Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
All Threat Reports
Critical PAN-OS Vulnerability CVE-2024-3400 Exploited by UTA0218, Volexity Reports
In April 2024, the CVE-2024-3400 vulnerability in PAN-OS was exploited by UTA0218, allowing unauthenticated remote code execution. Volexity's findings revealed the installation of the UPSTYLE backdoor and aggressive lateral movements within compromised networks, underscoring the criticality of the vulnerability.
OpenJS Foundation Thwarts Social Engineering Scheme Mirroring XZ Backdoor Incident
The OpenJS Foundation intercepted attempts to manipulate project maintainer roles through deceptive emails, mimicking tactics seen in the XZ backdoor incident. Enhanced security measures and collaboration with CISA help safeguard against such social engineering threats in the open source ecosystem.
Muddled Libra’s Exploitation of Cloud Services and Identity Portals
Unit 42 reveals Muddled Libra’s methods in compromising cloud services and SaaS applications. Utilizing social engineering, they orchestrate attacks across AWS and Azure, exploiting IAM and identity portals like Okta. Their deep technical understanding and strategic impersonation attacks pose significant threats to various global industries.
Phishing Campaign Harnesses ScrubCrypt and BatCloak to Mask VenomRAT Deployment
A new phishing campaign utilizes ScrubCrypt and BatCloak to deploy VenomRAT, as detailed by Fortinet. Attackers use SVG files disguised as invoices to initiate malware installation, targeting data and cryptocurrency wallets. This complex attack sequence underscores the importance of advanced threat detection techniques.
Signs of AI In PowerShell Script Distributing Rhadamanthys Stealer
Proofpoint reveals AI's influence in a PowerShell script distributing Rhadamanthys Stealer by TA547 targeting global firms. The script, marked by AI-generated precise comments, indicates an advancing use of AI in cybercriminal tactics. This development highlights the need for advanced defenses against these increasingly sophisticated cyber threats.
HHS Warns of Advanced Phishing Techniques Endangering Healthcare Data
The HHS warns of advanced phishing attacks within the healthcare sector, targeting IT help desks to bypass security protocols like MFA. Utilizing detailed personal data and sophisticated tactics like AI voice cloning, these attacks pose significant threats to healthcare data security and financial integrity.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.