Welcome to another episode of Humans of Talos! This week, Amy sits down with William (Bill) Largent from the Strategic Planning and Communications team. Bill’s role as Senior Security Researcher spans from threat research to communicating Talos’s critical work to internal teams, partners, and customers.
Join us as Bill shares what drew him to Talos, how his love of reading has shaped his cybersecurity ethos, and the key insights he shares for the next generation of cybersecurity professionals.
Amy Ciminnisi: Bill, it’s great to have you on. You’re part of my team in Strategic Planning and Communications. Can you tell us a little bit about what you do here at Talos?
Bill Largent: Generally speaking, most of my time is still spent on threat research and hunting. About 25 to 30% of the time, they have me talk to people. They let me out of the cage for a little while and put me in front of people. I get to talk to internal Cisco teams and to a lot of partners, which is really interesting. I discuss the state of things, help them understand what’s going on in the threat landscape, and explain what Talos is and how we do things. I also get to talk to customers, which is really fun. My background is in vendor-agnostic remote managed services, so I ran SOCs for years. Talking to people who are doing that now is really refreshing.
AC: You’ve been at Cisco for a while. What made you want to join Talos, and how did that career transition go for you?
BL: It’s really interesting. I’ve been here a long time. If you look me up in the directory, you’ll see my photo is about 24 years old. It was taken on a Saturday or Sunday night at 2 or 3 a.m. because I was working overnight shifts, so it looks exactly like you’d imagine. Getting to Talos was about seeking out smarter people. I believe if you’re the smartest person in the room, you’re in the wrong room, so I started tracking where the smarter people were and went there.
As a member of Talos, there’s never a smarter room than the Talos room. It’s insane, and I mean that for any topic you can think of — chaos theory, mathematics, planetary science, beer making… You name it, someone in Talos is an expert. It’s honestly great. That’s how I came to Talos: trying to find the smartest people in the room.
AC: Is working with people and especially people on Talos your favorite thing about your role, or are there other aspects you love?
BL: For me, the people are a massive differentiator from working anywhere else. I feel super supported and engaged all the time. Beyond the people, what’s interesting about cybersecurity is that it evolves so fast and changes so much that you’re never in a state of stasis. There’s always something new to learn, and even though it’s all cyclical and some things come back around, there’s a lot of difference day to day. It keeps my brain occupied. I also have the support of people who encourage me to go learn things that interest me.
Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.
Some attacks smash the door open. LOLBins just borrow your keys and walk right in.
They’re tricky because tools everyone trusts suddenly start doing things that don’t match their usual job; loading odd-looking modules, decoding files that shouldn’t need decoding, or quietly handing work off to hidden PowerShell scripts. At first glance it all feels normal, but a closer look shows a payload slowly being set up in the background.
For analysts, the real challenge is noticing that shift before it grows into a full incident.
Let’s take a closer look at what’s hiding behind LOLBin attacks, and how advanced SOC teams uncover them in minutes without much effort.
What Are LOLBin Attacks?
LOLBin attacks occur when threat actors repurpose legitimate Windows system binaries (rundll32, certutil, mshta, powershell, regsvr32, etc.) to carry out malicious actions. These tools are built into every system, signed by Microsoft, and widely used by normal applications, which is why attackers rely on them.
Using LOLBins, adversaries can:
Load disguised or renamed DLLs
Decode or unpack payloads using built-in utilities
Trigger PowerShell or script execution indirectly
Execute code completely in memory
Blend malicious steps into routine system activity
This approach lets attackers avoid dropping obvious malware and makes early-stage execution appear clean and legitimate.
Why LOLBin Attacks Are a Real Risk for Businesses?
ANY.RUN’s Interactive Sandbox provides tangible results across every SOC tier
The real problem isn’t the binaries themselves but how much visibility your SOC loses when attackers hide behind them. When malicious activity runs inside trusted system tools, the early signs of an intrusion become dramatically harder to catch.
Here’s what makes them dangerous:
Normal on the surface: Activity is routed through tools the environment already trusts.
Minimal forensic evidence: In-memory execution leaves few files to investigate.
Extended dwell time: Attackers gain more space for lateral movement and credential access.
Harder investigations: Clean-looking events force analysts to dig deeper to find the real issue.
Higher SOC workload: The team must identify subtle behavior shifts instead of relying on clear indicators.
This means attackers can establish footholds, unpack payloads, or run loaders while the environment still appears clean, leading to late detection and higher incident impact.
The Fastest Way to Reveal LOLBin Abuse: How ANY.RUN Makes It Obvious
LOLBin attacks only work when no one can see what’s really happening behind those trusted Windows binaries. ANY.RUN removes that advantage by showing analysts the full behavior in real time; not just the file name or the process label, but the actual actions taking place underneath.
With ANY.RUN’s sandbox, “normal-looking” activity turns into something you can spot immediately:
Process behavior becomes clear at a glance: rundll32 loading a strange module, certutil decoding an unexpected file, mshta spawning hidden PowerShell… every unusual step is visible right away.
Parent–child chains tell the full story: Instead of digging through logs, you see exactly who launched what, and whether it fits normal usage patterns.
Command lines show the truth: Encoded strings, odd export calls, Temp-folder payloads, and hidden flags are exposed instantly.
In-memory actions are no longer invisible: Even when attackers avoid dropping files, the sandbox reveals decoded scripts, loader behavior, and execution flow.
Artifacts stay captured: Renamed DLLs, extracted archives, decrypted payloads, and cleanup attempts can all be reviewed without rushing or digging.
Analysis becomes interactive: Analysts can click deeper, replay events, and confirm suspicions in minutes instead of piecing everything together manually.
Instead of guessing whether a trusted binary is being misused, ANY.RUN shows the exact behavior clearly, quickly, and with the context you need to act confidently.
Real-Time LOLBin Attacks Revealed Inside ANY.RUN in Minutes
Here are a few real LOLBin attacks captured and analyzed inside ANY.RUN. Take a look at how these techniques unfold in real time, and see how easily your team can expose the same behavior using interactive analysis.
1. LOLBin RUNDLL32.EXE
ATT&CK® Technique: T1218.011 – Rundll32
What this attack is: A trusted Windows utility used to load and run a disguised module, letting attackers execute their payload under a legitimate process.
rundll32.exe runs the hidden module and shows clear malicious actions
Gh0st RAT launches the legitimate rundll32.exe, which then loads a disguised module named grgfrqe.rfg from an unusual directory. The file isn’t a typical DLL at first glance; the strange extension is intentionally chosen to bypass simple “.dll” rules and blend into the system.
Expose hidden threats with ANY.RUN’s Sandbox
Detect evasive malware and phishing in under 60 seconds
Once loaded, rundll32 calls an export named RAFlush and passes it a path to a temporary executable: C:UsersadminAppDataLocalTemphkjhn.exe.
From there, the chain unfolds:
Load: rundll32 loads the renamed DLL (grgfrqe.rfg)
Invoke: The RAFlush export is executed
Drop/execute: The module drops, unpacks, or runs hkjhn.exe inside %Temp%
Cleanup: Temporary files are removed to reduce traces
This is a typical LOLBin pattern: a trusted binary quietly executing hidden functionality while the malicious module stays disguised and difficult to catch without behavioral visibility.
ATT&CK® Technique: T1140 – Deobfuscate/Decode Files or Information
What this attack is: A built-in Windows tool misused to decode, transform, or prepare hidden payloads before execution; all under the guise of a legitimate system operation.
A JPG-named WinRAR binary extracts a protected archive and drops new components
PXAStealer uses certutil.exe to quietly decode a disguised file named DA 성형외과재무 보고서.pdf. Although it appears to be a harmless PDF, certutil converts it into Invoice.pdf, which is not a document at all but a RAR archive.
The attack continues as a renamed instance of WinRAR, disguised as a JPEG image (부가가치세 영수증.jpg), unpacks the archive using the password iJbcsRBR84uUl9USIhj09PH0elalyHPJ.
The execution flow looks like this:
Decode: certutil transforms the fake PDF into an archive
Extract: The disguised WinRAR instance unpacks it
Execute: The payload inside the archive is launched
Cleanup: Files are removed or hidden to minimize traces
This combination, a trusted decoding tool + disguised content + hidden extraction, is a classic LOLBin chain designed to slip past basic detection and appear routine unless investigated behaviorally.
Check out more sessions of this attack and gather related IOCs using this TI query:
Several sandbox sessions highlight certutil -decode as a common step in malware chains
3. LOLBin MSHTA.EXE
ATT&CK® Technique: T1218.005 – Mshta
What this attack is: A trusted Windows utility used to execute HTA-based scripts that trigger hidden PowerShell activity, enabling in-memory execution without leaving clear artifacts.
mshta.exe runs gg.hta, which triggers hidden PowerShell execution; a clear sign of an HTA-based loader
In this attack chain, mshta.exe launches an HTA file named gg.hta from the user’s desktop. The HTA isn’t a simple script; it contains obfuscated logic that immediately spawns a PowerShell process configured to stay out of sight.
PowerShell is executed with:
-NoProfile
-WindowStyle Hidden
A Base64-encoded command decoded and passed into Invoke-Expression
This allows the payload to run entirely in memory, without dropping a traditional file on disk.
Here’s how the chain unfolds:
Deliver: The HTA file is delivered locally or through a link
Execute: mshta runs the HTA script as a trusted system tool
Decode & run: PowerShell decodes the Base64 string and executes the logic
Stealth: Hidden windows and in-memory execution conceal most traces
This mshta + encoded PowerShell combination is a well-known method for quietly loading backdoors, RATs, and script-based loaders while appearing to use legitimate system components.
Check out more sessions of similar attacks and gather relevant data using this TI query:
For SOC managers, stopping LOLBin abuse starts with improving how the team spots unusual behavior inside trusted system tools. These attacks don’t announce themselves, so the goal is to create clearer visibility and reduce the time analysts spend guessing what’s happening.
Focus on behavior, not the binary: Even legitimate tools like rundll32, certutil, and mshta become suspicious when they load odd modules, decode files, or trigger hidden PowerShell. Building detections around these behaviors helps the team surface threats that signatures often miss.
Give analysts a simple triage path: Most LOLBin alerts look harmless at first. A lightweight checklist, parent process, command line, execution path, and any decoding or script activity, keeps investigations consistent and prevents early-stage activity from slipping by.
Use sandbox analysis to confirm suspicious cases quickly: Instead of piecing clues together from logs, ANY.RUN gives analysts the full picture in seconds: process chains, decoded content, dropped components, and in-memory activity. This cuts investigation time and helps the team act confidently.
Add small policy controls where possible: Limiting execution from user-controlled folders or applying basic PowerShell restrictions reduces the surface attackers can exploit without disrupting normal operations.
A few focused improvements like these help SOC managers turn LOLBin activity from a hidden risk into something the team can catch early and handle efficiently.
Today, 15,000+ organizations worldwide use ANY.RUN to speed up investigations, strengthen detection pipelines, and give their teams a clearer view of what’s really happening on their endpoints.
SOC teams using ANY.RUN report measurable improvements, including:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-19 09:06:392025-11-19 09:06:39LOLBin Attacks Explained with Examples: Everything SOC Teams Need to Know
Malicious browser extensions remain a significant blind spot for many organizations’ cybersecurity teams. They’ve become a permanent fixture in the cybercriminal arsenal, used for session and account theft, espionage, masking other criminal activity, ad fraud, and cryptocurrency theft. High-profile incidents involving malicious extensions are frequent — ranging from the compromise of the Cyberhaven security extension to the mass publication of infostealer extensions.
Extensions are appealing to attackers because they’re granted permissions and wide-ranging access to information within SaaS applications and websites. Because they’re not standalone applications, they often slip past standard security policies and control tools.
A company’s security team must tackle this problem systematically. Managing browser extensions requires a combination of policy management tools and specialized extension-analysis services or utilities. This topic was the focus of Athanasios Giatsos’ talk at the Security Analyst Summit 2025.
Threat capabilities of web extensions and innovations in Manifest V3
A browser’s web extension has broad access to web page information: it can read and modify any data available to the user through the web application, including financial or medical records. Extensions also often gain access to important data typically unseen by users: cookies, local storage, and proxy settings. This greatly simplifies session hijacking. Sometimes, the capabilities of extensions extend far beyond web pages: they can access the user’s location, browser downloads, desktop screen capture, clipboard content, and browser notifications.
In the previously dominant extension architecture, Manifest V2 extensions — which worked across Chrome, Edge, Opera, Vivaldi, Firefox, and Safari — are virtually indistinguishable from full-fledged applications in terms of capabilities. They can continuously run background scripts, keep invisible web pages open, load and execute scripts from external websites, and communicate with arbitrary sites to retrieve or send data. To curb potential abuse — as well as to limit ad blockers — Google transitioned Chromium and Chrome to Manifest V3. This update limited or blocked many extension features. Extensions must now declare all the sites they communicate with, are prohibited from executing dynamically loaded third-party code, and must use short-lived micro-services instead of persistent background scripts. While some types of attacks are now harder to execute due to the new architecture, attackers can easily rewrite their malicious code to retain most necessary functions while sacrificing stealth. Therefore, relying solely on browsers and extensions operating under Manifest V3 within an organization simplifies monitoring, but is not a panacea.
Furthermore, V3 doesn’t address the core problem with extensions: they’re generally downloaded from official application stores using legitimate Google, Microsoft or Mozilla domains. Their activity appears to be initiated by the browser itself, making it extremely difficult to distinguish actions performed by an extension from those manually executed by the user.
How malicious extensions emerge
Drawing from various public incidents, Athanasios Giatsos highlights several scenarios where malicious extensions can rear their ugly heads:
The original developer sells a legitimate and popular extension. The buyer then “enhances” it with malicious code for ad display, espionage, or other nefarious purposes. Examples include The Great Suspender and Page Ruler.
Attackers compromise the developer’s account and publish a trojanized update for an existing extension, as was the case with Cyberhaven.
The extension is designed to be malicious from the beginning. It either masquerades as a helpful utility, such as a fake Save to Google Drive tool, or mimics the names and designs of popular extensions, like the dozens of AdBlock clones available.
A more sophisticated version of this scheme involves initially publishing the extension in a clean state, where it performs a genuinely useful function. Malicious additions are then introduced weeks or even months later, once the extension has gained enough popularity. ChatGPT for Google is one example.
In all these scenarios, the extension is widely available in the Chrome Web Store and sometimes even advertised. However, there’s also a targeted attack scenario where phishing pages or messages prompt victims to install a malicious extension that’s not available to the general public.
Centralized distribution through the Chrome Web Store, combined with automated updates for both the browser and extensions, often results in users unknowingly ending up with a malicious extension without any effort on their part. If an extension already installed on a computer receives a malicious update, it will be installed automatically.
Organizational defenses against malicious extensions
In his talk, Athanasios offered a number of general recommendations:
Adopt a company policy regarding the use of browser extensions.
Prohibit any extensions not explicitly included in a list approved by the cybersecurity and IT departments.
Continuously audit all installed extensions and their versions.
When extensions are updated, track changes in permissions they’re granted, and monitor any changes in the ownership of the extensions or their developer team.
Incorporate information about the risks of, and rules for, using browser extensions into security awareness training programs for all employees.
We add a few practical insights and specific considerations to these recommendations.
Restricted list of extensions and browsers. In addition to applying security policies to the company’s officially approved browser, it’s crucial to prohibit the installation of portable versions and trendy AI browsers like Comet or other unauthorized solutions that allow the same dangerous extensions to be installed. When implementing this step, ensure that local administrator privileges are restricted to the IT staff and other personnel whose job duties strictly require them.
As part of the policy for the company’s main browser, you should disable developer mode and prohibit the installation of extensions from local files. For Chrome, you can manage this via the Admin console. These settings are also available through Windows Group Policies, macOS configuration profiles, or via a JSON policy file on Linux.
Managed updates. Implement version pinning to prevent updates for allowed extensions from being installed company-wide immediately. The IT and cybersecurity teams need to regularly test new versions of approved extensions and pin the updated versions only after they’ve been vetted.
Multi-layered defense. It’s mandatory to install an EDR agent on all corporate devices to prevent users from launching unauthorized browsers, mitigate the risks of visiting malicious phishing sites, and block malware downloads. It’s also necessary to track DNS requests and browser network traffic at the firewall level for real-time detection of communications with suspicious hosts and other anomalies.
Continuous monitoring. Use EDR and SIEM solutions to collect browser state details from employee workstations. This includes the list of extensions in each installed browser, along with the manifest files for version and permission analysis. This allows for the rapid detection of new extensions being installed or the version being updated and granted permission changes.
How to vet browser extensions
To implement the controls discussed above, the company needs an internal database of approved and prohibited extensions. Unfortunately, application stores and the browsers themselves offer no mechanisms to assess risk on an organizational scale, or to automatically populate such a list. Therefore, the cybersecurity team has to create both this process and the list. Employees will also need a formal procedure for submitting requests to add extensions to the approved list.
The assessment of business need and available alternatives is best conducted with a representative from the relevant business unit. However, the risk assessment remains entirely the responsibility of the security team. It’s not necessary to manually download extensions and cross-reference them across different extension stores. This task can be handled by a range of tools, such as open-source utilities, free online services, and commercial platforms.
Services like Spin.AI and Koidex (formerly ExtensionTotal) can be used to gauge the overall risk profile. Both maintain a database of popular extensions, so assessment is typically instant. They use LLMs to generate a brief summary of the extension’s properties, but also provide detailed analysis, including required permissions, the developer’s profile, and the history of versions, ratings, and downloads.
To examine core data on extensions, you can also use Chrome-Stats. While primarily designed for extension developers, this service displays ratings, reviews, and other store data. Crucially, it allows users to directly download the current and several previous versions of an extension, which simplifies incident investigation.
You can employ tools like CRX Viewer for a deeper analysis of suspicious or mission-critical extensions. This tool allows analysts to examine the extension’s internal components, conveniently filtering and displaying the contents with an emphasis on the HTML and JavaScript code.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-18 18:06:342025-11-18 18:06:34How to securely vet browser extensions across your organization
Today, Cisco Talos is introducing new capabilities for Snort3 users within Cisco Secure Firewall. These enhancements are designed to give you greater flexibility in how you manage, organize, and prioritize detection rules. They also make it easier to align SNORT® rules with your organization’s specific security needs.
The new “Severity” rule group
In Snort3, rule groups let you organize and manage detection rules according to specific criteria. Previously, only two top-level groups were available:
Rule Category: groups rules by Snort2 categories such as FILE-OTHER, MALWARE-CNC, etc.
MITRE ATT&CK: groups rules by attacker behaviors and techniques
These groups allow you to set a security level from 0 (all rules disabled) to 4 (all rules enabled).
The new Severity rule group introduces a third way to organize rules — by vulnerability severity, using CVSS scores. Rules are grouped as low, medium, high, or critical, allowing your team to prioritize detection based on the impact and urgency of vulnerabilities, rather than just category or behavior.
This makes it easier to focus attention and resources where they matter most.
Flexible rule group creation based on time range
With the Severity group, you can define how far back in time you want your coverage to extend:
Level
Coverage
Description
0
None
No rules enabled
1
Last 2 years
Focuses on recent, high-impact vulnerabilities
2
Last 5 years
Balanced coverage of recent and mid-term threats
3
Last 10 years
Broad coverage for long-lived environments
4
All
Includes all vulnerabilities detected to date
This approach gives you precise control over rule selection and volume. It helps optimize performance while ensuring your detection policies match your organization’s patching cycles, compliance requirements, and risk profile.
We’re also looking to develop more top-level groupings in the coming quarters. More details will be shared in due course.
What this means for your environment
Configuring Snort3 previously required enabling rules individually or applying a predefined ruleset and then tuning manually. We know this wasn’t the most time-efficient process, so the Snort analyst team worked to simplify it with the new features announced today.
You can now:
Enable rule groups aligned with your own internal policies
Scale configurations across multiple environments without managing individual rules
Adjust detection depth easily by time range or severity level
These capabilities make it simpler to maintain consistent, targeted detection coverage — whether you’re running large, distributed networks or smaller environments with tailored security priorities.
Conclusion
The new Severity rule group and expanded rule group model give Snort3 users more flexibility and control.
By organizing rules based on vulnerability severity and timeframe, you can focus detection where it has the greatest impact, improving both efficiency and accuracy in threat management.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-18 12:06:392025-11-18 12:06:39New in Snort3: Enhanced rule grouping for greater flexibility and control
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-18 11:06:422025-11-18 11:06:42What if your romantic AI chatbot can’t keep a secret?
Scaling as a managed security provider can be a mixed blessing. Growth comes with more revenue, but also with increasingly high demands related to maintaining SLAs, quality, and compliance. For MSSPs in healthcare, this pressure is intensified by regulations like HIPAA and NIS2, along with the striking cost of a single mistake.
This was a challenge one of our clients, a mid-sized MSSP specializing in healthcare, had to face. As it expanded to support over a dozen hospitals, clinics, and labs with 2,000+ endpoints, their resources were thinning.
We spoke with the organization’s SOC lead about how they were able to reshape their workflow with ANY.RUN’s solutions, and what brought them the most results.
Core MSSP Challenges: Overload and Compliance
The first topic we discussed was what the workflow was like initially and why the need for new solutions occurred. In their words, even with experts on board and acknowledged tools, occurring gaps were growing harder to fill:
“It [the workflow] wasn’t that bad: we have a strong team and a SOAR platform by a well-known vendor. Teamwork was – and remains – our strong point. But as the client base grew, it became harder to maintain SLAs, which are pretty strict in healthcare. Tier 1 and 2 analysts were overwhelmed by an increased number of alerts coming from different customers.”
The analysts had to deal with hundreds of emails and URLs reported by clients each week, and the verification process was mostly manual. Some multi-step phishing cases required up to 40 minutes of analysis, as they required multiple tools and resources, or even custom virtual machines. The need for better triage solutions and prioritization protocols intensified.
After discussion, the company leaders came up with a plan to enhance the processes:
Introducing more automation in alert triage to reduce workload
Obtain higher-quality threat data for faster decision-making
Shifting from reactive to proactive defense
Some team members expressed concerns about introducing a new solution:
““What if we have to rebuild the workflow from scratch? What if automation fails to work as promised?” – these are some of the questions the analysts raised. So we had to be selective [when choosing a solution]. We needed something flexible and easy to integrate.”
Immediate Improvements with ANY.RUN’s Interactive Sandbox
The MSSP launched the streamlining process by adding just one solution to the stack at a time. The choice fell on ANY.RUN’s Interactive Sandbox, as it offered a unique approach to dynamic malware analysis:
“It stood out among other options with interactivity. Automation is powerful, but not always enough. Interactivity offered more depth and understanding of malware.”
The MSSP has been using the sandbox for one and a half years, mostly as a solution integrated in their SOAR. The automated mode helped effortlessly deal with overflowing low-priority incidents, even if they included multiple stages like hidden links, redirects, and CAPTCHAs.
ANY.RUN’s sandbox enables automated detonation of complex attacks, e.g., including QR codes
Just in the past few weeks, multiple phishing campaigns were prevented through interactive analysis. Two of them involved common office tools used in medical institutions, such as OneDrive and Jotform:
An email-based phishing campaign analyzed in Interactive Sandbox
Another example of a phishing threat detonation in ANY.RUN’s virtual machine
In SOC lead’s words, concerns related to automation and integration didn’t turn out to be justified:
“The integration worked much better than was expected. With minimal changes in the workflow, we achieved stronger results: Tier 1 analysts had far more capacity; analysis of both low- and high-priority incidents became easier. No manual VM unfolding, no tedious escalations.”
As part of a scheduled assessment of their infrastructure, the team was also shopping for new sources of threat intelligence. After a two-week trial, they decided to fully implement ANY.RUN’s products into the existing workflows.
“We were happy with the results ANY.RUN’s sandbox brought, so it made sense to support resources we’ve been using for a while with TI solutions from the same vendor.”
Broad threat monitoring Early detection of attacks
Threat context just a click away Fast enrichment of isolated artifacts
Behavioral data through sandbox analyses New detection rules
Automation via SOAR integration Effortless responses and ticket closure
Together, these solutions enabled the SOC to proactively hunt and neutralize threats before they could impact client operations.
Measurable Outcomes
Solution
Use Case
Result*
Interactive Sandbox
Dynamic analysis of URLs/files
76% reduction in phishing triage time (from 30-40 minutes to 4-7 minutes)
Full visibility into malware behavior
Tier 1 closure rate increased from 20% to 70%
TI Lookup
Enrichment of IOCs with threat data context
34% fewer false escalations
TI Feeds
Expanded threat coverage with live threat intelligence in SOAR
45% improved MTTR and 55% fewer false positives
Early detection through monitoring of latest attacks on 15,000 companies
20 seconds: average MTTD for phishing
*Based on the company’s statistics after using ANY.RUN’s solutions
Phishing Campaign Case and Successful Mitigation
A recent incident illustrated the efficiency of the new workflow based on early detection and mitigation:
“A couple of weeks ago, our analysts spotted a suspicious connection on a client endpoint. TI Lookup immediately showed that it’s tied to a known malicious C2 server.”
TI Lookup connects isolated indicators with real live attacks in seconds
“For further insights, they browsed other analyses and saw a threat sample featuring phishing. The sandbox then helped uncover the entire attack chain; and retrieved IOC were used to refine detection rules.”
95% of SOCs speed up investigationswith TI solutions by ANY.RUN
Healthcare is a sector with real urgency and high regulatory demands. Acting as an MSSP in this industry requires auditability, transparency, and SLA adherence. The SOC lead noted that protocols and regulations that are common in healthcare industry became easier to fulfill with ANY.RUN:
“Since we implemented new solutions, every investigation now comes with evidence and threat data, from MITRE tags to screenshots. This made reporting faster and extra work fell off our shoulders.”
The MSSP is now driven by:
Faster triage across multiple customers
Proactive and scalable threat detection strategy
Decision-making supported by high-quality data
Audit-ready evidence aligned with industry regulations
Conclusion: From Reactive to Proactive Defense
By integrating ANY.RUN’s Interactive Sandbox, TI Lookup, and TI Feeds, this MSSP built a proactive defense system.
“Needless to say, we still work hard every day, but ANY.RUN gave us the tools to manage our daily tasks more effectively. More clarity and quick access to reliable information made all the difference. It lightened our load without taking away in quality.”
About ANY.RUN
Built for modern MSSPs and Enterprises, ANY.RUN empowers analysts to deliver faster, deeper, and more transparent threat analysis for their clients. The Interactive Sandbox exposes full attack behavior, from process execution to network activity, enabling analysts to investigate incidents in real time and make confident, data-driven decisions.
Cloud-based and ready out of the box, ANY.RUN supports Windows, Linux, and Android environments, streamlining multi-tenant operations without complex setup. Integrated Threat Intelligence Lookup and TI Feeds provide continuously updated, automation-ready IOCs for better detection, response, and reporting across all client environments.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-18 08:06:592025-11-18 08:06:59Healthcare MSSP Cuts Phishing Triage by 76% and Launches Proactive Defense with ANY.RUN
Welcome to this week’s edition of the Threat Source newsletter.
A year ago, fresh off a layoff, I never would have guessed I’d be spending Halloween weekend bouncing between conversations about space policy, satellite hacking, and wedding plans. That’s exactly what happened when my space analyst friend came to stay with us for a few days. Between coffee runs, getting sneak peeks of his upcoming book, and painting on skull makeup for a party, we found ourselves deep in discussions about putting data centers in space and, inevitably, the world of satellite cybersecurity.
Somewhere within all of that, I realized I was on deck for the newsletter intro soon, and I did what any cyber newbie would do: I asked the nearest expert if there had ever been a well-known cyberattack on satellites. My friend didn’t even blink before answering, “KA-SAT.”
Some light research and a few Webex messages later, I was speaking with our own Joe Marshall — who, lucky for me, might be the only person at Cisco who’s been to satellite hacking training.
Joe walked me through how on Feb. 24, 2022, just hours before Russia’s invasion of Ukraine, a cyber attack targeted Viasat’s KA-SAT satellite network. The attackers exploited a vulnerability in a VPN appliance, gaining access to the network’s management systems. They then deployed a wiper malware called AcidRain, which was designed to erase data on modems and routers across Europe.
Satellite communications were disrupted for thousands of users in Ukraine, but surprisingly, beyond Ukraine’s borders, approximately 5,800 Enercon wind turbines in Germany lost connectivity for remote monitoring and control.
One surprise from the conversation was the overlap between the AcidRain wiper and VPNFilter, which you may remember from Joe’s September newsletter. AcidRain may be VPNFilter’s successor. Take a look:
Figure 1. Section headers strings tables for VPNFilter (left) and AcidRain (right). Credit: SentinelOne.
Identical, hinting at a shared compiler and other technical links, as SentinelOne’sblog details.
What followed this summary was a LOT of questions on my part. What was the VPN vulnerability? How did the wiper work, exactly? What are the pros and cons of replacing vs. fixing the modems, and what about the logistics of the winning decision? Ultimately, while the AcidRain attack was destructive, it was, in the context of what else was happening to Ukraine’s infrastructure, a blip.
As a newcomer to both cybersecurity and Talos, I keep discovering that there are always gaps in the story. I didn’t get all my questions answered because companies guard details, official statements leave out key information, and sometimes, even years later, we’re still piecing things together. Being okay with that is a tall order for people who scour logs looking for a needle in a stack of needles. But when attacks are raining down, customers aren’t asking you to send a flawless analysis. They want to know what you’redoing to keep them safe.
So, as I write this, still with more questions than answers about AcidRain and the KA-SAT attacks, I’m learning to find peace in knowing that curiosity is the foundation for future expertise. Keep acquiring knowledge, asking questions (both basic and complex), and being okay with some uncertainty.
The one big thing
Cisco Talos published a new blog today on the Kraken ransomware group. Linked to HelloKitty, they double-extort organizations globally with cross-platform attacks and use advanced techniques like encryption benchmarking and anti-analysis. Kraken has also launched a new underground forum to strengthen ties within the cybercrime community.
Why do I care?
Kraken’s advanced, cross-platform techniques — including encryption benchmarking and evasion methods — raise the threat level for organizations of all sizes, and may inspire similar advancements in future ransomware. Plus, their new secure underground forum may accelerate collaboration between threat actors, making robust, layered defenses and intelligence sharing among defenders even more critical.
So now what?
Prioritize patching known vulnerabilities (especially SMB), strengthen credential management, and implement comprehensive endpoint, network, and access security solutions. Continuous monitoring, incident response planning, and user awareness training are crucial to detect and contain threats early.
Top security headlines of the week
SAP fixes serious security issues – here’s how to stay safe A patch is now publicly available, and while SAP’s users were previously notified, the researchers are once again urging everyone to apply it as soon as possible since the risk is only going to get bigger going forward. (TechRadar)
Phishing tool uses smart redirects to bypass detection A new phishing tool targeting Microsoft 365 users called Quantum Route Redirect simplifies what was once a technically complex campaign flow, as well as offers a uniquely evasive redirect feature that can bypass even robust email protections. (Dark Reading)
Cisco finds open-weight AI models easy to exploit in long chats The report, titled Death by a Thousand Prompts: Open Model Vulnerability Analysis, analyzed eight leading open-weight language models and found that multi-turn attacks, where an attacker engages the model across multiple conversational steps, were up to ten times more effective than one-shot attempts. (HackRead)
Nearly 30 alleged victims of Oracle EBS hack named on Cl0p ransomware site The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland. (SecurityWeek)
Kimsuky APT takes over South Korean Androids, abuses KakaoTalk One of North Korea’s formidable advanced persistent threat (APT) groups is targeting Android users in South Korea with a remote reset attack that exploits a feature in Google aimed at helping users find their devices. (Dark Reading)
Can’t get enough Talos?
The TTP: How Talos built an AI model into one of the internet’s most abused layers Hazel talks with Talos researcher David Rodriguez about how adversaries use DNS tunneling to sneak data out of networks, why it’s so difficult to spot in real time, and how Talos built an AI model to detect it without breaking anything important (like the internet).
The 2026 Snort Calendar is now available Snorty will pose as a new mythical creature each month. To get your copy, fill out our short survey. Calendars will begin shipping in December 2025. U.S. shipping only, available while supplies last.
Talos Takes: How attackers use your own tools against you From a wave of Toolshell events, to a rise in post-exploitation phishing, and the misuse of legitimate tools like Velociraptor, this quarter’s cases all point to a theme: attackers are getting very good at living off what’s already in your environment.
Do robots dream of secure networking? This blog demonstrates a proof of concept using LangChain and OpenAI, integrated with Cisco Umbrella API, to provide AI agents with real-time threat intelligence for evaluating domain dispositions.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-13 19:06:332025-11-13 19:06:33Viasat and the terrible, horrible, no good, very bad day
Cybersecurity researchers have revealed a new attack method targeting AI browsers, which they refer to as AI sidebar spoofing. This attack exploits users’ growing habit of blindly trusting instructions they get from artificial intelligence. The researchers successfully implemented AI sidebar spoofing against two popular AI browsers: Comet by Perplexity and Atlas by OpenAI.
Initially, the researchers used Comet for their experiments, but later confirmed that the attack was viable in the Atlas browser as well. This post uses Comet as an example when explaining the mechanics of AI sidebar spoofing, but we urge the reader to remember that everything stated below also applies to Atlas.
How do AI browsers work?
To begin, let’s wrap our heads around AI browsers. The idea of artificial intelligence replacing, or at least transforming the familiar process of searching the internet began to generate buzz between 2023 and 2024. The same period saw the first-ever attempts to integrate AI into online searches.
Initially, these were supplementary features within conventional browsers — such as Microsoft Edge Copilot and Brave Leo — implemented as AI sidebars. They added built-in assistants to the browser interface for summarizing pages, answering questions, and navigating sites. By 2025, the evolution of this concept ushered in Comet from Perplexity AI — the first browser designed for user-AI interaction from the ground up.
This made artificial intelligence the centerpiece of Comet’s user interface, rather than just an add-on. It unified search, analysis, and work automation into a seamless experience. Shortly thereafter, in October 2025, OpenAI introduced its own AI browser, Atlas, which was built around the same concept.
Comet’s primary interface element is the input bar in the center of the screen, through which the user interacts with the AI. It’s the same with Atlas.
The home screens of Comet and Atlas demonstrate a similar concept: a minimalist interface with a central input bar and built-in AI that becomes the primary method of interacting with the web
Besides, AI browsers allow users to engage with the artificial intelligence right on the web page. They do this through a built-in sidebar that analyzes content and handles queries — all without having the user leave the page. The user can ask the AI to summarize an article, explain a term, compare data, or generate a command while remaining on the current page.
The sidebars in both Comet and Atlas allow users to query the AI without navigating to separate tabs — you can analyze the current site, and ask questions and receive answers within the context of the page you’re on
This level of integration conditions users to take the answers and instructions provided by the built-in AI for granted. When an assistant is seamlessly built into the user interface and feels like a natural part of the system, most people rarely stop to double-check the actions it suggests.
This trust is precisely what the attack demonstrated by the researchers exploits. A fake AI sidebar can issue false instructions — directing the user to execute malicious commands or visit phishing websites.
How did the researchers manage to execute the AI sidebar spoofing attack?
The attack starts with the user installing a malicious extension. To do its evil deeds, it needs permissions to view and modify data on all visited sites, as well as access to the client-side data storage API.
All of these are quite standard permissions; without the first one — no browser extension will work at all. Therefore, the chances that the user will get suspicious when a new extension requests these permissions are almost zero. You can read more about browser extensions and the permissions they request in our post Browser extensions: more dangerous than you think.
A list of installed extensions in the Comet user interface. The disguised malicious extension, AI Marketing Tool, is visible among them. Source
Once installed, the extension injects JavaScript into the web page and creates a counterfeit sidebar that looks strikingly similar to the real thing. This shouldn’t raise any red flags with the user: when the extension receives a query, it talks to the legitimate LLM and faithfully displays its response. The researchers used Google Gemini in their experiments, though OpenAI’s ChatGPT likely would have worked just as well.
The screenshot shows an example of a fake sidebar that’s visually very similar to the original Comet Assistant. Source
The fake sidebar can selectively manipulate responses to specific topics or key queries set in advance by the potential attacker. This means that in most cases, the extension will simply display legitimate AI responses, but in certain situations it will display malicious instructions, links, or commands instead.
How realistic is the scenario where an unsuspecting user installs a malicious extension capable of the actions described above? Experience shows it is highly probable. On our blog, we’ve repeatedly reported on dozens of malicious and suspicious extensions that successfully make it into the official Chrome Web Store. This continues to occur despite all the security checks conducted by the store and the vast resources at Google’s disposal. Read more about how malicious extensions end up in official stores in our post 57 shady Chrome extensions clock up six million installs.
Consequences of AI sidebar spoofing
Now let’s discuss what attackers can use a fake sidebar for. As noted by the researchers, the AI sidebar spoofing attack offers potential malicious actors ample opportunities to cause harm. To demonstrate this, the researchers described three possible attack scenarios and their consequences: crypto-wallet phishing, Google account theft, and device takeover. Let’s examine each of them in detail.
Using a fake AI sidebar to steal Binance credentials
In the first scenario, the user asks the AI in the sidebar how to sell their cryptocurrency on the Binance crypto exchange. The AI assistant provides a detailed answer that includes a link to the crypto exchange. But this link doesn’t lead to the real Binance site — it takes you to a remarkably convincing fake. The link points to the attacker’s phishing site, which uses the fake domain name binacee.
The fake login form on the domain login{.}binacee{.}com is nearly indistinguishable from the original, and is designed to steal user credentials. Source
Next, the unsuspecting user enters their Binance credentials and the code for two-factor authentication, if needed. After this, the attackers gain full access to the victim’s account and can siphon off all funds from their crypto wallets.
Using a fake AI sidebar to take over a Google account
The next attack variation also begins with a phishing link — in this case, to a fake file-sharing service. If the user clicks the link, they’re taken to a website where the landing page prompts them to sign in with their Google account right away.
After the user clicks this option, they’re redirected to the legitimate Google login page to enter their credentials there, but then the fake platform requests full access to the user’s Google Drive and Gmail.
The fake application share-sync-pro{.}vercel{.}app requests full access to the user’s Gmail and Google Drive. This gives the attackers control over the account. Source
If the user fails to scrutinize the page, and automatically clicks Allow, they grant attackers permissions for highly dangerous actions:
Viewing their emails and settings.
Reading, creating, and sending emails from their Gmail account.
Viewing and downloading all the files they store in Google Drive.
This level of access gives the cybercriminals the ability to steal the victim’s files, use services and accounts linked to that email address, and impersonate the account owner to disseminate phishing messages.
Reverse shell initiated through a fake AI-generated utility installation guide
Finally, in the last scenario, the user asks the AI how to install a certain application; the Homebrew utility was used in the example, but it could be anything. The sidebar shows the user a perfectly reasonable, AI-generated guide. All steps in it look plausible and correct up until the final stage, where the utility installation command is replaced with a reverse shell.
The guide for installing the utility as shown in the sidebar is almost entirely correct, but the last step contains a reverse shell command. Source
If the user follows the AI’s instructions by copying and pasting the malicious code into the terminal and then running it, their system will be compromised. The attackers will be able to download data from the device, monitor activity, or install malware and continue the attack. This scenario clearly demonstrates that a single replaced line of code in a trusted AI interface is capable of fully compromising a device.
How to avoid becoming a victim of fake AI-sidebars
The AI sidebar spoofing attack scheme is currently only theoretical. However, in recent years attackers have been very quick to turn hypothetical threats into practical attacks. Thus, it’s quite possible that some malware creator is already hard at work on a malicious extension using a fake AI-sidebar, or uploading one to an official extension store.
Therefore, it’s important to remember that even a familiar browser interface can be compromised. And even if instructions look convincing and come from the in-browser AI assistant, you shouldn’t blindly trust them. Here’s some final tips to help you avoid falling victim to an attack involving fake AI:
When using AI assistants, carefully check all commands and links before following the AI’s recommendations.
If the AI recommends executing any programming code, copy it and find out what it does by pasting it into a search engine in a different, non-AI browser.
Don’t install browser extensions — AI or otherwise — unless absolutely necessary. Regularly clean up and delete any extensions you no longer use.
Before installing an extension, read the user reviews. Most malicious extensions rack up heaps of scathing reviews from duped users long before store moderators get around to removing them.
Before entering credentials or other confidential information, always check that the website address doesn’t look suspicious or contain typos. Pay attention to the top-level domain, too: it should be the official one.
Use Kaspersky Password Manager to store passwords. If it doesn’t recognize the site and doesn’t automatically offer to fill in the login and password fields, this is a strong reason to ask yourself if you might be on a phishing page.
Install a reliable security solution that will alert you to suspicious activity on your device and prevent you from visiting a phishing site.
What other threats await you in browsers — AI-powered or regular:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-13 18:07:222025-11-13 18:07:22How a fake AI sidebar can steal your data | Kaspersky official blog
In August 2025, Cisco Talos observed big-game hunting and double extortion attacks carried out by Kraken, a Russian-speaking group that has emerged from the remnants of the HelloKitty ransomware cartel.
Talos observed in one intrusion that the Kraken actor exploited Server Message Block (SMB) vulnerabilities for initial access, then used tools like Cloudflared for persistence and SSH Filesystem (SSHFS) for data exfiltration before encryption.
Kraken is a cross-platform ransomware with distinct encryptors for Windows, Linux, and VMware ESXi, targeting a wide range of enterprise environments.
Kraken ransomware benchmarks a victim machine before starting the encryption process, a feature rarely seen in ransomware.
Talos also observed the announcement of a new underground forum, “The Last Haven Board,” on Kraken’s data leak blog, aimed at creating an anonymous and secure communication channel for the cybercrime underground.
Who is Kraken?
The Kraken ransomware group, which emerged in February 2025, employs a double extortion technique and appears to be opportunistic, as it has not concentrated on any specific business verticals. According to Kraken’s leak site, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait.
Like other operators in the double extortion space, Kraken also operates a data leak site to disclose the stolen data of victims who do not meet their ransom demands.
Figure 1. Kraken data leak blog.
Kraken encrypts the victim’s environment, uses the .zpsc file extension for the encrypted files, and drops a ransom note titled “readme_you_ws_hacked.txt.” In the ransom note, the actor threatens the victims by stating that they have stolen and encrypted their confidential data. They instruct the victim to contact them using an onion URL to prevent posting to their leak site.
Figure 2. Kraken ransomnote.
Talos observed in one of the instances that the actor demanded a ransom of around 1 million USD to be paid in Bitcoin to the actor’s wallet address. Kraken assures victims that after the successful payment, they will decrypt the environment and guarantee the non-disclosure of stolen data.
Ties to HelloKitty
Kraken, a Russian-speaking gang, is suspected to have emerged from the ashes of the HelloKitty ransomware cartel or to have been established by some of its former members, according to external reports. The title of the Kraken data leak site explicitly mentions the HelloKitty ransomware group name. Additionally, Talos has observed that Kraken and HelloKitty use the same ransom note filename, indicating a possible link between the two groups.
In September 2025, the Kraken group announced a new underground forum called “The Last Haven Board” in their data leak blog. According to its description, Last Haven’s primary objective is to create an anonymous and secure environment for communication within the cybercrime underground. Talos observed that the Last Haven forum administrator announced support and collaboration from the HelloKitty team and WeaCorp, an exploit buyer organization, suggesting the possible involvement of HelloKitty operators with the Kraken group.
Figure3. Last Haven underground forum announcement on Kraken data leak blog.
Infection chain
Figure 4. Kraken infection chain.
In August 2025, Cisco Talos Incident Response (Talos IR) observed in one instance that the Kraken ransomware actor gained initial access to the victim’s machine by exploiting an existing vulnerability in the SMB service on servers exposed to the internet. Once they established their foothold on the victim’s machine, they extracted valid administrators’ and other privileged accounts’ credentials. Subsequently, they re-entered the victim environment through a Remote Desktop connection using the exfiltrated privileged account credentials.
After re-entering the victim machine, the attacker established a persistent connection by installing the Cloudflared tool and configuring a reverse tunnel on the victim’s machine. Additionally, the attacker installed the SSHFS tool on the victim machine, utilizing it to navigate the victim’s environment and exfiltrate sensitive data. The attacker then deployed the Kraken ransomware binary and moved laterally to other machines connected to the infected machine through Remote Desktop Protocol (RDP) connections, using the stolen privileged user accounts to deploy the ransomware binaries. Through this persistent remote connection, the attacker executed commands to run the ransomware on multiple systems within the victim’s environment.
Kraken ransomware analysis
Kraken ransomware is a sophisticated ransomware family with variants that target Windows, Linux, and ESXi systems. This ransomware offers extensive command-line options, providing operational flexibility for the actors who utilize Kraken ransomware in their attacks. It has the capability for either full or partial encryption of targeted files, along with features that allow for the encryption of specific files, including SQL databases and network shares.
To encrypt targeted files, Kraken ransomware employs RSA encryption algorithms with a key length of 4096 bits and ChaCha20 symmetric encryption. Additionally, the ransomware features encryption benchmarking capabilities to assess how quickly it can operate on the victim’s machine without causing system overload, ensuring maximum damage in minimal time while evading detection through resource exhaustion.
Talos observed that the attacker executed the commands on Windows and ESXi environments to run the encryptor program. The Kraken encryptor is engineered with various command line arguments that the attacker could leverage depending on the victim’s environment.
Delays the execution of the encryptor for N seconds
-solid
Full file encryption without blocks
-step N
Numbers of blocks of a file to encrypt
-limitN
Limit encryption to first N megabytes
-d
Runs asdaemonandexecution through remote SSH connection
–noteonly
Drops ransom note only without performing the encryption
-tests
Run encryption performance tests
–tempfile
Temporarytest file path
–tempsize
Test file size in megabytes
-all
Encrypt all files
–nolsof
Disablelsofchecking
–nokillallvms
Skip VM termination
Kraken Windows encryptor
The Windows version of Kraken ransomware is a 32-bit executable written in C++ and possibly obfuscated using a Golang-based packer. The ransomware exhibits features such as anti-reinfection checks, anti-analysis, and anti-recovery, and it encrypts the targeted files, appending the .zpsc file extension to the encrypted files.
Initial execution phase
In the initial phase of execution, Kraken processes the command line parameters and performs the anti-reinfection checks on the victim machine to avoid double-encryption. The actor has employed anti-reinfection checks to effectively manage the decryption keys.
Kraken ransomware disables the WoW64 filesystem redirection on the victim machine by using the function Wow64EnableWow64FsRedirection with the argument “ (False)” to enable the 32-bit binary to access the 64-bit files on Windows machine.
WoW64 is a compatibility layer on a 64-bit Windows operating system that allows 32-bit applications to run seamlessly. The key feature of WoW64 is file system redirection, which ensures that when a 32-bit application attempts to access the “C:WindowsSystem32” folder, WoW64 redirects it to “C:WindowsSysWoW64”, allowing the 32-bit application to load the correct 32-bit version of system DLLs.
Figure5. Function snippet disabling the WoW64 redirection.
Kraken ransomware, after disabling the WoW64 redirection, modifies its process token privilege, enabling the debugging rights. This privilege is essential for ransomware to access and encrypt files belonging to other processes. Further, the ransomware encrypts the local drives, network shares, and SQL database files and disables the backup services on the 64-bit Windows operating system. All these operations of the 32-bit ransomware binary would require access to the folder “C:WindowsSystem32”. Disabling the redirection in Wow64 will enable the 32-bit ransomware binary to access the “C:WindowsSystem32” folder on the 64-bit Windows operating system.
Anti-analysis and anti-recovery techniques
Kraken ransomware utilizes anti-analysis techniques to evade detection, complicate analysis, and prevent execution in sandbox environments.
The ransomware employs extensive control flow obfuscation with multiple conditional loops throughout the code, concealing the actual control flow paths and increasing complexity for static analysis and pattern matching for signature generation.
It also manipulates system exception handlers to prevent Windows error dialogs from appearing by executing SetErrorMode function with the value 0x8003 which is a bitwise OR combination of three Windows error mode flags:
SEM_FAILCRITICALERRORS (0x0001) – no critical error handler message box
SEM_NOGPFAULTERRORBOX (0x0002) – no general protection fault error box
SEM_NOOPENFILEERRORBOX (0x8000) – no open file error box
Figure 6. Function snippet sets the error mode flags.
It employs a sleep-based execution delay to evade sandbox analysis, stops the backup services, and executes the embedded command to remove all restore points on the victim machine.
vssadmin delete shadows /all /quite
It also deletes the recycle bin using the Windows function SHEmptyRecycleBinA.
Encryption performance testing and benchmarking
Kraken ransomware has the ability to conduct performance testing on the victim’s machine before initiating the actual encryption. An actor can use this feature through command line options such as “-tests,” “-tempfile,” and “-tempsize” to assess the victim machine’s performance and optimize the ransomware encryption process.
Kraken does this by first creating a temporary test file, using the path and filename specified via the “-tempfile” parameter. It then populates this file with random data, writing in 1MB chunks until the total size defined by the “-tempsize” parameter is reached. To time the core operation, the module records the start time with the clock_gettime function, performs the actual encryption on the test file, and then records the end time. Finally, it calculates the elapsed time and computes the encryption speed for the victim machine, expressed in MB/s, using the formula:
Based on the throughput results, the function validates if the attacker should choose full encryption mode or partial encryption mode with the maximum file size chunks to encrypt. After the performance testing process, it removes the test file using the function unlink() .
Parallel encryption operation
The Kraken Windows encryptor has four encryption modules including SQL database, Network share, Local drive, and Hyper-V encryption. Based on the command-line flags provided by the attacker, the encryptor determines which encryption module to execute.
The SQL database encryption module encrypts Microsoft SQL server databases. To target database files, the module accesses the Microsoft SQL Server registry keys on the victim machine, specifically querying “HKLMSOFTWAREMicrosoftMicrosoft SQL Server” and its “Instance NamesSQL” subkey to search for the “MSSQLSERVER” and “SQLEXPRESS” instances. Upon locating an instance, it retrieves the “SQLDataRoot” registry value to determine the path to the database files. The module then validates that these paths exist using the PathFileExistsWWindows API before proceeding to encrypt the database files.
The network share encryption module enumerates and encrypts accessible network shares by using Windows WNet APIs to detect both mapped and unmapped network locations, specifying RESOURCETYPE_DISK and RESOURCETYPE_ANY. During enumeration, it iterates through the discovered network resources but explicitly skips the ADMIN$ and IPC$ shares. For each accessible network shares it finds, the module creates dedicated encryption worker threads to handle the encryption process.
Figure 8. Function snippetenumeratesdifferent network resource types.
The local drive encryption module encrypts all locally attached drives by first using the GetLogicalDrives function to enumerate all available drive letters from A to Z. For each letter, it checks the drive type with the GetDriveTypeW function, targeting drives identified as DRIVE_REMOVABLE, DRIVE_FIXED, or DRIVE_REMOTE while excluding CD-ROM and network-only drives. After constructing the drive path (e.g., “X:”), it creates a dedicated encryption worker thread for each validated drive path.
The Hyper-V virtual machine encryption module targets virtual machine files by executing a series of embedded PowerShell commands. First, it disables PowerShell restrictions on the victim machine to ensure its commands run. It then discovers the virtual machine files by listing all VMs and extracting their corresponding hard disk file paths. To unlock these files for encryption, the module forcefully stops all running virtual machines. After these prerequisite steps, it creates encryption worker threads to encrypt the located virtual machine files. The PowerShell commands executed by the module:
The ransomware excludes the executables (.exe) and dynamic-link library (.dll) files along with the folders “Program Files”, “Program Files (X86)”, and “ProgramData” from the encryption processes on the victim machine, allowing the victims to still access the system to communicate with the threat actor.
Kraken Linux/ESXi encryptor
The Linux or ESXi version of the Kraken ransomware is 64-bit executable written in C++ and compiled using the tool crosstool-NG version 1.26.0.
In the initial phase of the execution, the Linux executable file version of Kraken ransomware processes the command-line parameters specified by the attacker.
Platform discovery
The ransomware runs the platform detection module to discover the type of victim machine by executing the commands mentioned below and adapting the behavior based on the detected platform.
System type
Command
ESXi
esxclisystem version get
Nutanix
uname–a with “nutanix”
Ubuntu Linux
uname–a with “ubuntu”
Synology NAS devices
cat/etc.defaults/VERSION with“dsm”
While targeting the ESXi environments, the ransomware lists any running virtual machines and forcefully attempts to kill them by executing the following commands embedded in the ransomware binary:
esxcli vm process list
esxcli vm process kill --type=force --world-id=
Encryption types
The ELF version of Kraken ransomware performs the multi-threaded encryption, supporting both “solid – Full encryption” and “setp – partial encryption”. It also employs the encryption performance benchmarking module that an attacker can leverage during the attack to calculate the encryption speed and decide if they want to perform full or partial encryption. The performance benchmarking algorithm is like the Windows version of Kraken ransomware described in the previous section.
It performs the recursive directory traversal and encrypts the file based on the type of encryption mode specified in the command line parameter by the attacker and appends the .zpsc file extension to the encrypted files.
Anti-analysis and detection evasion
The ELF version of Kraken ransomware employs control flow obfuscation with the complex loop structure to hinder the analysis and operates in daemon mode by forking into background process through fork_as_daemon() function and continues to run, performing the encryption in background. It also ignores the signal handlers SIGCHLD (child process termination) and SIGHUP (Terminal hangup).
The ransomware employs a multi-stage self-deletion and cleanup process to erase traces of its execution, leaving a minimal forensic artefact, after completing the encryption operation. Kraken creates a bash script “_bye_bye_.sh” in the same directory as the ransomware binary. It then builds the script with the commands to delete the log files, shell history, ransomware binary, and the script itself.
It executes the script using popen function popen(“sh ”<deletion_script_path>””,"r") which runs in a separate shell process, and the parent process can exit before the script finishes its execution which helps to delete itself before the completion of the execution.
Coverage
Ways our customers can detect and block this threat are listed below.
Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.
Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.
Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.
Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.
Cisco Secure Access is a modern cloud-delivered Security Service Edge (SSE) built on Zero Trust principles. Secure Access provides seamless transparent and secure access to the internet, cloud services or private application no matter where your users work. Please
contact your Cisco account representative or authorized partner if you are interested in a free trial of Cisco Secure Access.
Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.
Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.
Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.
Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.
Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
Snort SIDs for the threats are: 65480 and 65479.
ClamAV detections are also available for this threat:
Win.Ransomware.Kraken-10056931-0
Unix.Ransomware.Kraken-10057031-0
Indicators of compromise (IOCs)
The IOCs can also be found in our GitHub repository here.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-13 11:07:032025-11-13 11:07:03Unleashing the Kraken ransomware group
How many real threats hide behind the noise your SOC faces every day?
When hundreds of alerts demand attention at once, even the best analysts start to lose focus. The nonstop pressure to react to everything drains energy, clouds judgment, and opens the door to real risk.
Teams using ANY.RUN have alreadyflipped that script:
90% of attacks become visible within 60 seconds, giving analysts instant context instead of endless guesswork.
94% of users report faster triage, cutting time spent on false positives and low-value alerts.
95% of SOC teams speed up investigations, easing the overload that leads to burnout.
Ready to see how to get there? This action plan lays out the steps CISOs can take to turn alert fatigue into lasting focus.
Step 1: Replace Guesswork with Real-Time Visibility
Alert fatigue often begins with uncertainty. Analysts spend hours dissecting fragmented data, trying to connect the dots between partial logs and incomplete alerts. When they can’t see the full story, every alert feels critical, and fatigue takes over.
Real-time behavioral visibility changes everything. With ANY.RUN’s interactive sandbox, your team watches the attack unfold in a safe environment. From the first process execution to registry changes and data exfiltration attempts, every move is mapped in real time.
That level of context replaces guesswork with confidence.
Real-time analysis of Clickup abuse fully exposed in 60 seconds
In the following example, analysts used the sandbox to expose a phishing attack that abused ClickUp to deliver a fake Microsoft 365 login page, uncovering the full chain in seconds.
With ANY.RUN’s real-time visibility, team achieve:
3× higher efficiency in daily operations
15 sec median MTTD
Fewer false positives and missed threats
Faster response and a calmer, more focused SOC
Bring real-time visibility to your SOC
with ANY.RUN’s Interactive Sandbox
Even the strongest SOCs lose precious hours to repetitive work, copying IOCs, exporting reports, updating tickets. None of these tasks strengthen defense; they just drain energy and attention. Over time, that’s how alert fatigue turns into burnout.
But not every task can or should be automated. Many modern threats still require human-like interaction to be revealed: clicking a phishing link, solving a CAPTCHA, or scanning a QR code that hides a malicious redirect. Traditional tools stop short there.
QR code–based phishing fully exposed inside ANY.RUN sandbox; the hidden malicious link and full attack chain revealed in under 60 seconds.
With ANY.RUN’s sandbox, analysts get the best of both worlds; automation that behaves like a human when automated interactivity is enabled. It clicks through phishing pages, solves CAPTCHAs, follows redirects, and even scans QR codes that hide malicious links. All of this happens automatically, revealing threats most tools would miss. And when deeper insight is needed, analysts can jump in at any point to interact directly.
Outcome of automation and interactivity:
Hidden threats revealed that traditional tools can’t detect
Faster investigations with less manual work
Lower analyst fatigue through balanced automation
Human control preserved for high-priority incidents
This combination helps analysts uncover complex threats in less time and enables Tier 1 teams to resolve more cases independently.
According to recent data among ANY.RUN’s users:
20% lower workload for Tier 1 analysts
30% fewer escalations from Tier 1 to Tier 2
Step 3: Integrate Live Threat Intelligence to Cut Through the Noise
Even the best SOCs struggle to stay focused when analysts waste hours chasing outdated data; verifying expired domains, checking inactive IOCs, or switching between disconnected tools just to confirm what’s real.
Alert fatigue is a major obstacle for SOCs around the world
You can easily solve this with the help of live, connected intelligence.
ANY.RUN’s Threat Intelligence Feeds pull verified indicators from 15,000 organizations and 500,000 analysts worldwide, all sourced from real-time sandbox investigations. This means your team acts on current data, active phishing kits, live redirect chains, and real attacker infrastructure, not last month’s reports.
ANY.RUN’s TI Feeds deliver 99% unique IOCs in real time
When this intelligence is integrated into your SOC tools, analysts no longer need to jump between platforms or second-guess stale alerts. Every IOC is backed by behavioral evidence and traceable to a live analysis.
With this setup, your team can:
Validate alerts instantly using verified, real-time data
Eliminate repetitive checks for outdated or inactive indicators
Trace every IOC back to its full attack chain
Make faster, evidence-based decisions without leaving their workflow
As a result, businesses achieve stronger detection, less context-switching, and sharper focus across all SOC operations.
Detect emerging threats early
with real-time intelligence from TI Feeds
Even the most advanced SOCs lose efficiency when investigations and follow-ups aren’t coordinated. Without clear ownership and visibility into who’s handling what, tasks overlap, progress stalls, and important findings slip through the cracks.
With ANY.RUN’s teamwork features, CISOs and SOC leads can manage investigations within a single workspace: assigning tasks, tracking analyst progress, and keeping every case organized.
Team management in ANY.RUN
Each analysis also generates a structured, shareable report, so findings are easy to review, reuse, or hand off across shifts.
This unified workflow keeps everyone aligned, from initial detection to final response, while ensuring accountability and consistency across the SOC.
With a unified response workflow, you can ensure:
Clear task ownership and visibility into investigation progress
Structured, shareable reports for faster knowledge transfer
Stronger coordination between analysts and response leads
Higher overall efficiency with no duplicated effort
Time to Give Your Team a Break from the Noise
Alert fatigue is a sign of systems that demand too much and explain too little. By giving your analysts real-time visibility, automation that understands context, and intelligence they can trust, you give them what they need most: focus.
When the noise quiets down, your team moves with intent; faster investigations, sharper decisions, and actions backed by real context instead of guesswork.
Built for modern SOC operations, ANY.RUN helps teams detect, analyze, and respond to threats in real time. Its Interactive Sandbox reveals full attack behavior, from process execution to network activity, giving analysts the clarity they need to act with confidence.
Compatible with Windows, Linux, and Android, the cloud-based sandbox provides deep behavioral visibility with no setup required. Integrated Threat Intelligence Lookup and TI Feeds deliver continuously updated, automation-ready IOCs that strengthen every layer of detection.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-11-13 10:07:162025-11-13 10:07:16Solve Alert Fatigue, Focus on High-Risk Incidents: An Action Plan for CISOs
Better preventative measures 
