Product

ConnectWise

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 18, 2026 · last 12d ago

Timeline2 articles

Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates

ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.

ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.

ANY.RUNSep 3, 09:11 UTC · 12d agoTools1

More than 200 victims of Medusa ransomware identified over the last year, CISA says

CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.

CISA and the FBI updated their March 2025 advisory, stating Medusa actors had hit more than 500 victims as of April 2026, up from 300 in 2025, with a focus on healthcare and critical infrastructure. The agencies say Medusa rapidly adopts newly announced exploits, sometimes using them up to a week before public vulnerability disclosure, but does not develop its own zero-days, preferring access obtained from unknown sources. The gang moved to an affiliate model in 2023, offers up to $1 million for exclusive initial access brokers, and uses credential stealers plus legitimate remote access tools including AnyDesk, Atera, ConnectWise and Splashtop. No new victims have appeared on its leak site since April, after the shutdown of the University of Mississippi Medical Center drew significant law enforcement attention.

The RecordAug 18, 18:11 UTC · 28d agoRansomware in the wild1

Appears with

threat actor LinX Coders 1 threat actor Medusa 1 malware CRPX0 1 malware Mirage2FA 1 malware OVERLORD RAT 1 malware TRIBACK 1 organization CISA 1 organization FBI 1 organization SafeBreach 1 product AnyDesk 1 product ANY.RUN TI Lookup 1 product Atera 1 product BeyondTrust 1 product eHorus 1 product GoTo Resolve 1 product LogMeIn Rescue 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.