Threat Coverage Digest: New Malware Reports and 1,100+ Detection Rules
ANY.RUN's September digest adds 76 behavior signatures, 16 YARA rules, and 1,098 Suricata rules plus TI reports on IronToll and CSuite phishing.
ANY.RUN released its September threat coverage update with 76 new behavior signatures, 16 YARA detections, and 1,098 Suricata rules spanning Windows, Linux, macOS, and Android threats. New network detections include Gh0stRAT inbound TCP C2 activity (SID 84004588), the Wazza device-code-flow phishing kit (SID 84004715), and the Chinese-backed Sailor PhaaS framework (SID 85008428). Two Threat Intelligence Reports cover IronToll, a PhaaS platform impersonating government sites via live-operator WebSocket panels, and CSuite, a multi-stage phishing and remote-access operation targeting US and European organizations.
- 76 behavior signatures, 16 YARA rules, and 1,098 Suricata rules added in September
- TI reports cover IronToll PhaaS and CSuite phishing operations
- Suricata detections added for Gh0stRAT C2, Wazza phishkit, and Sailor PhaaS
- Malware
- Gh0stRAT
From the original article
3 min read at any.run
September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY. RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications.
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.