Year in Review by ANY.RUN: Key Threats, Solutions, and Breakthroughs of 2025 

ANY.RUN’s 2025 year in review highlights 5.7M analyses across 195 countries uncovering 1.1M threats, major sandbox advances (Android and Debian VMs, Detonation Actions, AI Sigma Rules), and expanded threat intelligence offerings (TI Lookup free plan, industry/geo threat landscape context, real-time Feeds with STIX/TAXII and ThreatQ integration), along with new SDK and SOAR/QRadar integrations. The team spotlighted notable phishing and mobile malware activity—including Tycoon2FA, Salty 2FA, Salvador Stealer, Pentagon Stealer, Tykit, and a hybrid Salty2FA & Tycoon2FA case—while earning multiple industry awards. Looking ahead to 2026, they plan enhanced SOC collaboration, refined reporting (including auto YARA), enriched sandbox detections with TI data, improved network visibility (SSL decryption without MITM, in-browser inspection), AI-powered analysis, and expanded enterprise VM options with macOS and Windows Server support.