Jump to content

Anomali

From Wikipedia, the free encyclopedia
Anomali Inc.
FormerlyThreatStream (2013–2016)
TypePrivate
IndustryCybersecurity
Founded2013; 13 years ago (2013)[1]
Founders
Headquarters
Redwood City, California
,
United States
Area served
Worldwide
Key people
  • Ahmed Rubaie (CEO)
  • Hugh Njemanze (President)
ProductsAnomali ThreatStream, Anomali Match, Anomali Lens, Security Analytics
Number of employees
201-500
Websiteanomali.com

Anomali Inc. is an American cybersecurity company that develops and provides threat intelligence products.

History

[edit]

Anomali was founded in 2013[2] under the name ThreatStream, by Greg Martin and Colby DeRodeff. The company sold ThreatStream, the eponymous software designed as a threat intelligence platform, to detect and monitor of indicators of compromise and security breaches.[3][4] The company rebranded to its current name in 2016,[5][6] and changed its business model to software as a service (SaaS), where customers upload their logs to Anomali's servers for threat detection and analysis. Anomali matches the uploaded data with previously known indicators of compromise.[7][8][9]

Threat research

[edit]

In January 2019, Anomali uncovered a phishing scam targeting Australian businesses.[10] Hackers would email companies, claim that they had been selected by the Department of Infrastructure and Regional Development to submit a tender for a commercial project, and then require companies to register in the tender portal to continue. The link in the email took businesses to a replica site of the government's AusTender website. The ATR team alerted the government to the scam.[11]

In July 2019, the ATR observed a new ransomware targeting QNAP Network Attached Storage (NAS) devices and named it eCh0raix.[12] A decryptor was released in August.

In December 2019, Anomali published research that said that Gamaredon, a hacking group, had launched attacks targeting Ukrainian military and government agencies, including the Ministry of Foreign Affairs, journalists, law enforcement, and nongovernmental organizations (NGOs).[13] The attacks started in mid-September.

In June 2020, the company identified twelve apps posing as coronavirus contact tracing apps that were designed to steal personal and financial information from Android users.[14][15] Four of the apps used either the Anubis banking malware or the SpyNote Trojan.[16] The apps targeted people in Armenia, Brazil, Colombia, India, Indonesia, Iran, Italy, Kyrgyzstan, Russia and Singapore.[17]

In February 2021, ATR identified a cyberespionage campaign targeting UAE and Kuwait government agencies.[18] The work was attributed to Static Kitten (aka MERCURY and MuddyWater) and the objective was to install the remote management tool ScreenConnect with "unique launch parameters that have custom properties with malware samples and URLs masquerading as the Ministry of Foreign Affairs of Kuwait and the UAE National Council".[19] Static Kitten is a state-sponsored hacking group believed to be working for Iran's Islamic Republic Guard Corps.[20]

In May 2021, the team identified threat actors who were using Microsoft Build Engine (MSBuild) to filelessly deliver remote access trojans and password-stealing malware on targeted Windows systems.[21] The campaign had been active since April, with the attackers using the Microsoft application to load the attack code, thereby avoiding any traces of infection.[22][23] The samples analyzed by Anomali delivered Remcos RAT, Quasar RAT, and RedLine Stealer.[24][25]

In September, ATR identified action from the FIN7 financial cybercrime gang.[26] The gang was delivering JavaScript backdoors using Word documents to steal payment-card data.[26]

See also

[edit]

References

[edit]
  1. ↑ "Cyber-security firm to create 120 jobs". BBC News. 18 May 2017.
  2. ↑ Mishra, Pankaj (20 February 2014). "ThreatStream Raises $4M From Google Ventures To Add Realtime Cybersecurity Intelligence". TechCrunch.
  3. ↑ "Anomali secures $40 million Series D led by Lumia Capital to scale threat detection solution". TechCrunch. 17 January 2018. Retrieved 2022-07-08.
  4. ↑ Lawson, Craig (28 July 2020). "Market Guide for Security Threat Intelligence Products and Services". Gartner. Archived from the original on 2021-06-25.
  5. ↑ Panettieri, Joe. "Managed Security Services Provider (MSSP) News: 26 August 2020". MSSP Alert.
  6. ↑ Kerner, Sean Michael (2016-03-01). "ThreatStream Renames and Refocuses Itself as Anomali". eWEEK. Retrieved 2022-07-21.
  7. ↑ "Anomali secures $40 million Series D led by Lumia Capital to scale threat detection solution". TechCrunch. 17 January 2018. Retrieved 2022-07-29.
  8. ↑ "Anomali Altitude automates detection, analysis, and threat response". Help Net Security. 2019-10-01. Retrieved 2022-07-29.
  9. ↑ Kerner, Sean Michael (2016-03-01). "ThreatStream Renames and Refocuses Itself as Anomali". eWEEK. Retrieved 2022-07-21.
  10. ↑ Powell, Dominic (2019-01-16). "Government warns SMEs of new scam luring businesses into applying for fake tender contracts". SmartCompany. Retrieved 2022-08-17.
  11. ↑ Powell, Dominic (2019-01-16). "Government warns SMEs of new scam luring businesses into applying for fake tender contracts". SmartCompany. Retrieved 2022-08-17.
  12. ↑ "New eCh0raix Ransomware Brute-Forces QNAP NAS Devices". BleepingComputer. Retrieved 2022-08-26.
  13. ↑ "Possible APT attacks against Ukraine expand to target journalists, researchers say". CyberScoop. 2019-12-09. Retrieved 2022-09-01.
  14. ↑ "Fake contact-tracing apps delivering banking trojans". ComputerWeekly.com. Retrieved 2022-09-08.
  15. ↑ "Hackers use fake contact tracing apps in attempt to install banking malware on Android phones". CyberScoop. 2020-06-10. Retrieved 2022-09-08.
  16. ↑ "Hackers use fake contact tracing apps in attempt to install banking malware on Android phones". CyberScoop. 2020-06-10. Retrieved 2022-09-15.
  17. ↑ "Fake contact-tracing apps delivering banking trojans". ComputerWeekly.com. Retrieved 2022-09-15.
  18. ↑ "Iranian Hackers Utilize ScreenConnect to Spy On UAE, Kuwait Government Agencies". The Hacker News. Retrieved 2022-11-14.
  19. ↑ "Iranian Hackers Utilize ScreenConnect to Spy On UAE, Kuwait Government Agencies". The Hacker News. Retrieved 2022-11-14.
  20. ↑ "Iranian Hackers Utilize ScreenConnect to Spy On UAE, Kuwait Government Agencies". The Hacker News. Retrieved 2022-11-14.
  21. ↑ "Hackers Using Microsoft Build Engine to Deliver Malware Filelessly". The Hacker News. Retrieved 2022-11-23.
  22. ↑ "Hackers Using Microsoft Build Engine to Deliver Malware Filelessly". The Hacker News. Retrieved 2022-11-23.
  23. ↑ "Microsoft build tool abused to deliver password-stealing malware". BleepingComputer. Retrieved 2022-11-23.
  24. ↑ "Hackers Using Microsoft Build Engine to Deliver Malware Filelessly". The Hacker News. Retrieved 2022-11-23.
  25. ↑ "Microsoft build tool abused to deliver password-stealing malware". BleepingComputer. Retrieved 2022-11-23.
  26. 1 2 "FIN7 Capitalizes on Windows 11 Release in Latest Gambit". threatpost.com. 3 September 2021. Retrieved 2022-11-23.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Anomali&oldid=1381325436"