https://cybertoolchain.io/tools/joe-security-joe-sandbox New releases and features in Joe Security (Joe Sandbox), tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 11:46:38 GMT https://www.joesecurity.org/blog/5949477938680764107 https://www.joesecurity.org/blog/5949477938680764107 Tue, 03 Nov 2026 11:46:38 GMT Joe Sandbox adds Adaptive Detonation, an AI agent that identifies why a sample stopped, intervenes, and re-runs it to expose hidden malware behavior⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Joe Sandbox now adds Adaptive Detonation, an AI agent capability that runs a sample, identifies what blocked execution (evasion check, missing prerequisite, or failure), applies a targeted change, and re-analyzes the sample under the new conditions to surface behavior the initial run missed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The agent can supply missing launch arguments — for example, recovering and injecting the required `S1=1` MSI installer property — without modifying the sample package itself. • The agent can adjust the analysis environment by setting the guest machine's date to a required window or advancing the guest clock (demonstrated by a two-day advance to bypass a file-age loader delay) before re-running the unchanged sample in Joe Sandbox Cloud. • The agent can run preparation code to create required files, directories, or registry values, or install a missing software dependency such as Python in a location the sample already searches. • Analysis reports now include the agent's findings from Adaptive Detonation: what blocked execution, the runtime and code evidence, the recommended action, alternative explanations, and remaining uncertainty. • Adaptive Detonation is available as part of Joe Sandbox AI and has been running in Joe Sandbox Cloud Basic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/joe-security-joe-sandbox https://www.joesecurity.org/news https://www.joesecurity.org/news Tue, 15 Sep 2026 13:01:39 GMT Joe Reverser 2.1 'Golden Eagle' expands agentic malware and phishing analysis with deeper automation workflow integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Releases Joe Reverser 2.1 'Golden Eagle', an agentic automated analyst covering malware, phishing campaigns, malicious documents, and web-based threats with enhanced autonomous analysis and reverse engineering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves integration into automated analysis workflows for Joe Reverser's agentic capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/joe-security-joe-sandbox https://www.joesecurity.org/blog/2556159268374894800 https://www.joesecurity.org/blog/2556159268374894800 Mon, 07 Sep 2026 11:11:25 GMT Joe Sandbox v45 adds 625 new signatures, 55 config extractors, 133 Suricata rules, and improves DOM/QR/Live Interaction analysis. • Adds 50 new behavior signatures covering emerging malware families including RatonRAT, REMUS Stealer, EtherHiding, GehennaLocker, PureLogs Stealer, PhantomGate, QuimaRAT, and others. • Adds 575 new custom YARA rules to detect ransomware, stealers, RATs, and phishing frameworks. • Adds 55 new malware configuration extractors — including ZigClipper, BlakcSee Stealer, Sirius RAT, OverLordRat, CastleRat, WikiKit, PhantomGate, Remus Stealer, SantaStealer, and GenericBot — to automatically extract IOCs and family configuration data without manual reverse engineering. • Adds 133 new Suricata rules (30 anomaly, 88 malware, 15 phishing) covering CastleRAT, LummaC, LxBase RAT, njRAT, Phoenix Stealer, SilentNet, ErrTraffic v2 ClickFix, EvilTokens, Tycoon2FA, and WikiKit/Sneaky2FA. • Updates the underlying Suricata engine to Suricata 8. • Improves DOM extraction and phishing detection for better visibility into dynamic web content, obfuscated scripts, and redirect-based phishing pages. • Improves QR code reader analysis to uncover embedded URLs and data in QR-based phishing samples and documents. • Improves Live Interaction responsiveness and performance for smoother manual analyst interaction with analysis machines. • Adds macOS shutdown protection to prevent analysis evasion via system shutdown on macOS samples. • Improves prevention of VM and analysis system detection techniques used by evasive malware. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/joe-security-joe-sandbox https://www.joesecurity.org/blog/8642293418708272405 https://www.joesecurity.org/blog/8642293418708272405 Thu, 05 Mar 2026 14:10:00 GMT Joe Reverser 1.0.0 introduces Skill Only Mode, Office file analysis, and a Chat Report. • Adds 'Skill Only Mode' to guide the agent toward specific objectives without predefined workflows • Adds analysis support for DOC/DOCX, XLS/XLSX, and PPT/PPTX file formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/joe-security-joe-sandbox https://www.joesecurity.org/blog/4986670706879863609 https://www.joesecurity.org/blog/4986670706879863609 Mon, 19 Jan 2026 09:40:00 GMT Joe Sandbox v44 adds SOCKS/HTTP proxy support for phishing evasion, Sentinel integration, and macOS Sonoma/Sequoia • Added `SOCKS / HTTP Proxy Support` to Joe Sandbox Cloud Pro to evade IP-based reputation and bot detection during phishing analysis. • Added `Module Proxy Detection` to expose stealthy DLL loading techniques (e.g., proxying kernel32!LoadLibrary via ntdll) used to hide C2 beacons. • Added `Microsoft Sentinel Integration` to push Joe Sandbox analysis results back into Microsoft Sentinel workflows for enriched incident context. • Added `Support for macOS Sonoma and Sequoia` to the macOS analysis environment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/joe-security-joe-sandbox