Anomali

Anomali Inc.

Company type	Private
Industry	Cybersecurity
Founded	2013
Founder	Greg Martin, Colby DeRodeff
Headquarters	Redwood City, California , United States
Products	ThreatStream, Anomali Match, Anomali Lens, Anomali Preferred Partner (APP) Store, Cloud-Native XDR
Website	anomali.com

Anomali Inc. is a U.S.-based cybersecurity firm specializing in the development and delivery of threat intelligence solutions. In 2023, the company expanded its offerings to include security analytics enhanced by artificial intelligence (AI).

History

Established in 2013 by Greg Martin and Colby DeRodeff under the original name ThreatStream, Anomali initially focused on providing tools that enabled organizations to filter and customize views of indicators of compromise (IOCs). That same year, the company launched the inaugural version of ThreatStream, a threat intelligence platform (TIP) designed to aggregate data from multiple sources to identify and monitor known cyber threats.

In 2016, the organization rebranded as Anomali, unveiling new products and adopting a refreshed strategy for delivering threat intelligence. This shift introduced both SaaS and on-premises platforms that allowed clients to upload their security logs. Alongside this, Anomali released its second product—initially named Anomali and later rebranded as Anomali Match—a service aimed at enterprise-level threat detection by correlating internal data with established IOCs.

By 2018, Anomali had secured $96.3 million in funding from a group of eleven investors, including Paladin Capital Group, Institutional Venture Partners (IVP), GV (formerly Google Ventures), General Catalyst, Telstra Ventures, and Lumina Capital. The company’s clientele includes notable entities such as the Bank of England, Citigroup, and Alaska Airlines.

In 2019, Anomali launched Anomali Lens, a browser extension that identifies and extracts relevant threat intelligence from web content like news articles, blogs, and social media. The gathered information feeds into ThreatStream and is matched against internal network events through the Anomali Match platform. Since its inception, Anomali has built an extensive partner ecosystem comprising channel resellers, managed security service providers (MSSPs), systems integrators, and commercial threat intelligence feed providers, collectively forming the Anomali Preferred Partner Store (Anomali APP Store). The company also forged a collaboration with Microsoft to integrate ThreatStream’s intelligence with Microsoft Graph Security API data, enabling organizations to correlate cloud and network activity with adversary insights. Additionally, Anomali partnered with the National Health Information Sharing and Analysis Center (NH-ISAC) to enhance cybersecurity capabilities within the healthcare sector.

In March 2021, Anomali entered its first distribution partnership in Australia and New Zealand by signing an agreement with Netpoleon. Subsequently, in January 2022, it expanded its reach in Southeast Asia through a distribution deal with ACA Pacific targeting markets including Singapore, Malaysia, Indonesia, and Thailand.

That same year, Anomali became a member of MITRE Engenuity’s Center for Threat-Informed Defense to contribute to the Attack Flow Project, aimed at deepening understanding of adversary tactics and improving defensive measures. The project was publicly released in March 2022.

In March 2022, Anomali introduced its Cloud-Native XDR (eXtended Detection and Response) platform designed to augment existing security infrastructures by integrating threat intelligence and IOC repositories. This solution supports integration with frameworks such as MITRE ATT&CK among others.

Also during March 2022, Anomali launched the Resilience Partner Program targeted at Global Systems Integrators (GSIs), Value Added Resellers (VARs), distributors, and service providers. This initiative facilitates streamlined access for partners to both the Anomali Platform and Cloud-Native XDR services.

Investigations / Anomali Threat Research (ATR) Team

In January 2019, Anomali detected a phishing scheme aimed at Australian enterprises. Cybercriminals impersonated the Department of Infrastructure and Regional Development, notifying companies that they had been chosen to submit tenders for commercial projects. To proceed, recipients were instructed to register via a link directing them to a counterfeit version of the government's AusTender platform. The ATR team promptly informed government authorities about this fraudulent activity.

By July 2019, the ATR team identified a novel ransomware strain named eCh0raix, which targeted QNAP Network Attached Storage (NAS) devices. A decryptor tool was subsequently made available in August to assist affected users.

In December 2019, Anomali released findings revealing that the hacking collective Gamaredon had initiated cyberattacks against Ukrainian military and governmental entities. Their targets included the Ministry of Foreign Affairs, journalists, law enforcement bodies, and various nongovernmental organizations (NGOs). These operations began around mid-September.

During June 2020, the company uncovered a dozen malicious applications masquerading as coronavirus contact tracing tools designed to exfiltrate personal and financial data from Android users. Among these, four apps deployed either the Anubis banking malware or the SpyNote Trojan. The campaigns affected individuals across Armenia, Brazil, Colombia, India, Indonesia, Iran, Italy, Kyrgyzstan, Russia, and Singapore.

In February 2021, ATR exposed a cyberespionage campaign directed at government agencies in the United Arab Emirates and Kuwait. This operation was attributed to Static Kitten (also known as MERCURY or MuddyWater), a state-sponsored group linked to Iran's Islamic Republic Guard Corps. Their objective involved deploying the remote management software ScreenConnect with customized launch parameters and malicious properties disguised under URLs imitating Kuwait’s Ministry of Foreign Affairs and the UAE National Council.

In May 2021, the team identified threat actors exploiting Microsoft Build Engine (MSBuild) to stealthily deliver remote access trojans (RATs) and credential-stealing malware on Windows machines without leaving typical infection footprints. This campaign had been ongoing since April. Analyzed samples included Remcos RAT, Quasar RAT, and RedLine Stealer.

By September 2021, ATR observed activity from the FIN7 cybercrime group specializing in financial theft. The gang employed Word documents containing JavaScript backdoors aimed at harvesting payment card information.

Products and services

• ThreatStream – an automated threat intelligence platform designed to streamline the processes of threat detection, analysis, and response; it aggregates intelligence from a variety of sources.
• Match – a breach detection system that correlates external threat intelligence with internal security events to identify potential compromises.
• Lens – a browser-based extension utilizing natural language processing (NLP) to analyze both structured and unstructured online data, facilitating automated recognition of adversaries, malware, and cyber threats that are either active within or newly discovered on the user's network.
• Anomali Preferred Partner (APP) Store – a marketplace enabling organizations to acquire supplementary intelligence products; this platform was developed in partnership with channel resellers, Managed Security Services Providers (MSSPs), Systems Integrators, and providers of Commercial Threat Intelligence Feeds.
• Cloud-Native XDR – a solution aimed at assisting organizations in monitoring and enhancing their current security telemetry frameworks.

See also

• AT&T Cybersecurity
• Cyber threat intelligence
• Vulnerability management