Skip to main content
Beyond Detecting. Start Deciding. Start Acting.

ANOMALI AGENTIC AI

AI agents that investigate, prioritize, and act — grounded in Managed Intelligence as a Service so every decision is trustworthy. Governed autonomy across detection, investigation, and response, with humans in the loop and on the loop.

Request a Demo
Tell me about IP 118.248.255.174
What is cl0p ransomware?
What are the top threats to my organization?
ASK ANOMALI AGENTIC AI
Cl0p is a Ransomware-as-a-Service (RaaS) operation first observed in 2019, known for its advanced anti-analysis and anti-virtual machine detection capabilities. The group rose to prominence in Q2 2023 by automating the exploitation of file transfer vulnerabilities, including MOVEit Transfer and GoAnywhere MFT.  The group has been known to exploit zero-day vulnerabilities, such as the CVE-2023-34362 vulnerability in Progress Software's MOVEit Transfer solution. In this campaign, they used a SQL injection vulnerability to install a web shell called LEMURLOOT, enabling data theft from underlying databases.The IP address 118.248.255.174 is identified as a malicious IP (mal_ip), an APT IP (apt_ip), and a scanning IP (scan_ip) with high confidence levels ranging from 98 to 100. It has been tagged with various sources such as Mandiant, Anomali Adversary Intelligence, and cinsscore:ci-badguys OSINT.   It is located in China and is part of the China Unicom Shandong province network. The IP is associated with the threat actor APT28, known for state-sponsored activities and information theft. Tags related to APT28 include Fancy Bear and Iron Twilight.Cl0p is a Ransomware-as-a-Service (RaaS) operation first observed in 2019, known for its advanced anti-analysis and anti-virtual machine detection capabilities. The group rose to prominence in Q2 2023 by automating the exploitation of file transfer vulnerabilities, including MOVEit Transfer and GoAnywhere MFT.  The group has been known to exploit zero-day vulnerabilities, such as the CVE-2023-34362 vulnerability in Progress Software's MOVEit Transfer solution. In this campaign, they used a SQL injection vulnerability to install a web shell called LEMURLOOT, enabling data theft from underlying databases.The top threats to your organization over the last 30 days include:  Actors: Chaos, FSB, Federal Security Service, Hamas, Laravel, Opsec, Payouts, Scam_Guard, Silent Crow, World Leaks.  Attack Patterns: Application Layer Protocol, Command and Scripting Interpreter, Deobfuscate/Decode Files or Information, Exploitation for Client Execution, Exploitation for Privilege Escalation, Impair Defenses: Disable or Modify Tools, Ingress Tool Transfer, Masquerading, System Information Discovery, Valid Accounts.  |

Why ThreatStream Next-Gen

‍

Why Anomali Agentic AI

300x Faster detection and investigation

Analysts pivot across years of data and intelligence in seconds.

96% Reduced time for threat investigations

Context-driven prioritization reduces false positives and alert fatigue.

50% analyst time saved with operationAlized intel

Threat intel informs every stage of the SOC workflow, not just reports.

60% reduced siem bill and operational cost

Eliminate SIEM tax and manual effort while scaling data retention.

Built for Security Decisions – Not Just Automation

Most AI security tools automate tasks. Anomali Agentic AI governs decisions. It reasons over complete telemetry — enriched at ingestion by Managed Intelligence as a Service — to recommend and execute the right action at the right time, with human oversight built in.

AI-assisted reasoning

across detection, investigation, and response workflows.

Context-aware decisioning

grounded in real security data.

Human-guided automation

so analysts stay in control.

Actions informed by years

of historical and real-time context.

Core Capabilities

AI-Guided Detection & Prioritization

Combine analytics and intelligence to surface high-confidence threats.

Guided Investigations

AI assists analysts with recommended pivots, context, and next steps.

Agentic Response Workflows

Automate enrichment, triage, and response while keeping humans in control.

Intelligence-Driven Decisions

Threat intelligence informs every stage of detection, investigation, and response.

SOC-Native Experience

Designed for analysts — fast, intuitive, and operational.

Dark ModeLight Mode

AI-Ready Insights Powered by Complete Data

Act faster, investigate smarter, and respond with confidence.

‍

‍

How it works

1. Detect and Prioritize

Analytics and intelligence identify what matters now.

2. Investigate With Guidance

AI recommends investigative paths using complete context.

3. Respond and Automate

Execute automated or guided actions across your security stack.

Powered by the Anomali Agentic SOC Platform

Three layers, each compounding the value of the others. Raw data without intelligence is noise. Intelligence without data is reporting. It’s time to operationalize your intelligence.

Unified Security Data Lake

Full-fidelity telemetry — cloud, endpoint, network, identity, IT/OT, and beyond — always-on and always-searchable, with no legacy SIEM cost or performance ceiling.

Managed Intelligence as a Service

Powered by ThreatStream Next-Gen, the safety layer the entire agentic architecture depends on. Continuously enriches your data lake with threat actors, TTPs, and campaigns — operationalizing intelligence in minutes, not business days.intelligence and context

Agentic AI

A stack-ranked decision queue, MCP-enabled agentic operations, and Tier 1/2 triage agents that reflect your SOC's judgment — not vendor runbooks.execution and action

Customer Proof

“Having Anomali Agentic AI is like having another mature analyst. We went from 3-hour IOC collection to 3 minutes.”
 
— SOC Manager, Global Enterprise

Make intelligence the foundation of every security decision.

Governed, AI-guided operations built on complete context and Managed Intelligence as a Service.

Request a Demo