Anvilogic Forge Threat Research Reports

Here you can find an accumulation of trending threats published weekly by the Anvilogic team.

We curate threat intelligence to provide situational awareness and actionable insights

Threat Identifier Detections

Atomic detections that serve as the foundation of our detection framework.

Threat Scenario Detections

Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.

Reports Hot Off the Forge

Threat News Reports
Trending Threat Reports
ResearchArticles

Forge Threat Report

Forge Report: First Half Threat Trends of 2024

Anvilogic Forge's latest report offers essential insights into key threat trends and adversarial tactics observed in the first half of 2024. From the pervasive use of PowerShell and remote access tools to sophisticated social engineering and attacks on the healthcare sector, this comprehensive analysis provides actionable intelligence and detection rules to bolster your defenses. Explore our key findings and access ready-to-deploy detection content to enhance your security posture.

All Threat Reports

Levels

All
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
This is some text inside of a div block.
10
-
17
-
2024
Level:
Tactical
|
Source:

A Growing Trend of BEC Attacks Misusing Legitimate File Sharing Platforms

Microsoft reports a surge in BEC attacks using legitimate platforms like SharePoint and OneDrive. These attacks evade detection by sending legitimate file-sharing notifications, luring victims into re-authenticating and exposing credentials. Threat actors then use compromised accounts to expand their reach and conduct further attacks.

Global
This is some text inside of a div block.
10
-
10
-
2024
Level:
Strategic
|
Source:

Royal Mail Impersonated in Latest Prince Ransomware Phishing Scam

Proofpoint researchers unveil a phishing campaign that impersonates Royal Mail to deliver Prince ransomware. Active in the UK and US, the campaign uses public contact forms and direct emails, leveraging ZIP files with malicious scripts. Despite no clear attribution, the ransomware is available on GitHub for free.

Global
This is some text inside of a div block.
10
-
10
-
2024
Level:
Tactical
|
Source:

Perfctl Malware Adapts and Evades Detection Targeting Linux Servers

Aqua Security researchers uncover the perfctl malware targeting Linux servers by exploiting misconfigurations and vulnerabilities like CVE-2021-4034. The malware adapts to evade detection, impacts server operations, and is linked to cryptomining. It uses stealth tactics, including masking processes and leveraging user-agent filtering to deliver payloads.

Global
This is some text inside of a div block.
10
-
10
-
2024
Level:
Tactical
|
Source:

A more_eggs Malware Infection From Recruitment Scams

The more_eggs malware, part of the Golden Chickens malware-as-a-service (MaaS) toolkit, continues to spread through fake job recruitment scams. Threat actors like FIN6 and the Cobalt Group are leveraging this toolkit to target industries involved in hiring, particularly finance and retail, using deceptive social engineering techniques.

Global
This is some text inside of a div block.
10
-
03
-
2024
Level:
Strategic
|
Source:

Memory Manipulation Vulnerability in ChatGPT Raises Concerns for Data Exfiltration

A memory manipulation vulnerability in ChatGPT, discovered by security researcher Johann Rehberger, could allow attackers to implant false memories and exfiltrate data. Despite OpenAI's fixes, risks remain. Ars Technica highlights the importance of vigilance when using AI models to prevent potential security breaches.

Global
This is some text inside of a div block.
10
-
03
-
2024
Level:
Strategic
|
Source:

Hackers Could Exploit ATG Flaws to Cause Environmental and Economic Havoc

Researchers from Bitsight have identified critical vulnerabilities in Automatic Tank Gauges (ATGs) that could enable attackers to manipulate fuel storage systems, causing environmental damage and economic disruption. CISA advises immediate security measures to mitigate the risks as some vendors delay patches.

Critical Infrastructure

Intelligence Levels for Threat Reports

Tactical

Detectable threat behaviors for response with threat scenarios or threat identifiers.

Strategic

General information security news, for awareness.

The World's Best SOC Teams Use Anvilogic

Paypal Logo
Rubrik Logo
Deloitte Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
Paypal Logo
Sprinklr Logo
SAP Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo
Navan Logo
ADP Logo
Labcorp Logo
Dyson Logo
siemens Logo

Build Detections You Want,
Where You Want

Build Detections You Want,
Where You Want