Anomali

Anomali Anomali. Resilience starts here. The fact is these technologies are perfectly capable of detecting and mitigating today’s advanced threats.

SIGN UP / FOLLOW US:

WEB: www.anomali.com
TWITTER: https://twitter.com/Anomali
LINKEDIN: https://www.linkedin.com/company/anomali

Cyber intelligence platform provides enterprise and government organizations with the ability to detect and disrupt cyber adversaries using existing security infrastructure by operationalizing the largest and most diverse set of threat indicators in real-time. Organizations have invested significant resources — people and capital — into security infrastructure, including building and running security operations, global SIEM deployments, and border protection technologies. But they lack visibility into who the adversaries are and which exploitative methods are being used. OPTIC takes a fresh approach. It’s not a new appliance, not a new enterprise software application to deploy. Rather, it’s a simple connection to your existing security devices that transforms their capabilities by providing actionable threat intelligence to enable correlation against known bad actors. Before Optic, new threat intelligence meant more work. Copying IPs from email lists and pulling down threat data with custom scripts was a struggle to maintain and evolve. Configuring your security infrastructure to take advantage of new threat intelligence required even more manual effort. Optic fully automates the distribution of threat indicators across your favorite security products using seamless secure-connector technology and offers a simple REST API to integrate with custom applications. In real-time, OPTIC aggregates and analyzes threat intelligence from hundreds of sources. From open-source intelligence to global honey net sensors farms, social media, and private sources. That’s in addition to the hundreds of organizations that contribute to the OPTIC community. Each individual indicator of compromise is categorized and risk ranked for severity and relevance using data analytics to identify relationships with known threats. A risk score is then assigned to each indicator before it is delivered to your security infrastructure. The most actionable threat intelligence. The most effective enterprise integration. Game-changing community collaboration.

More and more decisions are being handed to AI systems that can act on their own. So what happens when one gets it wrong...
10/15/2026

More and more decisions are being handed to AI systems that can act on their own. So what happens when one gets it wrong?

Right now, the answer is murky. The developer says it worked as designed. The company using it followed the vendor's guidance. The person running it couldn't see how the decision was made. Everyone has an explanation, and no one is clearly responsible.

In this week's Anomali Dispatch, our Cyber Data Analyst Barry Cheevers connects this problem to the UN debate over autonomous weapons, the UK's plans for AI-driven cyber defense, and the new frameworks trying to keep pace. Then he asks a question that goes beyond what limits to put on AI.

Totally worth your time: https://bit.ly/4ymsOWD

Last week's edition tracked the strategic debt nations are accumulating by doing nothing on sovereign AI. This week examines why the doing-nothing keeps happening. We are increasingly delegating consequential decisions to systems whose behaviour we may not fully understand, in contexts we cannot alw...

What if your AI servers are the easiest target in your environment? A new campaign called PoeLLM has infected more tha...
10/13/2026

What if your AI servers are the easiest target in your environment? A new campaign called PoeLLM has infected more than 3,400 servers by going after exposed tools like LiteLLM and Ollama. The way in wasn't sophisticated. It was known security flaws that never made it into regular patching.

The strangest part is how the malware finds its instructions. It reads a poem on GitHub. Change the poem, and every infected server gets sent somewhere new. Attackers did that 11 times without setting up a single new server.

There's also a catch in the fix: two separate vulnerabilities have to be patched, and fixing just one leaves the door open.

Which two? Our threat analyst breaks it down in this week's Anomali Cyber Watch: https://www.anomali.com/blog/anomali-cyber-watch-castlestealer-npm-sdk-supply-chain-risks?utm_source=facebook&utm_medium=social&utm_campaign=anomali-cyber-watch-castlestealer



https://www.anomali.com/blog/anomali-cyber-watch-castlestealer-npm-sdk-supply-chain-risks?utm_source=facebook&utm_medium=social&utm_campaign=anomali-cyber-watch-castlestealer

The average time attackers need to move from first access to a second machine dropped to 29 minutes in 2025, down from 4...
10/12/2026

The average time attackers need to move from first access to a second machine dropped to 29 minutes in 2025, down from 48 the year before. In one breach, data theft began just four minutes after entry. Detection tools usually flag these intrusions. The real delay is what happens next: analysts spending hours pulling context from tools that don't talk to each other. See where AI actually closes that gap: https://bit.ly/4iOL472

Most SIEMs charge more than $4 a gigabyte to ingest logs, while object storage runs about two cents. That pricing gap is...
10/05/2026

Most SIEMs charge more than $4 a gigabyte to ingest logs, while object storage runs about two cents. That pricing gap is why so many security teams quietly shorten retention windows even as log volume keeps growing year over year. When a threat advisory names indicators from months back, a short retention window means teams can't confirm exposure. See how a different model closes that gap: https://bit.ly/4xKSo7s

An agent will not pause when the same host shows up under three different names in three different consoles. A human ana...
09/30/2026

An agent will not pause when the same host shows up under three different names in three different consoles. A human analyst does. That instinct is doing more work in your SOC than anyone has measured, and it doesn’t transfer to an agent. Agents inherit whatever data quality they are handed, and they act on it faster than a person would. Which is why we think the agentic conversation is a data foundation conversation first.

New Gartner® research on AI in cyberthreat intelligence operations is available here, along with our view on what it asks of your data: https://bit.ly/4xMfri3



Source: Gartner, Feeds to Agents: How AI Is Rewiring Cyberthreat Intelligence Operations, Jonathan Nunez, Jaime Anderson, 1 April 2026.

GARTNER is a trademark of Gartner, Inc. and/or its affiliates.

How does new Windows malware use AI instead of a hacker's server?Researchers just documented a Windows implant that skip...
09/29/2026

How does new Windows malware use AI instead of a hacker's server?

Researchers just documented a Windows implant that skips the usual attacker-run server entirely. Instead, it asks a panel of four different commercial AI tools what to do next, and acts on whatever the majority agrees on.

Once it's running, it:
- Steals passwords and cryptocurrency wallet data
- Hides by injecting itself into other programs
- Sticks around after a reboot using built-in Windows features
- Suppresses security logging to slow down anyone investigating

The individual tricks aren't new. What's different is that no one has to be steering it after it's deployed, and there's no hacker-controlled server to shut down to stop it. No one's found this running in the wild yet, but the person who built it has a history on stolen-card forums, which suggests this was made to be used.

Read this story and more in this week's Anomali Cyber Watch: https://bit.ly/4d7LWzZ

SIEMs excel at storing and searching alerts. Adding threat context to those alerts typically still happens by hand, one ...
09/28/2026

SIEMs excel at storing and searching alerts. Adding threat context to those alerts typically still happens by hand, one query at a time, well after the event occurred. An intelligence layer changes the sequence. It normalizes, deduplicates, and fuses intelligence into the data before the SIEM ever ingests it, so triage begins with attribution already attached. CISOs are already redesigning their stacks this way. Here's the six-step blueprint: https://bit.ly/46Kme0U

This week’s Anomali Cyber Watch analyzes 6 threats, including a DPRK-linked group targeting an Indian IT provider throug...
09/22/2026

This week’s Anomali Cyber Watch analyzes 6 threats, including a DPRK-linked group targeting an Indian IT provider through a fake job lure.

One to watch: Android malware that pairs with your phone’s own debug tools to gain shell access. Uninstalling the malware alone doesn’t stop it.

Read the full update to learn more: https://bit.ly/4rz2k2n

Security fragmentation quietly drains revenue, and the cost compounds with each new integration. Some say as much as 5% ...
09/22/2026

Security fragmentation quietly drains revenue, and the cost compounds with each new integration. Some say as much as 5% of annual revenue. We tackle this at the data layer, normalizing sources to and removing duplicates before data reaches the lake, so your team spends more hours hunting threats.

Read all about it: https://bit.ly/4y0BEJW

Would you spot this attack?It starts with a calendar invite. It routes through genuine, trusted infrastructure. And th...
09/16/2026

Would you spot this attack?

It starts with a calendar invite. It routes through genuine, trusted infrastructure. And the fake login page it eventually shows you doesn't even have a real web address, it's built on the fly inside your browser.

Our threat analyst walks through how it works, what's still visible to defenders, and why familiar branding along the way is no guarantee the destination is safe.

Get the full story in this week's Anomali Cyber Watch: https://bit.ly/3ULftcu

Address

Redwood City, CA

Telephone

+16505038265

Website

Alerts

Be the first to know and let us send you an email when Anomali posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Anomali:

Shortcuts

Share

Category