Top 10 last week's threats by uploads 🌐
⬆️ #Xworm 1044 (641)
⬆️ #Lumma 479 (476)
⬆️ #Asyncrat 398 (275)
⬇️ #Quasar 371 (390)
⬆️ #Vidar 370 (292)
⬆️ #Remcos 318 (271)
⬆️ #Stealc 282 (174)
⬆️ #Agenttesla 193 (167)
⬆️ #Guloader 176 (171)
⬇️ #Smoke 160 (164)

👉 Explore malware in action
#Top10Malware

🚨 RondoDox botnet exploits 56 vulnerabilities across 30+ vendors to compromise routers, DVRs & enterprise systems.

Uncover RondoDox "exploit shotgun" strategy.
👉 Dive into detection, prevention, & TI tips

Phishing activity in the past 7 days 🐟
👉 Track latest phishing threats in TI Lookup

#TopPhishingThreats

🧭 Drowning in phishing alerts, a healthcare MSSP turned things around with #ANYRUN.
Outcome: triage time cut by 76%

See how our sandbox and TI reshaped their workflow, in the SOC leader’s own words.
👉 Read the success story

⚠️ Gunra is a fast-growing ransomware using Conti-based code and double extortion.

It targets Windows/Linux systems in healthcare, manufacturing, and other sectors worldwide, deletes recovery options, and encrypts data across entire networks.

👾 View Gunra sample analysis
📚 Read the full breakdown

⚠️ Supply chain attacks stay stealthy and disruptive. This DHL impersonation case showed HTML attachments slipping past filters and credential theft via a third-party form service.

📚 Explore the case against the energy sector.

⚠️ Rundll32, certutil, mshta; attackers abuse them to load payloads without raising alerts.

Security teams using real-time analysis expose these LOLBin tactics fast.

👉 Learn how to achieve it inside your SOC

⚠️ Just one email targeting a US state agency exposed a full FormBook infection chain. Spoofed headers, failed SPF checks, and C2 activity become visible in seconds.

👨‍💻 See how attacks on government institutions were uncovered and analyzed using #ANYRUN. Read now

⏱️ Can a full phishing chain really be analyzed in ~60 seconds?

See our new breakdown on sandbox vs. manual workflows and how analysts get to the verdict faster.

👉 Learn how you can speed up detection in your SOC

🚨 JSGuLdr: Multi-Stage Loader Delivering PhantomStealer

TL;DR: We identified JSGuLdr, a multi-stage JavaScript-to-PowerShell loader used to deliver PhantomStealer. A JScript file triggers PowerShell through an Explorer COM call, pulls the second stage from %APPDATA%\Registreri62, then uses Net.WebClient to fetch an encrypted payload from Google Drive into %APPDATA%\Autorise131[.]Tel. The payload is decoded in memory and loaded, with PhantomStealer injected into msiexec.exe.

⚠️ The chain combines obfuscation, cloud-hosted payloads, COM-based execution, and fileless in-memory loading, making it difficult to detect with automated or static detection solutions.

Execution chain: wscript.exe ➡️ explorer.exe (svchost.exe) ➡️ explorer.exe (COM) ➡️ powershell.exe ➡️ msiexec.exe
👨‍💻 See analysis session

Stage 1️⃣: The sample is an obfuscated JScript script signed with a fake Authenticode certificate to bypass trust checks. It builds an encrypted PowerShell string and writes it to %APPDATA%\Registreri62, forming the second stage.

Through Shell.Application and Explorer COM interaction, the script launches powershell.exe under explorer.exe, masking the execution chain as normal user activity.

🎯 TTPs: Obfuscation (T1027), Signed binary proxy execution (T1553.006), COM interaction (T1559.001), Proxy execution via explorer.exe (T1218)

Stage 2️⃣: The PowerShell code decodes and runs %APPDATA%\Registreri62, reconstructing hidden commands (iex) and loading a new payload from Google Drive. The file is saved as an encrypted container for the third stage.

🎯 TTPs: Encrypted payload download (T1105), Cloud storage abuse (T1105), Local file staging (T1074.001)

Stage 3️⃣: Autorise131[.]Tel acts as an on-disk container for an in-memory payload.
The same PowerShell process decodes it, extracts bytes, and executes the result through Invoke-Expression, running PhantomStealer filelessly in memory.

The payload is injected into msiexec.exe, enabling PhantomStealer to steal data.

🎯 TTPs: Fileless execution (T1059.001), Reflective .NET module loading (T1620), Process injection (T1055), Proxy execution via msiexec.exe (T1218.007)

🔍 Track similar activity and pivot from IOCs using this TI Lookup search query

#IOCs:
URL: hxxps://drive[.]google[.]com/uc?export=download&id=1gUB_fKBej5Va_l3ZSEXk_7r5Q4EeJuwd
Files: %APPDATA%\Registreri62, %APPDATA%\Autorise131[.]Tel
CMD: powershell.exe "$Citize=$env:appdata+'\Registreri62';$Guazuma=gc $Citize;$Aristape=$Guazuma[4460..4462] -join ''"

🚀 Gain fast detection and full visibility with #ANYRUN. Sign up
#ExploreWithANYRUN

💡 When alerts overwhelm your SOC, it's time to automate.

#ANYRUN’s Sandbox combines automation with interactivity to detonate multi-stage phishing, beat evasion, and deliver verdicts in seconds.

👉 See how it gives your team a measurable advantage

👨‍💻 How to cut MTTR? 
Get actionable tips in a live webinar on November 25. In this session, our experts will demonstrate how to:   
✅ Reduce MTTR by 21 minutes per incident 
✅ Ensure early detection of new attacks 
✅ Eliminate alert fatigue 
✅ Achieve a 3x performance boost  

Who should join? 
SOC leaders, security managers, CISOs, and analysts of all tiers looking to improve the security posture. 

🎯 Register and bring your team

Top 10 last week's threats by uploads 🌐
⬇️ #Xworm 1042 (1044)
⬆️ #Quasar 413 (371)
⬇️ #Asyncrat 383 (393)
⬇️ #Lumma 370 (479)
⬇️ #Vidar 316 (370)
⬇️ #Stealc 251 (282)
⬇️ #Remcos 249 (314)
⬆️ #Snake 174 (148)
⬇️ #Agenttesla 170 (192)
⬇️ #Guloader 168 (176)

👉 Explore malware in action
#Top10Malware

🚨 Attackers abuse LOLBin to execute payloads without triggering alerts. The real challenge for SOC teams is spotting this behavior early before it escalates into a full incident.

👾 See rundll32 abuse delivering Gh0stRAT exposed in real time.

👉 Read the report to learn how to spot LOLBin abuse techniques with interactive analysis.

📢 Live tomorrow! Join us to discover 3 actionable steps that help SOC teams reduce MTTR and improve security posture. 

In this session, #ANYRUN experts will walk you through how to: 
✅ Reduce MTTR by 21 minutes per incident 
✅ Ensure early detection of new attacks 
✅ Eliminate alert fatigue 
✅ Achieve a 3x performance boost  

Who should join? 
SOC leaders, security managers, CISOs, and analysts of all tiers looking to improve the security posture. 

🎯 Register and bring your team

⚠️ DoubleTrouble is an Android banking trojan leveling up mobile cybercrime with dual-stage attacks.

It uses MFA interception and modular spyware to target European users.

👉 See how it works and learn how to detect & stop it

Phishing activity in the past 7 days 🐟
👉 Track latest phishing threats in TI Lookup

#TopPhishingThreats

🚨 Our new TI Report outlines cross-platform threats that SOCs should track right now:
🔹 BTMOB RAT abuses Accessibility Services to target banking apps
🔹 PDFChampions is delivered through malvertising, a highly effective initial infection vector
🔹 Efimer combines phishing and WordPress exploits to steal credentials

👨‍💻 Read the report, gather IOCs, and see how #ANYRUN helped detect and analyze these threats with deep visibility and unique threat intelligence