MFT 
• $MFTMirr 
• $LogFile 
• $Boot 
• $Bitmap 
• $TxfLog 
• $Tops 
• $AttrDef 

Before overwriting the contents of the artifacts, the wiper also attempts to dismount volumes using the ‘FSCTL_DISMOUNT_VOLUME IOCTL’ to the MountPointManager device object. PathWiper also destroys files on disk by overwriting them with randomized bytes. 

PathWiper’s mechanisms are somewhat semantically similar to another wiper family, HermeticWiper, previously seen targeting Ukrainian entities in 2022. HermeticWiper, also known as FoxBlade or NEARMISS, is attributed to Russia’s Sandworm group in third-party reporting with medium to high confidence. Both wipers attempt to corrupt the master boot record (MBR) and NTFS-related artifacts.  

 A significant difference between HermeticWiper and PathWiper is the corruption mechanisms used against recorded drives and volumes. PathWiper programmatically identifies all connected (including dismounted) drives and volumes on the system, identifies volume labels for verification and documents valid records. This differs from HermeticWiper’s simple process of enumerating physical drives from 0 to 100 and attempting to corrupt them. 

Coverage 

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. 

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. 

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. 

Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device. 

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. 

Cisco Secure Access is a modern cloud-delivered Security Service Edge (SSE) built on Zero Trust principles.  Secure Access provides seamless transparent and secure access to the internet, cloud services or private application no matter where your users work.  Please contact your Cisco account representative or authorized partner if you are interested in a free trial of Cisco Secure Access. 

Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.  

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.  

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center. 

Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.  

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. 

Snort 2 rules: 64742, 64743 

Snort 3 rules: 301174

Indicators of compromise (IOCs) 

7C792A2B005B240D30A6E22EF98B991744856F9AB55C74DF220F32FE0D00B6B3

Cisco Talos Blog – ​Read More

We’ve packed May with updates to make your experience smoother and your threat detection even sharper. Whether you’re just getting started or knee-deep in malware every day, these changes are here to save you time and give you better insights. 

In this update: 

• A brand-new onboarding tutorial in the sandbox to guide you step by step 

• TAXII support for TI Feeds, so you can plug threat intel right into your tools 

• A big boost in threat coverage, with new signatures, YARA rules, and standout samples 

Take a look below to see how these updates can help you work faster, stay ahead of threats, and get more out of ANY.RUN! 

Product Updates 

New Sandbox Onboarding Tutorial 

Whether you’re brand new to ANY.RUN or just want a quick refresher, the new onboarding tutorial in the sandbox has you covered. It walks you through each step of the analysis process, from uploading a sample to making sense of the process tree, network activity, and IOCs. 

It’s a great starting point for new analysts or anyone looking to get more comfortable with the platform. 

You can find it in the FAQ section under the Tutorials tab; just click on Quick Sandbox Tutorial and you’re good to go. 

TAXII Protocol Now Supported for TI Feeds 

TAXII (Trusted Automated eXchange of Indicator Information) is a widely used protocol for sharing threat intelligence in a fast, secure, and standardized way. It’s designed to make integrating threat data with your existing tools, like SIEMs, EDRs, or TIPs, smooth and efficient. 

Now, ANY.RUN’s Threat Intelligence Feeds fully support TAXII, making it even easier to bring high-quality threat data directly into your security stack. 

Here’s what you get with ANY.RUN’s TI Feeds + TAXII integration: 

• Actionable, real-world threat indicators: The feeds pull data from threats seen across 15,000+ companies worldwide. You’ll get fresh, high-confidence IOCs sourced from dynamic malware analysis and enriched with context from ANY.RUN’s sandbox.  

• Minimal false positives: Every indicator is pre-processed and vetted before it reaches your system, so you get clean, reliable data that won’t overload your analysts or flood your alerts.  

• Boosted detection and response automation: Use TI Feeds to automatically block malicious IPs, flag risky logs, enrich alerts, or trigger playbooks, saving your team time and cutting response delays. 

How It Works 

If you’re on a paid plan, you can now set up ANY.RUN’s TI Feeds as a TAXII endpoint in your existing system, whether it’s a SIEM, EDR/XDR, NGFW, or TIP platform. 

Once connected to our TAXII server, your tools will start receiving fresh threat intel automatically. Want to see what the feeds look like? You can preview a sample in STIX or MISP format. 

For full access to the latest indicators, reach out to us for 14-day trial of TI Feeds. 

Threat Coverage Updates 

In May, we expanded our detection coverage across Windows, Linux, and Android environments with 900+ new behavior signatures, YARA rules, Suricata rules, and attribution-based detections. These updates help defenders spot emerging malware families and reduce analysis time with better context and accuracy. 

New Behavior Signatures 

162 new behavior-based signatures were added to improve detection across commodity malware, ransomware, loaders, and remote tools. 

Highlighted additions include: 

• BPFDoor – A stealthy Linux backdoor that receives TCP/UDP/ICMP packets directly via BPF filters. Linked to the Red Menshen group, this malware hides without opening network ports and persists on servers for months. 

• Sakura RAT – A rare APT-26 (Deep Panda) tool used in major data breaches. It hides C2 traffic in normal HTTP requests and uses stolen certificates to avoid detection. 

• RoamingMOUSE – An Excel dropper used by MirrorFace (APT10) to side-load the Anel backdoor. Targets Japanese and Taiwanese government entities. 

• FinalDraft – A cross-platform backdoor that uses Microsoft Graph API and Outlook drafts as C2 channels. It can proxy traffic and inject malicious code. 

• PayDay Loader – Delivered via fake VPN/AI websites, this tool silently downloads stealers like Lumma and Poseidon across Windows, macOS, and Android. 

• TerraStealer v2 – A stealer from the Golden Chickens toolkit. It grabs browser credentials and crypto wallets and exfiltrates data via Telegram or cloud services. Often paired with TerraLogger. 

Other behavior-based detections added for the following threats: 

New Tool and Utility Detections 

We also added detections for commonly abused remote access tools and packers: 

YARA Rule Updates 

In May, we released 19 new and updated YARA rules to strengthen static detection and improve malware classification during analysis. These rules help identify emerging threats, improve attribution, and support faster triage, especially when working with evasive samples or reviewing files pre-execution. 

Here are the latest additions: 

• Packit Stealer – Rule added to detect this custom packer-based stealer known for targeting credentials and crypto assets. 

• Lobshot – Detection rule to catch a Windows-based stealer that uses legitimate processes for stealth. 

• GoFing – Rule added for this lesser-known info-stealer that focuses on browser and session data. 

• Anel Backdoor – Part of the RoamingMOUSE dropper chain; used in targeted attacks. 

• Teapot Stealer – New rule to detect this Python-based stealer active in commodity malware campaigns. 

• Ralord Ransomware – Detection rule for this rapidly spreading ransomware targeting personal files and enterprise systems. 

We also added YARA rules tied to the following threats: 

Suricata Rule Updates 

To improve detection of network-based threats, we added 756 new Suricata rules in May. These updates expand visibility into malicious domains, phishing infrastructure, and command-and-control traffic seen across live malware samples. 

Some highlights include new detections for infrastructure observed in: 

• WikiKit Campaign – Detects domain chains used in phishing and payload delivery. 

• EvilProxy Campaign – Tracks malicious proxies abusing login flows and multi-factor authentication bypasses. 

These rules are automatically applied during analysis and contribute to network-layer IOCs in your reports, making it easier to detect lateral movement, data exfiltration, and malware beaconing early in the infection chain. 

About ANY.RUN 

ANY.RUN supports over 15,000 organizations across industries such as banking, manufacturing, telecommunications, healthcare, retail, and technology, helping them build stronger and more resilient cybersecurity operations.  

With our cloud-based Interactive Sandbox, security teams can safely analyze and understand threats targeting Windows, Linux, and Android environments in less than 40 seconds and without the need for complex on-premise systems. Combined with TI Lookup, YARA Search, and Feeds, we equip businesses to speed up investigations, reduce security risks, and improve team’s efficiency. 

The post Release Notes: TAXII Support for TI Feeds, New Sandbox Onboarding, and 900+ Detection Rules  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Given that just under half of all websites in the world are powered by the WordPress content management system, it’s no wonder cybercriminals are constantly looking for loopholes to exploit it. This past March, cybersecurity researchers at the hosting company GoDaddy described a campaign that began in 2016 and has since compromised more than 20 000 WordPress websites worldwide.

The campaign has been dubbed “DollyWay World Domination” after a line of code (define (‘DOLLY_WAY’, ‘World Domination’)) found in the malware used in this campaign. As part of DollyWay, threat actors inject malicious scripts with various capabilities onto websites. Their main goal is to redirect users from legitimate websites to third-party pages. As of February 2025, experts had recorded over 10 000 infected WordPress websites worldwide.

To compromise websites, malicious actors exploit vulnerabilities in WordPress plugins and themes. They start by injecting a harmless-looking script that raises no red flags with security systems performing static HTML code analysis. The script operates as a stealthy infiltrator — quietly downloading more dangerous code used for profiling victims, communicating with command-and-control servers, and ultimately redirecting visitors to infected sites. You can read the original research paper for a detailed description of how these scripts work.

Monetizing the malicious campaign

Redirect-links generated by DollyWay include an affiliate identifier — much like referral programs that bloggers often use to promote products or services. These identifiers allow websites to track where users are coming from. Bloggers typically earn a commission on purchases made by visitors who arrive through referral links. The DollyWay World Domination Campaign is monetized in much the same way, using the VexTrio and LosPollos affiliate programs.

VexTrio has been called the “Uber of cybercrime”. Reportedly active since at least 2017, this service primarily acts as a broker for scam content, spyware, malware, pornography, and so on. It’s VexTrio that redirects the traffic from DollyWay to scam sites. As noted above, the malware profiles its victims. Based on these profiles, users are then funneled to various types of websites, such as fake dating sites, crypto scams, or gambling pages.

LosPollos apparently specializes in selling traffic to legitimate services. Whenever DollyWay redirects traffic to a site promoted by LosPollos, the redirects always include the same LosPollos affiliate account identifier. DollyWay’s partnership with LosPollos explains why, in some cases, redirects from infected sites lead users not to malicious pages, but to legitimate app listings on Google Play such as Tinder or TikTok.

How DollyWay conceals itself on websites it has infected

Cybercriminals exercise great care to keep their malware from being detected and removed. For starters, the malicious code is injected into every active plugin. Removing it is no walk in the park, as DollyWay employs an advanced re-infection mechanism that triggers every time a page on the compromised site is accessed. If the malicious code isn’t removed from all active plugins and snippets, loading any page on the site will result in re-infection.

Detecting DollyWay may prove no simple task either — the malware is adept at hiding its presence on an infected site. To maintain access to the compromised site, the attackers create their own account with admin privileges, and DollyWay hides this account from the WordPress dashboard.

In case their accounts are discovered, the attackers also hijack the credentials of legitimate administrators. To do this, DollyWay monitors everything entered into the site’s admin login form and saves the data to a hidden file.

The attackers also take steps to ensure their assets remain operational. Researchers found evidence of a script apparently used by the attackers to maintain infected sites. Specifically, it can update WordPress, install and update required components, and initiate the injection of malicious code.

Experts also discovered a web shell that the attackers use, among other things, to update compromised sites and keep away rival malware. This goes to show that the attackers are keen to prevent other malware from hijacking traffic or setting off any security alarms that might alert the site owner.

The experts believe that the maintenance script and web shell aren’t deployed on every site infected by DollyWay. Maintaining such infrastructure across all 10 000 sites would be prohibitively resource-intensive. Chances are, the attackers only deploy these scripts on their most valuable assets.

Protecting your corporate website

The sheer scale and longevity of the DollyWay World Domination campaign once again underscore the need for regular security audits of company websites. When it comes to WordPress sites, plugins and themes deserve particular attention — they’ve repeatedly proven to be the most vulnerable parts of the platform’s infrastructure.

If you suspect your company’s website has fallen victim to DollyWay, researchers recommend keeping a close eye on file creation and deletion events. Such activity can be an indicator of compromise, as some versions of DollyWay v3 perform file operations every time a page is loaded.

Here is what you need to do if you come across signs of compromise.

• Temporarily take the affected site offline, redirecting all traffic to a static page. Or, at the very least, deactivate all plugins while you’re removing the malware.
• Remove any suspicious plugins — but keep in mind that DollyWay knows how to hide them from the WordPress dashboard.
• Delete any unrecognized administrator accounts — again, be aware that DollyWay can hide these too.
• Change the passwords for all WordPress users, starting with anyone who has admin privileges.
• Enable two-factor authentication for WordPress sign-in.
• If the internal infosec team’s resources are insufficient, seek help from third-party incident response specialists.

Kaspersky official blog – ​Read More