Why a Cisco Talos Incident Response Retainer is a game-changer

/in

Why a Cisco Talos Incident Response Retainer is a game-changer

In today’s hyper-connected world, cyber attacks are not a matter of if but when. Ransomware, phishing and data breaches dominate headlines. For any organization, the stakes are high and the impact can be wide. A cybersecurity breach can impact your organization’s ability to conduct normal business, damaging its reputation, reducing revenue, and disrupting operations. 

A Cisco Talos Incident Response (Talos IR) Retainer is a strategic investment that empowers your entire organization to stay resilient and ahead of tomorrow’s threats. Here’s how a Talos IR Retainer can strengthen your organization’s security and ensure peace of mind.

What is a Cisco Talos IR Retainer? 

A Talos IR Retainer offers a direct line to Cisco’s top cybersecurity specialists, ensuring both proactive protection and swift response to cyber threats. Backed by Cisco Talos global threat intelligence and hundreds of threat intelligence researchers, it equips organizations to prevent, respond to, and recover from cyber incidents efficiently. From tailored incident response plans to 24/7 emergency support, the retainer is a lifeline in a threat landscape that never sleeps.

We have just released a series of short videos that explain the full range of Talos IR services. Check out the playlist here, or start by watching the Emergency Response video below:

Benefits to the entire organization 

A Cisco Talos IR Retainer is not only designed to benefit your IT teams, but it’s a catalyst for building organization-wide resilience. Here is how Talos IR delivers value to clients’ stakeholders:  

  1. Risk mitigation and cost savings 
    Talos IR enables customers to respond swiftly to cyber threats and supports them through recovery efforts, minimizing downtime, costs, and regulatory risks 
  2. Reputation protection 
    A retainer equips leadership with strategic response plans and expert guidance, ensuring preparedness, demonstrating due diligence, and preserving stakeholder confidence during critical incidents. 
  3. Organization-wide alignment 
    A cybersecurity retainer ensures that your legal, human resources, information technology, and leadership teams are aligned before a threat strikes. Defined responsibilities and structured playbooks, plans, and tabletop exercises eliminate ambiguity and drive faster, more efficient incident response and recovery. Talos IR is there to create and review existing policies and make sure you are prepared at various levels.

Bolstering organizational security 

A Talos IR Retainer transforms your organization’s security posture from reactive to proactive. Our job is to take you though the lifecycle of an incident and build up long-term resilience to cybersecurity attacks. We do this by delivering various engagements, such as: 

  • Proactive Threat Hunting 
    Using the PEAK Framework (Prepare, Execute, Act with Knowledge), Talos IR specialists proactively hunt for threats before they escalate, leveraging real-time intelligence to stay ahead of adversaries. 
  • Customized preparedness 
    Tailored IR plans, playbooks, and readiness assessments address your organization’s unique risks and evaluates the current state of its cybersecurity preparations.  
  • Continuous improvement 
    Post-incident reports and ongoing collaboration identify gaps and recommend long-term strategies, ensuring that security evolves with the threat landscape. 
  • Vendor-agnostic integration 
    Talos IR works with existing security tools, maximizing investments and enhancing detection and response capabilities in place. If needed, we can always deploy additional Cisco technology to help with an investigation. 
  • Intelligence-driven defense 
    Access to Talos’ global threat intelligence, updated in real time, ensures your organization is armed with the latest insights on adversary tactics, techniques, and procedures (TTPs). 

What it means to have IR specialists on speed dial 

Having Talos IR specialists on call is like having an elite SWAT team for cybersecurity. Here is what Talos IR provides for your organization: 

  • Rapid response, 24/7 
    With a retainer, Cisco Talos IR specialists mobilize within hours of an incident, isolating threats and minimizing damage. This speed is critical, as every minute counts when containing ransomware or a data breach. 
  • Expert guidance 
    The Talos IR team brings unmatched expertise, analyzing adversary TTPs and providing actionable recommendations across many verticals and industries. 
  • Tailored support 
    Specialists collaborate with your teams, aligning response efforts with your business priorities. Whether coordinating with legal or PR, they ensure a cohesive strategy. 
  • Peace of mind 
    Knowing experts are a call away reduces stress for your executives and IT teams. Priority access means your organization is never left waiting during a crisis. 
  • Post-Incident Review 
    Talos IR delivers comprehensive reports that detail root causes, remediation steps, and preventive measures, turning incidents into opportunities for increased cybersecurity and prevention of future incidents.

Real-world impact 

Our customers trust us to bring the expertise and knowledge they need to navigate their most challenging days with confidence.  Read about our work with Veradigm and how we made a difference during a Qakbot attack here. 

Take the next step 

A Cisco Talos IR Retainer is a shield against cyber chaos. It strengthens your cybersecurity and ensures rapid recovery with specialists just a call away. Here’s how to get started: 

  • Secure a Retainer: Lock in priority access to proactive and emergency services. 
  • Schedule a Tabletop Exercise: Test your preparedness with tailored scenarios to fit your environment. 
  • Explore our website: Access quarterly trends and learn more about Talos and what we do to secure our clients. 

Cisco Talos Blog – ​Read More

Efficient SOC: How to Detect and Solve Incidents Faster 

/in

SOCs face constant pressure. Heavy workloads, poor threat visibility, and disconnected tools introduce delays in detection and response, which may lead to financial loss and operational disruptions for the business. 

ANY.RUN helps over 15K security teams to solve this challenge by empowering them to quickly detect, analyze, and understand threats, so they can respond faster and with confidence. 

Here’s how your SOC can handle incidents efficiently and save up to 21 minutes per case. 

Spot More Threats in Real Time 

Many SOCs struggle with delayed detection due to static analysis tools and manual research that takes hours. By the time an attack is confirmed, it may have already spread across the network, increasing the cost and complexity of response. 

Interactive Sandbox lets SOCs follow entire attack chains manually to reach the final payload 

ANY.RUN’s Interactive Sandbox tackles this problem by providing a real-time virtual environment, allowing teams to observe malware behavior as it unfolds. Suspicious files, URLs, and scripts are detonated in cloud VMs, giving immediate insights into their actions, without risking production systems or waiting for the analysis to finish.  

The result is fast knowledge of the threat and a clear understanding of the response steps needed to contain and mitigate it. 

Results SOCs like yours achieve 

  • Faster MTTD: Get answers in minutes, not hours, with 88% of attacks visible within 60 seconds of analysis. 
  • Higher detection rate: See more with a 36% detection rate increase on average. 

Reduce MTTR and minimize risks with ANY.RUN’s solutions
Request a quote or trial for your SOC  



Contact us


Identify Low-Detection Attacks with Speed and Ease  

For cases with evasive threats, the sandbox equips SOC teams with the interactivity. It lets them identify attacks that beat the majority of standard detection systems by simulating user actions right inside the VM.  

The common threats exposed with interactive analysis include: 

  • Multi-stage malware 
  • Payloads hidden in email attachments 
  • CAPTCHA-protected phishing pages 
Interactive Sandbox streamlines detection of malware and phishing with live analysis 

By opening, downloading, running, and performing other activities to trigger the attack chain, analysts can force threats to reveal themselves in seconds, cutting the time to the response stage. 

Thanks to the ANY.RUN sandbox’s intuitive interface, most of the investigations can be done by junior analysts without assistance from senior professionals. This results in a continuous team-wide expertise growth and better decision-making.  

Results SOCs like yours achieve 

  • Fewer missed threats: Find hidden attacks that most tools skip with up to 58% more threats identified overall. 
  • Efficient triage and response: Enable junior staff to handle more incidents on their own with 30% reduction in Tier 1 to Tier 2 escalations. 

Automate Repetitive Work to Free Up Analysts 

Alert fatigue ranks as number one challenge for SOC teams. It not only slows down response times but also increases the risk of human error, leaving gaps in defense. 

ANY.RUN takes the brunt of the work off your team’s hands and automates critical aspects of threat analysis, including user simulations and malware detonation.  

See a video recording of the analysis performed by Automated Interactivity

You get clear verdicts and actionable threat reports with IOCs and TTPs, enabling your team to make faster, more accurate decisions about the incident at hand. 

Results SOCs like yours achieve 

  • No time wasted: Automation reduces manual effort, accelerating analysis and improving productivity across the team, with 94% of ANY.RUN users reporting faster triage. 
  • Lower costs: Save resources on routine tasks like checking suspicious files and URLs with 20% reduction in case load for Tier 1. 

Connect Your Security Stack for Zero-Delay Workflow 

Disconnected security tools create silos, forcing teams to lose time during switching between platforms and makes it harder to maintain a unified defense strategy. 

ANY.RUN’s products: Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds integrate seamlessly with popular TIPs, SIEMs, and SOAR platforms via API/SDK. These include Cortex XSOAR, QRadar SIEM & SOAR, OpenCTI, and others. 

TI Lookup provides SOC teams with up to 24x more IOCs per case to boost response 

With a centralized incident control powered by ANY.RUN’s solutions, teams gain real-time alert enrichment, insights into threat behavior, and valuable context that guide containment and remediation efforts. 

Results SOCs like yours achieve 

  • Productivity boost: With ANY.RUN’s products, teams reach up to 3x better performance, accelerating response times and fostering cross-team collaboration. 
  • Stronger security: Enrich proactive defense with 24x more IOCs using ANY.RUN’s TI solutions powered by data from 15K+ SOCs worldwide. 

The Result: 21 Minutes Faster MTTR per Case 

Organizations using ANY.RUN experience a unified, efficient workflow that cuts through noise and accelerates investigations. Real-time analysis, automation, and seamless integrations enable teams to reduce MTTR by 21 minutes per incident. This translates to: 

  • More threats handled with existing resources 
  • Faster alert triage and investigations 
  • Higher detection rates and wider threat coverage 
ANY.RUN provides a comprehensive solution for the entire SOC team 

For CISOs, the outcome is simpler, stronger security: fewer blind spots, lower costs, and a team equipped to stay ahead in an increasingly hostile threat landscape. 

These results are evidenced by companies like Expertware, a leading IT consultancy and MSSP in the EU. With ANY.RUN, they achieved a 50% reduction in threat investigation and IOC extraction turnaround time.  

By replacing time-consuming manual setups with interactive sandboxing, Expertware improved visibility into complex threats, streamlined collaboration across their SOC, and scaled operations without adding overhead. 

About ANY.RUN  

Designed to accelerate threat detection and improve response times, ANY.RUN equips teams with interactive malware analysis capabilities and real-time threat intelligence.  

ANY.RUN’s cloud-based sandbox supports investigations across Windows, Linux, and Android environments. Combined with Threat Intelligence Lookup and Feeds, our solutions give security teams full behavioral visibility, context-rich IOCs, and automation-ready outputs, all with zero infrastructure overhead.   

Ready to see how ANY.RUN’s services can power your SOC?     

Start your 14-day trial now →  

The post Efficient SOC: How to Detect and Solve Incidents Faster  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Responding to npm package compromise by the Shai-Hulud worm.

/in

On the evening of September 15, a new attack against the most popular JavaScript component — npm — began.  A number of packages — some with millions of weekly downloads — were infected with malicious code that steals tokens and authentication keys. Its most interesting feature is that it is able to spread automatically — infecting other nmp packages. Among the infected packages is the popular @ctrl/tinycolor. According to Aikido Security, almost 150 packages have been compromised — including Crowdstrike packages.

Propagation methodology

The method of the first infection and “patient zero” are currently unknown. Since the attack pattern is very similar to the recent s1ngularity incident, it may have been phishing as well. But the further chain of infection is as follows:

  • Malicious code is added to compromised packages in the form of a post-installation script saved in the bundle.js file. When the victim installs the infected package, the script runs. Unlike the previous incident, the script is cross-platform and works in both *nix and Windows environments.
  • The script downloads a platform-appropriate version of TruffleHog, a legitimate secret-finding tool. TruffleHog finds high-entropy strings in local file systems and available repositories. These are cryptographic keys, API tokens, and other such information.
  • In addition to searching through TruffleHog, the script validates useful tokens by analyzing environment variables such as GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY. It then checks if they are valid by querying the npm whoami and GitHub user API-endpoints.
  • The script then compromises npm packages to which the attacked user has access with publishing rights. To do this, it downloads the current version of the infected package from npm, increments the subversion by 1, adds a link to the postinstall hook, and writes its copy to the bundle.js file. Then the trojanized “new version” of the package is published to npm.
  • Then it marks the victim’s repositories as public ones, which is sometimes a separate, more important leak.

Publishing stolen data

Extracting the harvested secrets is done in two ways at the same time:

Through the GitHub repository. Malware creates a public Shai-Hulud repository on behalf of the victim and with their GitHub token. Then it uploads a JSON file with the collected secrets and system information to this repository.

Via GitHub actions. The script creates a new GitHub workflow (github/workflows/shai-hulud-workflow.yml) that encodes the collected secrets into JSON and transmits to the attacker’s webhook[.]site server.

Incident Response

The infection of the tinycolor package and dozens of others became known on the night of September 15-16, and by morning the npm administration had already started to respond by rolling back the infected packages to their clean versions. The history of processed packages does not show the malicious version at all, but the fact that it existed can be found in GitHub bulletins. Judging by the fact that there’ve been no new bulletins for five hours at the time of writing, the large-scale incident could be considered over. But given that we’re dealing with a worm, it could start all over again — unless npm blocks the publication of specific malicious files.

Those who managed to download the infected packages are advised to:

  • rollback to safe versions of packages, and clearing the npm cache;
  • audit CI/CD Pipeline and developer computers for unauthorized changes;
  • analyze logs to identify suspicious accesses to npm publish;
  • replace all NPM, GitHub, AWS, GCP and Azure keys and tokens that were available in the affected environment.

Kaspersky solutions detect this threat with the verdict Worm.Script.Shulud.*. The most complete list of affected packages can be found on GitHub.

Kaspersky official blog – ​Read More

ANY.RUN & Palo Alto Networks Cortex XSOAR: Streamline SOC Workflows for Top Performance 

/in

Swamped by incident alerts, Security Operations Centers (SOCs) struggle to quickly identify and prioritize high-risk attacks, leaving critical infrastructure exposed to ransomware and data theft. ANY.RUN’s integration with Palo Alto Networks Cortex XSOAR solves this by automating proactive sandbox analysis and threat intelligence correlation to beat alert fatigue, boost detection rates, and accelerate security workflows. 

ANY.RUN & Palo Alto Networks Cortex XSOAR Integration 

Security Operations Centers (SOCs) using Palo Alto Networks Cortex XSOAR can now seamlessly integrate ANY.RUN’s products into their workflows.  

The ANY.RUN content pack includes connectors for the Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds, empowering SOCs to streamline alert triage, broaden threat detection, and improve identification of elusive malware. 

Set up the integration in your workspace → 

With the ANY.RUN content pack, organizations can: 

  • Detect evasive threats faster with automated sandbox analysis for stronger protection. 
  • Prevent attacks proactively using real-time threat data to reduce breach risks. 
  • Clarify incidents with enriched threat context for quicker, more accurate response. 
  • Reduce alert overload by automating analysis and response, saving SOC time. 
  • Ensure compliance with secure, private workflows for safe operations. 
  • Strengthen security posture by integrating sandboxing, threat data, and XSOAR automation. 

Integrate ANY.RUN’s products for stronger proactive security
Request a quote or demo for your SOC 



Contact us


Interactive Sandbox in Palo Alto Networks Cortex XSOAR 

File analysis with ANY.RUN’s Interactive Sandbox inside Cortex XSOAR 

ANY.RUN’s Interactive Sandbox is a cloud-based solution offering SOC teams immediate, real-time access to Windows, Linux, and Android virtual environments for analyzing suspicious files and URLs. 

Read documentation → 

With the ANY.RUN’s Interactive Sandbox in Cortex XSOAR, users can: 

  • Submit a file, remote file, or URL for analysis across Windows, Ubuntu, or Android operating systems. 
  • Retrieve detailed report details and IOCs for a specific analysis in JSON, HTML. 
  • Download file submission samples and analysis network traffic dumps for deeper incident response insights. 

Benefits of the Interactive Sandbox in Palo Alto Networks Cortex XSOAR 

  • Higher detection rate: Automated Interactivity ensures even evasive attacks are fully detonated and identified.  
  • Faster incident resolution: Quick insights accelerate response to critical threats.  
  • Reduced alert fatigue: Focus only on severe incidents, while the sandbox identifies.  

Threat Intelligence Feeds in Palo Alto Networks Cortex XSOAR 

A malicious indicator from TI Feeds displayed inside Cortex XSOAR 

ANY.RUN’s Threat Intelligence Feeds empower SOCs and MSSPs to strengthen security with high-fidelity, actionable IOCs from real-time sandbox analysis. New indicators are continuously added to TI Feeds from sandbox investigations across 15,000+ organizations after filtering. This means you get a curated stream of malicious IPs, domains, and URLs that have been active for no more than several hours and can still be used to detect attacks that are happening right now.  

Read documentation → 

With ANY.RUN’s Threat Intelligence Feeds in Cortex XSOAR, users can: 

  • Correlate feed data with incoming alerts to identify high-risk threats. 
  • Use indicators to create new detection rules for proactive threat mitigation. 
  • Automate threat hunting and response workflows using XSOAR playbooks. 

Benefits of Threat Intelligence Feeds in Palo Alto Networks Cortex XSOAR: 

  • Expanded threat coverage: Real-time IOCs from 15,000+ organizations catch diverse threats.  
  • Enhanced threat prioritization: Correlating alerts with IOCs highlights critical risks.  
  • Proactive attack prevention: Fresh intelligence enables early threat detection. 

Threat Intelligence Lookup in Palo Alto Networks Cortex XSOAR 

TI Lookup delivers instant context on over 40 types of indicators of malicious activity 

ANY.RUN’s Threat Intelligence Lookup offers a searchable database of up-to-date IOCs, IOBs, and IOAs, drawn from real-time sandbox analysis of active malware and phishing attacks across 15,000+ organizations (Learn more about TI Lookup’s capabilities). This ensures fresh, actionable threat data is available swiftly post-attack.  

Read documentation → 

With the ANY.RUN’s Threat Intelligence Lookup in Cortex XSOAR, users can: 

  • Perform deep searches for IOCs, IOAs, and IOBs to uncover detailed threat intelligence. 
  • Enrich incident investigations with extensive context on threats. 
  • Search threat info by parameters like threat level, OS, or submission country for targeted investigations. 

Benefits of Threat Intelligence Lookup in Palo Alto Networks Cortex XSOAR 

  • Greater incident clarity: Rich threat data provides precise attack context.  
  • Broader threat insight: Detailed IOC/IOA/IOB analysis expands attack understanding.  
  • Enhanced threat hunting: Targeted searches help identify hidden threats effectively. 

About ANY.RUN  

Trusted by over 500,000 cybersecurity professionals and 15,000+ organizations in finance, healthcare, manufacturing, and other critical industries, ANY.RUN helps security teams investigate threats faster and with greater accuracy.  

Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, watch behavior as it unfolds, and make confident, well-informed decisions.  

Our Threat Intelligence Lookup and Threat Intelligence Feeds strengthen detection by providing the context your team needs to anticipate and stop today’s most advanced attacks.  

Ready to see the difference? Start your 14-day trial of ANY.RUN today →  

The post ANY.RUN & Palo Alto Networks Cortex XSOAR: Streamline SOC Workflows for Top Performance  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass

/in

UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal

WeLiveSecurity – ​Read More

Are cybercriminals hacking your systems – or just logging in?

/in

As bad actors often simply waltz through companies’ digital front doors with a key, here’s how to keep your own door firmly locked tight

WeLiveSecurity – ​Read More

Beaches and breaches

/in

Beaches and breaches

Welcome to this week’s edition of the Threat Source newsletter. 

I took a two-week vacation (thanks to Bill for covering my author shift last week) and made the deliberate choice to leave my laptop behind. No emails, IMs, no IT at all. Thank you, European work culture! It was a complete break. 

Well, almost. 

The weather didn’t always cooperate, so instead of freezing on a beach, I found myself catching up on TV — mostly news and a few series. But wherever I clicked, I just couldn’t escape the daily dose of AI. What can we do about invasive mosquitos? Ask AI. Government doesn’t move the needle? Ask AI. Want the weather forecast? AI, obviously. There are countless ads with people asking AI whether or not to wear a jacket “because it might rain.” Even with your favorite TV shows, gone are the days when the hoodied hacker sits in front of a black terminal with green text running a dangerous (haha) ping or nmap. Now, they’re writing lines like, “Did you try breaking the firewall with our latest AI algorithm, bro?” 

Coming back to work and catching up on our industry news, I almost expected AI to be dominating the headlines. But it wasn’t, and neither was ransomware. Instead, they were all about breaches. Many — but not all — reports referenced compromised OAuth tokens linked to Salesloft’s Drift integration, with a notable number of high-profile victims. Sure, this isn’t a scientific or qualitative analysis (ransomware isn’t disappearing anytime soon), but the reporting and the headlines have definitely shifted from one to the other. 

Looking past the buzzwords and catchphrases, the headlines really boiled down to two main themes: supply chain and identity attacks. In a SaaS world, I think it’s time to rethink their definitions and priority levels. 

Why? First, supply chain attacks aren’t limited to hardware or software anymore. We need to consider the datapath (or where data possibly is processed) as a key part of the supply chain. 

Second, identity attacks don’t just target users; interconnected applications are increasingly at risk, too. I’m not saying we can ignore the users, especially with current reporting that it started with access through a GitHub account or software vulnerabilities in our “classic” applications, but we absolutely need to broaden our focus. Last week’s headlines made that clear. 

The one big thing 

Cisco Talos’ latest blog post details the Cyber Threat Intelligence Capability Maturity Model (CTI-CMM), a framework that helps organizations assess and enhance their cyber threat intelligence programs across 11 key domains. By outlining clear maturity levels and improvement cycles, CTI-CMM can help your team benchmark your current capabilities and develop a strategy for continuous (and practical) growth. 

Why do I care? 

Understanding and improving your CTI program’s maturity can help your organization better anticipate, detect, and respond to cyber threats, no matter your budget or staffing level. It also makes the security investments you do have more effective, and ensure your team’s efforts are aligned with business priorities.  

So now what? 

Check out the CTI-CMM framework to assess where your organization stands, identify gaps and opportunities, and create a roadmap to practical improvements for your organization.

Top security headlines of the week 

Huge NPM supply chain attack goes out with whimper 
A supply chain attack involving multiple NPM packages had the potential to be one of the most impactful security incidents in recent memory, but such fears seemingly have proved unrealized. (Dark Reading) 

Swiss Re warns of rate deterioration in cyber insurance 
Increased competition among insurers has led to a third consecutive year of reduced rates, according to the report, as the available supply of cyber coverage has exceeded current demand. (Cybersecurity Dive) 

Critical SAP vulnerability actively exploited by hackers 
A critical security flaw has been found in several SAP products, and could allow a malicious actor to gain administrator-level control. (HackRead)

No gains, just pains: 1.6M fitness phone call recordings exposed 
Sensitive info from hundreds of thousands of gym customers and staff was left sitting in an unencrypted, non-password protected database. Audio recordings spanned from 2020 to 2025. (The Register)

US offers $10M reward for Ukrainian ransomware operator 
Volodymyr Tymoshchuk allegedly hit hundreds of organizations with the LockerGoga, MegaCortex, and Nefilim ransomware families. According to an indictment, the intrusions caused hundreds of millions of dollars in losses. (Security Week)

China accuses Dior’s Shanghai branch of illegal data transfer 
China’s public security authority alleges that Dior’s Shanghai branch has transferred customers’ personal data to its headquarters in France illegally, leading to a data leak in May. (Reuters)

Can’t get enough Talos? 

  • Beers with Talos: How to ruin an APT’s day
    The B-Team is joined by Sara McBroom from Talos’ nation-state threat intelligence and interdiction team. Sara shares her journey from a liberal arts major to tracking some of the world’s most advanced adversaries.
  • Who would sign up to secure a network full of hackers? 
    Our latest video takes you behind-the-scenes at the Black Hat Network Operations Center (NOC) to see how Cisco and SnortML contain the chaos. 
  • Patch Tuesday for Sept 2025 
    In this month’s release, Microsoft observed none of the included vulnerabilities being exploited in the wild. However, there are eight vulnerabilities where exploitation may be likely. 
  • Cisco: 10 years protecting Black Hat 
    Cisco works with other official providers to bring the hardware, software and engineers to build and secure the Black Hat USA network: Arista, Corelight, Lumen, and Palo Alto Networks.

Upcoming events where you can find Talos 

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: 41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610   
MD5: 85bbddc502f7b10871621fd460243fbc    
VirusTotal: https://www.virustotal.com/gui/file/41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610/details
Typical Filename: N/A   
Claimed Product: Self-extracting archive   
Detection Name: Win.Worm.Bitmin-9847045-0 

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
MD5: 2915b3f8b703eb744fc54c81f4a9c67f  
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507   
Typical Filename: VID001.exe  
Claimed Product: N/A  
Detection Name: Win.Worm.Coinminer::1201 

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0  
MD5: 8c69830a50fb85d8a794fa46643493b2   
VirusTotal: https://www.virustotal.com/gui/file/c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0  
Typical Filename: AAct.exe   
Claimed Product: N/A   
Detection Name: PUA.Win.Dropper.Generic::1201  

Cisco Talos Blog – ​Read More

Cybersecurity and privacy in LLM-powered AI browsers | Kaspersky official blog

/in

Whether superintelligent AI arrives by 2027 is anyone’s guess. However, the forecast for 2026 is already clear: the year will be defined by easily accessible AI agents — large multimodal models capable of building and executing a chain of actions based on user commands. Agentic features are already available on the ChatGPT website and from other providers, but achieving maximum performance requires these agents to execute actions directly on the user’s computer rather than in the cloud. The ideal solution would probably be an AI-powered OS, but creating a new operating system is a challenge. Because of this, all minds are focused on a user-friendly and effective alternative: the AI browser. And by that we mean a regular web-browsing application with a deeply integrated LLM. The AI model can view all open web pages, process information from them, and issue the same commands a user typically would, such as opening, clicking, entering data, saving, and downloading.

The market leaders all see the value of this solution. For instance, Perplexity has released its own Comet Browser and recently made a multi-billion-dollar bid to buy Chrome, while OpenAI has started developing its own browser. Google and Microsoft are in a better position, integrating Gemini and Copilot into their existing Chrome and Edge browsers, respectively. Meanwhile, Mozilla is approaching the same goal from a different angle: gradually integrating AI features deeply into its Firefox browser.

As a result, you’re already seeing ads encouraging you to “upgrade your browser” by either downloading the latest version, or activating “smart features” in your current one. Next year, they’ll be wall to wall. The only thing left to decide will be why you need all this, and whether the benefits are worth the emerging risks.

Why you might need an AI browser

An AI assistant perfectly integrated into your browser can free you from many tedious tasks. With the press of a button, you can get a quick summary of a long article or a two-hour video; or instead of reading a lengthy document, you can ask a question about its content. All of this happens quickly and naturally, without the need to copy and paste links or text into a chatbot tab.

But the real breakthrough will come with agentic features: the ability to perform specific actions rather than just process data. For example, you could open your favorite marketplace and tell the assistant to add everything you need for a three-day backpacking trip in August to your cart.

Unlike similar features already available on AI provider websites, this agentic activity takes place directly on your computer. Online services recognize you since you’re already logged in, and operations occur much faster than they would on a cloud virtual machine — though better results aren’t guaranteed.

Information retrieval features can also provide more relevant results in an AI browser running on your device because bots like ChatGPT, Claude, and Perplexity are blocked from many websites. This prevents LLMs from considering many up-to-date sources in their answers. With these features running from within the browser, the problem will be significantly alleviated as the AI assistant will access websites on your behalf. Additionally, if you’re subscribed to any restricted data sources, such as scientific journals or stock market reports, the AI agent will be able to use them as needed.

Why AI companies need such a browser

Some AI solution providers’ motivations they state themselves, while others require educated guesses based on the business models of Big Tech.

Billions of users. Successful entry into the browser market is a ticket to the largest possible user base. Sure, acquiring Chrome, or at least Firefox, would be ideal, but failing that, tech players can always push their own browser high up the popularity ladder.

“Stickiness”. A service that’s built directly into the browser will see more frequent use because it’s always within easy reach. Besides, it’s harder to switch from a familiar browser: it takes significant effort to migrate bookmarks and extensions to another browser and set it up. This is way more than simply closing one chat tab and opening another.

More information. If there are many users, and they access the service frequently, they feed the AI provider more information, allowing new versions of language models to be trained faster, helping to improve the product. A browser has access to all user web traffic, so training can be done on any website data — not just on conversations with the model.

New training methods. The provider gains a gold mine of behavioral data. Currently, AI agents work by looking at web pages and figuring out what button to press. This is similar to how humans think out loud: it’s a slow and not very efficient process. Training on mouse movements and clicks will allow for a completely new layer in the model, resembling motor memory which, just like in humans, will be faster and more efficient.

Sufficiently bold providers could even utilize user files on the computer for training. Newer versions of Facebook are already doing something similar by sending unpublished photos from the user’s phone gallery to the cloud.

Lower costs. AI providers’ enormous server costs would decrease because some of the work would be done directly on the user’s computer instead of on a virtual machine in the cloud.

Bypassing blocks and paywalls. AI model training is already facing a shortage of new information, with the problem exacerbated by many websites blocking access to AI agents. Cloudflare, which protects one in five websites, including the vast majority of larger ones, has enabled this policy by default. Sending data requests from the user’s computer addresses these challenges: the AI agent’s activity is indistinguishable from the computer owner’s.

A distributed network of browsers makes it possible to access websites for things like model training, without running into restrictions. In principle, this also allows downloading publicly unavailable data, such as articles in subscription-based journals.

Impact on privacy and confidentiality

All of this means that an AI browser creates significant, poorly controlled threats to your privacy. AI companies get access to all of your traffic, your entire web history, the full content of those websites, and all the files on your computer.

As a result, you might unintentionally feed deeply personal or restricted data — like books you purchased, or unpublished scientific papers — into a publicly available AI system. You could also accidentally leak highly confidential information from work websites, such as draft financial reports, in-progress designs, or other trade secrets.

This isn’t some sci-fi scenario: in 2023, ChatGPT mistakenly revealed snippets of users’ chats, and the “share chat” feature — available to ChatGPT users until July 31, 2025 — resulted in tens of thousands of user conversations being indexed by search engines and made available to anyone.

What makes AI-powered browsers a security risk

Incidents involving AI applications are becoming commonplace, and paint a worrying picture.

In a recent experiment, researchers successfully tricked an AI agent within the Comet browser into downloading malware onto its owner’s computer. They did this by sending a fake email to the victim’s account, which the agent could access, stating falsely that it contained blood test results. To download them, the user had to click a link and complete a CAPTCHA. When the AI agent tried to download the results and encountered a CAPTCHA, it was prompted to complete a special task, which the agent “successfully” handled by downloading a malicious file.

In another experiment by the same team, an AI assistant was persuaded to buy products from a scam site. Considering that passwords and payment information are often saved in browsers, deceiving an AI agent could lead to real financial losses.

The researchers noted that AI is highly susceptible to social engineering, and tried-and-true human deception tricks work well on it. While the tests were conducted in the Comet browser, the same thing would happen in any browser with AI agent capabilities.

Another risk is that a browser is a fully featured application with broad access to files on the computer. By obeying a prompt injection on a malicious site, a browser assistant can delete the user’s files, or upload them to fraudulent websites without permission. A recent example involving the hack of the Nx application demonstrated this: the malicious code didn’t search for crypto wallets or passwords on infected developers’ computers itself; instead, it simply instructed previously installed AI assistants to find the files it needed.

A third, still hypothetical, risk is related to the fact that more and more countries are passing laws against accessing illegal information online. The list of what’s forbidden differs from country to country, from child sexual abuse and terrorism to unlicensed books and cryptographic technology. If some players in the AI browser market decide to use their browser as a crawler (search bot) to train new LLMs, or if an AI agent is attacked with a prompt injection, the AI assistant could start searching for such information without the user’s request. How the user would prove that it was the AI looking for the data is an open question.

We also shouldn’t forget about traditional software vulnerabilities. Hundreds of dangerous defects are found in browsers every year because browser security is a complex engineering task. Even with the Chromium team doing the lion’s share of the work, there’s still plenty for wrapper developers to do. Will enough attention be paid to testing and fixing vulnerabilities in AI-powered browsers? It’s not a given.

Finally, sloppy implementation of AI features can lead to excessive memory and CPU consumption, as demonstrated by the recent release of Firefox 141. While this doesn’t directly threaten security, the lags and glitches annoy users and increase the chance of human error.

What makes for an ideal AI browser

To enjoy the benefits of AI without creating unnecessary risks, you should choose a browser that:

  • Allows you to enable and disable AI processing with a single click for individual sites and groups of sites, while isolating AI models and their conversation context between different sites.
  • Guarantees that the AI only downloads and sends information based on specific user requests.
  • Lets you choose the AI model, including a fully local one.
  • Performs self-checks, and isn’t afraid to double-check with the user in questionable situations.
  • Asks for confirmation before entering sensitive data or making purchases.
  • Has built-in, OS-level restrictions on access to files and data.

No such browser with these specific features currently exists on the market. Also, all of these measures won’t suffice to protect you from phishing and scam sites and the risks associated with landing on them. So, in addition to a smart browser, it’ll be even more imperative to have an external system in place to deliver full-fledged protection of your computer and smartphone from cyberthreats.

Read about other AI-related risks:

Kaspersky official blog – ​Read More

Maturing the cyber threat intelligence program

/in
  • The Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) helps organizations assess and improve their threat intelligence programs by outlining 11 key areas and specific missions where CTI can support decision-making. 
  • The model describes four levels of maturity, guiding teams from basic, ad hoc activities to highly strategic and refined practices through a cycle of continuous improvement. 
  • CTI-CMM builds on earlier capability models and research, offering a practical framework for organizations to benchmark and evolve their CTI efforts. 

Overview 

Maturing the cyber threat intelligence program

The familiar idiom “walk before you run” summarizes a fundamental truth about skill acquisition: you must master certain foundational capabilities before you can successfully execute more complex activities. This principle applies universally, from learning a new sport to developing highly specialized technical skills. Any area will have foundational skills, activities that anyone competent in the domain can perform, and characteristics that show that an individual (or team) has reached the highest levels of mastery. 

Capability maturity models (CMMs) outline the hierarchy of skills and activities that may be required within a particular area. The capabilities and characteristics are listed for teams of different levels of maturity operating within a domain. These descriptions can be used to evaluate the current level of a team or to identify the capabilities that must be acquired in order to improve. 

Despite its importance, the exact function of cyber threat intelligence (CTI) can vary widely across organizations. The community-developed  Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) shows how threat intelligence can help an organization and the various levels of capability that cyber threat intelligence teams can achieve. 

Details 

The CTI-CMM lists 11 domains where CTI can greatly improve decision-making,  and also details specific “missions” CTI can carry out to strengthen each domain. 

Domain 

Abridged Description 

Example CTI Mission 

Asset, Change and Configuration Management 

Manage the organization’s IT and OT assets. 

Rapidly detect at-risk assets. 

Threat and Vulnerability Management 

Detect, identify, analyze, manage, and respond to cybersecurity threats and vulnerabilities. 

Reduce risk against new and emerging adversaries, malware, vulnerabilities, and exploits. 

Risk Management 

Identify, analyze and respond to cyber 

risk the organization is subject to. 

Improve risk decisions. 

Identity and Access Management 

Manage identities for entities that may be 

granted logical or physical access to the organization’s assets. 

Reduce incident detection times, accelerate remediation. 

Situational Awareness 

Establish situational 

awareness for operational state and cybersecurity state. 

Drive threat-informed decision-making based on the current and forecast threat landscape. 

Event and Incident Response, Continuity of Operations 

Respond to, and recover from cybersecurity events and incidents. 

Create an intelligence 

advantage for incident responders and strengthen the security posture. 

Third-Party Risk Management 

Manage the cyber risks arising from suppliers and other third parties 

Monitor, detect, assess and mitigate potential incidents posed by third-party vendors and suppliers. 

Fraud and Abuse Management 

Shield organizations from malicious digital scams and attacks. 

Share threats 

and findings with relevant stakeholders. 

Workforce Management 

Create a culture of cybersecurity 

and security competence. 

Support hardening of the human element. 

Cybersecurity Architecture 

Maintain the structure and behavior of the organization’s cybersecurity architecture. 

Provide insights into cyber threats that may 

target the organization. 

Cybersecurity Program Management 

Provides governance, strategic planning and sponsorship for the organization’s cybersecurity activities. 

Deliver tailored intelligence inputs to 

inform cybersecurity decision-making. 

The missions span a wide spectrum, from proactively monitoring an organization’s attack surface in support of asset management to providing crucial situational awareness of the evolving threat landscape and its direct relevance to organizational activities. 

The CTI-CMM also defines distinct levels of maturity for threat intelligence activities, providing a clear progression path: 

Level 

Characteristics 

CTI0 (Pre-Foundational) 

A placeholder for practices that are not executed. 

CTI1 (Foundational) 

Many threat intelligence activities begin here, characterized by basic, ad hoc and unplanned efforts focused on short-term, reactive results. 

CTI2 (Advanced) 

As an activity matures, it becomes planned, with documented procedures and metrics demonstrating its support for stakeholders. The focus shifts towards proactive and predictive intelligence, delivering short- and intermediate-term results. 

CTI3 (Leading) 

At the highest level, activities are highly refined, focusing on delivering long-term strategic outcomes for the business. This level integrates prescriptive intelligence and recommendations, combined with continuous improvement practices, making practices measurable and aligned directly to business objectives. 

The framework espouses an improvement process analogous to the “plan, do, check, act” management model. In this case, the steps within a cycle of improvement are “prepare, assess, plan, deploy, measure.” With each rotation through the cycle, the capabilities of the threat intelligence program are incrementally improved, growing the maturity of the program. 

Maturing the cyber threat intelligence program

History of CTI-CMM 

This approach to improving capabilities and benchmarking against defined standards is not new. CMMs originated in the mid-1980s, driven by the U.S. Department of Defense’s desire to compare and evaluate software contractors. Largely thanks to the efforts of the Software Engineering Institute (SEI) at Carnegie Mellon University, CMMs evolved into the widely-applied Capability Maturity Model Integration (CMMI). 

The CTI-CMM adopts domains from the Cybersecurity Capability Maturity Model (C2M2), developed by the U.S. energy industry and first published in 2012. While the C2M2 acknowledged the importance of threat intelligence as a concept within overall cybersecurity posture, it did not specifically address the maturity of a dedicated threat intelligence program. However, the very first paper describing a maturity model for threat intelligence was published in the same year by the industry vendor Verisign. Thus, the origins of the CTI-CMM can be traced back to these two initiatives of the early 2010s. 

Closing 

It’s crucial for organizations to understand that aspiring to the highest level of CTI maturity is not always a practical goal. The intelligence program should focus on meeting the real needs of its users and stakeholders rather than seeking to hit a high score on an industry framework. An intelligence team with more resources may produce “better” intelligence and be more responsive. However, in a world of finite resources, those additional resources may be better spent in delivering “good enough” intelligence to teams that can use it well, rather than delivering the best intelligence to teams without the capacity or resources to effectively utilize the information. 

Ultimately, the Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) provides an invaluable resource for organizations to assess and evolve their CTI capabilities. As threat intelligence solidifies its role as an indispensable component of cybersecurity strategy, maturity models tools will become not only the drivers for internal organizational growth but also key instruments for external entities to benchmark and compare organizations’ overall cybersecurity maturity.

Cisco Talos Blog – ​Read More

Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know 

/in

The Lazarus Group, North Korea’s state-sponsored hacking collective, has held the title of the most notorious advanced persistent threat (APT) for almost two decades now. In 2025, it escalated its cyber operations, targeting tech industries with fake IT workers, fraudulent job interviews, and hijacked open-source software.  

It’s time to take a closer look at its current activities and see how SOC teams can proactively detect and track the group attacks using ANY.RUN’s solutions. 

Biggest Lazarus Group Campaigns So Far 

Lazarus’s 2025 campaigns combine sophisticated social engineering and supply chain attacks, posing severe risks to businesses’ financial stability, data security, and operational continuity. 

North Korean IT Workers 

Since 2024, Lazarus Group has been deploying North Korean operatives posing as legitimate remote IT workers to infiltrate companies, particularly in the U.S. and UK. Using stolen or AI-enhanced identities, these operatives secure tech roles to steal sensitive data, deploy malware, or generate illicit revenue for North Korea. 

According to the U.S. Department of Justice, these schemes compromised over 100 U.S. companies, including Fortune 500 firms. For example, an Atlanta-based blockchain company lost over $900,000 in virtual currency due to insider access by fake IT workers. 

Beyond financial losses, businesses face reputational damage, loss of intellectual property, and regulatory scrutiny for hiring vulnerabilities. Extortion attempts, where operatives hold stolen data hostage, further disrupt operations and erode customer trust. 

Operation 99: Fake Job Interviews (Contagious Interview) 

Operation 99 (aka “Contagious Interview”) is a campaign from Lazarus and its subgroups like Famous Chollima that targets tech, crypto developers and CEOs, with fake job and partnership interviews.  

Posing as recruiters on LinkedIn, Telegram, or Calendly, Lazarus lures victims with fraudulent coding tests hosted on malicious GitLab repositories. As part of the scheme, Lazarus hackers utilize NPM packages.  

For C-suite targets, criminals typically share fake Zoom executables and malware disguised as other software widely used in corporate environments. 

Example of a fake job proposal from a Lazarus operative. Source: Mauro Eldritch, Bitso Quetzal Team’s Medium 

The common losses for victims include stolen cryptocurrency and credentials, compromised systems, and disrupted operations. In some cases, device infections led to downstream supply chain attacks, affecting customers and partners. Crypto and tech firms rely on skilled developers, making them prime targets for social engineering. These attacks disrupt product development, expose proprietary code, and undermine trust in hiring processes, while recovery costs (e.g., system remediation, legal fees) strain budgets. 

Hijacking Open Source Packages 

Despite doing it since September 2024, Lazarus Group continues to embed malicious backdoors in cloned open-source software packages on repositories like GitHub and PyPI, targeting developers in both medium and large enterprises. Over 230 malicious packages have been identified since the start of 2025, affecting 36,000 firms in Europe, India, and Brazil.  

Victims face losses from stolen credentials, authentication tokens, and system data, with recovery costs exceeding millions. Open-source software is critical to tech and crypto industries.  

Given that many IT companies work in tight cooperation, a successful attack on an endpoint at one firm can lead to major incidents in other businesses down the supply chain. A notable example here is the $1.5 billion ByBit hack orchestrated by Lazarus. 

The initial compromise occurred on a developer’s machine at Safe{Wallet}, a multisignature provider used by ByBit, through a malicious Docker project. From there, the attackers gained access to Safe{Wallet}’s Amazon Web Services (AWS) S3 bucket and managed to push a malicious script to the system. This resulted in ByBit’s transaction being hijacked and the funds funneled to a wallet controlled by Lazarus Group. 

Current Lazarus Malware Threats and How to Detect Them 

Lazarus’s 2025 operations leverage advanced malware and TTPs, tailored to maximize damage to businesses through data theft, system compromise, and financial extortion. 

To detect such attacks early, SOC teams require a reliable solution for proactive analysis of suspicious files and URLs. ANY.RUN’s Interactive Sandbox provides a fast, isolated, and hands-on way to expose malware and phishing in seconds.  

Let’s take a look at several examples of malware families employed by Lazarus Group in their attacks and see how sandboxing simplifies their identification. 

☝ How Interactive Sandbox boosts SOCs
  • Higher detection rate with deep insights into threat behavior.
  • Shorter MTTR with fast identification of malware and detailed reports for informed mitigation.
  • Reduced manual effort with analysis automation.

InvisibleFerret 

InvisibleFerret is a modular malware often deployed by Lazarus hackers via fake job interviews, capable of keylogging, screen capturing, and establishing persistent C2 connections to steal sensitive data. 

Read technical analysis of InvisibleFerret 

Analysis of an InvisibleFerret sample inside ANY.RUN’s Interactive Sandbox 

InvisibleFerret compromises developer endpoints, exposing proprietary code and client data.  

ANY.RUN highlights malicious actions of InvisibleFerret on the system 

As shown in a sandbox analysis session, the malware engages in several activities on an infected system, such as attempting to connect to an unusual port. In a business setting, armed with this knowledge, SOCs can act proactively and prevent the incident, keeping the network safe. 

Boost detection rate of evasive malware and phishing
Analyze threats inside a fully interactive sandbox   



Get started


OtterCookie 

OtterCookie is a malware which is often embedded in hijacked open-source packages. It is used as part of the Contagious Interview campaign to extract authentication tokens, session data, and crypto wallets. Stolen tokens allow attackers to bypass authentication, access corporate systems, or customer accounts. 

Read technical analysis of OtterCookie 

OtterCookie malware analysis inside ANY.RUN’s Interactive Sandbox 

Thanks to the analysis inside ANY.RUN’s Interactive Sandbox, we can observe the entire attack chain for this malware. 

OtterCookie payload being downloaded from an external server 

The sandbox session shows that attackers use a fake error and a try/catch block to download and run a piece of malicious code responsible for deploying OtterCookie on the system. This is an evasion technique which may escape detection by signature-based solutions.  

With ANY.RUN’s advanced threat tracking, we get notified about the malicious activity and can stop the attack early, keeping our company’s infrastructure secure and free from disruptions. 

PyLangGhost RAT 

PyLangGhost is a relatively new remote access trojan from Lazarus APT. Delivered via fake interviews or malicious packages, it enables long-term espionage and data theft, compromising trade secrets and customer data. As a result of its activities, businesses may face prolonged downtime during remediation and regulatory fines for data breaches. 

Read technical analysis of OtterCookie 

A fake error, prompting the user to run a command. Source: BlockOSINT 

The malware has been observed in attacks involving the use of the ClickFix tactic, a trick that presents victims with a fake page instructing them to run a malicious script on their system as a way to solve an error or verify their identity.  

ANY.RUN’s Interactive Sandbox lets analysts run the malicious script to ensure full detection

In the case of PyLangGhost, users were often asked to paste and run a command on their computer to fix an issue with their camera. Using the interactivity of ANY.RUN’s sandbox, we can manually perform these actions in an isolated, cloud-based virtual environment to trigger the threat’s execution. The result is a malware being installed on the system, as you can see in the analysis. 

ANY.RUN’s Interactive Sandbox detects PyLangGhost and its activities in seconds 

The sandbox marks the processes spawned by the threat as malicious, providing analysts with a definitive and actionable verdict for instant incident resolution. 

ANY.RUN’s Interactive Sandbox collects and displays all IOCs collected during analysis 

Once the investigation is over, we can collect the indicators of compromise (IOCs) gathered by ANY.RUN and use them to create detection rules to spot future attacks in advance. 

How to Identify and Track Lazarus Attacks with Threat Intelligence 

To keep up with the evolution of Lazarus Group’s attacks, we can utilize ANY.RUN’s Threat Intelligence Lookup. It is a free-access database of the latest indicators of compromise, behavior (IOBs), and attack (IOAs). This data is extracted from live sandbox analyses of active malware and phishing attacks across 15,000 SOCs, ensuring the indicators are fresh and available quickly after an attack. 

To see examples of Lazarus Group’s recent attacks, we can start with a simple query: 
threatName:”lazarus” 

TI Lookup provides fresh sandbox reports on Lazarus attacks 

The service provides us with a list of sandbox sessions with threats attributed to the Lazarus APT. This provides us with rich context about the current malware families, TTPs, and campaigns run by the group. For example, as visible from a report from August 17, the OtterCookie malware is still in use.  

Suricata IDS rule identifying OtterCookie triggered inside ANY.RUN’s Interactive Sandbox 

We can dive deeper into each report to collect actionable indicators for detection rules and see what threats the North Korean hackers are using right now. 

Enrich investigations with live attack data 

from threat analyses across 15K SOCs    



Try TI Lookup free


With TI Lookup, SOC teams can: 

  • Accelerated Response: Reduce MTTR by quickly understanding threat behavior, objectives, and targets through sandbox analysis.  
  • Enriched Threat Investigations: Gain deeper insight into threats by connecting existing artifacts with real-world attacks.  
  • Stronger Proactive Defense: Gather intelligence on emerging threats to act before they cause damage.  
  • Improved Detection Rules: Leverage intelligence from TI Lookup to refine SIEM, IDS/IPS, and EDR rules for stronger proactive defense.  

About ANY.RUN 

Over 500,000 cybersecurity professionals and 15,000+ companies in finance, manufacturing, healthcare, and other sectors rely on ANY.RUN to streamline malware investigations worldwide.  

Speed up triage and response by detonating suspicious files in ANY.RUN’s Interactive Sandbox, observing malicious behavior in real time, and gathering insights for faster, more confident security decisions. Paired with Threat Intelligence Lookup and Threat Intelligence Feeds, it provides actionable data on cyberattacks to improve detection and deepen your understanding of evolving threats.  

Explore more ANY.RUN’s capabilities during 14-day trial→ 

The post Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More