Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.
- TI Lookup adds Connections block for pivoting across related domains/IPs/URLs
- Detection update: 81 behavior signatures, 16 YARA rules, 559 Suricata rules
- New reports cover RMM phishing (46 countries), Mirage2FA M365 phishing, OVERLORD RAT
- Mirage2FA: AiTM phishing-as-a-service linked to 9,332 potential compromise events
- Vendors
- ANY.RUN
- Threat actors
- LinX Coders
- Countries
- United States
From the original article
5 min read at any.run
Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY. RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity.
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.