Pinned Tweet
New Windows malware skips the hacker's own server. It asks 4 AI tools what to do next, then votes on the answer. The techniques aren't new. The architecture is, and it closes off one of defenders' best tools. More in this week's Anomali Cyber Watch: bit.ly/4xR7fxc
When an autonomous AI system causes harm, who's accountable? The developer, deployer, and operator can each point elsewhere. Barry Cheevers writes about the gap no framework fills: bit.ly/4B8bR4T #AI #AgenticSOC #GovernedDecisions
Agents inherit whatever data quality you hand them, and they act faster than an analyst would. Our take, plus new Gartner® research on #AI in CTI operations: bit.ly/4zvnNvI #cyberattacks #cybersecurity
Anomali Cyber Watch: A #malware campaign finds its C2 server by reading a poem on GitHub. Edit the poem, and 3,400+ infected AI servers get redirected. 11 times recently. Why IOC blocking alone fails: bit.ly/4ySB8Pa #AI #cybersecurity
Attackers now break out in 29 minutes on average. One breach saw data theft start 4 minutes after entry. Detection tools catch these intrusions. But analysts lose hours assembling context by hand. See where #AI actually closes that gap: bit.ly/3TkWSUf #cybersecurity
NeedyMantis's selectivity is a key signal: seen in few intrusions, it usually appears after initial access. Hunt back to Oct 2025, treat WinSparkle.dll hits as inconclusive, and check the C2 domain and firefox/21.0 user agent. More in Anomali Cyber Watch: bit.ly/3W8IcIE
SIEM ingest runs past $4 per gigabyte. Object storage costs about two cents. That gap is why most teams cut retention as log volume keeps rising. A different architecture keeps years of data searchable without the ingest tax. See how the math works: bit.ly/4xQ6h4r #AI
Malware is getting a brain. 3 groups we're tracking:
🧠 ClosedQuorum queries 4 LLMs and votes on its next move
📱 RatHat uses AI to navigate live Android apps
🐳 Carbonato runs an AI agent on hacked Docker hosts to self-execute tasks
For defenders ➡️ bit.ly/4ANzfVk
Anomali to address the next phase of AI-led cyber defence at GISEC 2026 tahawultech.com/enterprise/a…
Anomali maps 200 extortion crews and finds hospitals in the top three medrisk.io/2026/09/24/anomal… via @MedRiskIO
Most #AI failures don't start with bad code. They start with data nobody checked. Alexandre Depret-Bixio breaks down the one thing missing from most AI deployments right now. #cybersecurity Read here: bit.ly/4wVWrgT
Anomali retweeted
“Security operations centres (SOC) are under growing pressure to process rising volumes of alerts with limited resources”.
Learn more about @Anomali's participation at GISEC 2026 below.
tahawultech.com/enterprise/a…
#Anomali #GISEC2026 #tahawultech
Anomali retweeted
"Security operations centres (SOC) are under growing pressure to process rising volumes of alerts with limited resources".
Learn more about @Anomali's participation at GISEC 2026 below.
tahawultech.com/enterprise/a…
#GISEC2026 #Anomali #tahawultech
Anomali retweeted
🏆 Die Ergebnisse stehen fest: Das sind die Grand Stevie® Award Gewinner der 12. German Stevie® Awards 2026! 🏆
Zwei Organisationen haben die Fachjury in diesem Jahr besonders überzeugt:
🥇 Unternehmen des Jahres: Wolters Kluwer (Deutschland) – mit beeindruckenden 21,5 Punkten und 9 Trophäen (u. a. für KI & Prozessautomatisierung).
⭐ Höchstbewertete Nominierung: Anomali Inc. (USA) – mit einer Jury-Spitzenbewertung von 9,09 für ihre KI-Innovation.
hubs.ly/Q04y6dVP0
#StevieAwards #GermanStevieAwards #BusinessAwards #GrandStevies @anomali
Alert enrichment inside the SIEM runs hours behind the threat. Moving that work upstream fuses context into every event before an analyst or an agent sees it. CISOs are rearchitecting around an intelligence layer. See the six steps behind it: Link: bit.ly/4hw8Cex
No honor among thieves. ShinyHunters breached Clop's own leak site via an unpatched Grav CMS bug, stealing source code, logs, and Clop's Tor private keys. If you paid a ransom, you might not be done yet. Cyber Analyst Barry Cheevers on what it means 🧵👇 bit.ly/3VMKEnW
A bad decision used to take hours to cause damage. Now it takes seconds. Alexandre Depret-Bixio explains why the real risk isn't the mistake. It's the speed. Full story in Channel Post MEA👇
bit.ly/4wVWrgT
This week's ACW: 6 stories, including a DPRK-linked group hitting an Indian IT provider through a fake job interview lure. One to watch: an Android malware strain that pairs with phones' debug tools for shell-level access. See how and why: bit.ly/46EiCxn
