Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
OpenAI Tracks Phish, Malware Tooling, And Low-Reach Influence Campaigns
OpenAI’s October 2025 report reveals threat actors integrating large language models into phishing, malware maintenance, scams, and small-scale influence operations. Despite disruptions of over 40 networks, investigators found no evidence of new offensive capabilities, emphasizing iterative abuse of AI tools, multilingual lure generation, and adaptive social engineering.
From CL-STA-0043 to Phantom Taurus: Multi-Year Hunt Reveals New PRC Cyber Playbook
Unit 42 formally identifies Phantom Taurus, a PRC-aligned APT evolved from cluster CL-STA-0043. Active since 2023, it targets government and telecom networks across Africa, the Middle East, and Asia. The group employs the .NET-based NET-STAR suite, IIS in-memory persistence, timestomping, and SQL-focused data exfiltration for espionage objectives.
W-9 Lure Kicks Off 28-Day Intrusion Ending in Exfiltration With No Ransomware
A May 2024 intrusion beginning with a malicious W-9 JavaScript downloader developed into a patient 28-day operation. Operators used Brute Ratel, Cobalt Strike, Zerologon, and living-off-the-land techniques to harvest credentials, move laterally, and exfiltrate data. The campaign ended with eviction—no ransomware was deployed.
Okta: 130+ DPRK Identities Linked to 6,500 Interviews at 5,000 Companies
Okta research reveals North Korea’s IT-worker program spans 130+ false identities tied to over 6,500 job interviews at 5,000 companies worldwide. The scheme targets technology, finance, healthcare, and government sectors, generating revenue and potential insider access. Okta warns of a mature, global threat using deception to gain remote roles.
TA415 Targets U.S.–China Policy Circles with VS Code Tunnel Intrusions
Proofpoint attributes a 2025 phishing campaign to TA415 / APT41, targeting U.S.–China policy, academic, and government sectors. Lures spoofed trade organizations and officials, dropping a Python loader that abuses Visual Studio Code’s Tunnel feature for remote command execution. The operation replaces traditional malware with living-off-the-land persistence.
Akira’s SonicWall Blitz: CVE-2024-40766 to Ransomware in Under 4 Hours
Arctic Wolf reports Akira campaigns (July 2025) exploiting SonicWall CVE-2024-40766 SSL VPN access to authenticate from VPS hosts, harvest credentials, and rapidly stage exfiltration and ransomware. Attacks compressed lateral movement and impact into minutes–hours. Arctic Wolf urges resetting VPN and AD credentials, revoking exposed keys, and tightening remote-access controls.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
