55
55
30
Phishing Powers 80% of Attacks on US Companies: How SOCs Can Detect It Early
Phishing drives 80% of attacks on US companies; FBI recorded 158,436 BEC victims and over $20B in losses from 2013-2023.
A vendor-authored analysis claims phishing powers roughly 80% of attacks on US companies, citing FBI statistics of 158,436 business email compromise victims and more than $20 billion in reported losses between 2013 and 2023. It describes modern phishing using compromised infrastructure, redirect chains, dynamic pages, and adversary-in-the-middle techniques, including a recent campaign targeting tens of thousands of primarily US users. The piece promotes ANY.RUN Threat Intelligence Feeds and TI Reports, claiming 99% unique high-confidence IOCs, 21-minute faster MTTR, and 30% fewer Tier 2 escalations.
25
60
30
30
30
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.
58
30
30
30
30
30
42
30
55
30
55
30
30
55
42
57
47
Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction
ANY.RUN urges SOC teams and MSSPs to adopt intelligence-driven threat monitoring to reduce mean time to respond.
ANY.RUN published a vendor blog post arguing that threat monitoring is the connective tissue of modern security operations and that SOC teams and MSSPs must move from simple log collection to a proactive, intelligence-driven framework. The piece promotes ANY.RUN's Threat Intelligence offering as the solution for detection engineering and MTTR reduction. It is promotional content rather than a threat disclosure or research finding.
10
57
30
30
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.
Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.
48
Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk
ANY.RUN's August 2026 roundup shows US and EU firms hit via Microsoft 365 session hijacking, remote-tool abuse, and hiring lures.
ANY.RUN's August 2026 review catalogs attacks on US and European businesses abusing Microsoft 365 sessions, legitimate remote-management tools, and business-themed files. Observed techniques included account takeover, session hijacking, persistence via remote access, credential exposure, and exploitation of hiring processes. The report stresses that attacker activity frequently resembled legitimate business behavior.
45
US Finance Under Phishing Pressure: What the SOC Data Reveals?
ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.
ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.
42
North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs
ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.
ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.
50
30
42
60
60
60
30
42