Anvilogic Forge Threat Research Reports

Here you can find an accumulation of trending threats published weekly by the Anvilogic team.

We curate threat intelligence to provide situational awareness and actionable insights

Threat Identifier Detections

Atomic detections that serve as the foundation of our detection framework.

Threat Scenario Detections

Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.

Reports Hot Off the Forge

Threat News Reports
Trending Threat Reports
ResearchArticles

Forge Threat Report

Forge Report: First Half Threat Trends of 2024

Anvilogic Forge's latest report offers essential insights into key threat trends and adversarial tactics observed in the first half of 2024. From the pervasive use of PowerShell and remote access tools to sophisticated social engineering and attacks on the healthcare sector, this comprehensive analysis provides actionable intelligence and detection rules to bolster your defenses. Explore our key findings and access ready-to-deploy detection content to enhance your security posture.

All Threat Reports

Levels

All
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
This is some text inside of a div block.
05
-
16
-
2024
Level:
Strategic
|
Source:

FBI Warns Retailers of Increased Phishing Attacks on Corporate Offices

The FBI warns US retail corporate offices about STORM-0539’s phishing and smishing attacks targeting gift card departments. Since January 2024, these attacks have aimed to create fraudulent gift cards, causing significant financial losses. The group bypasses multi-factor authentication using advanced phishing kits and AiTM techniques. Enhanced email and SMS filtering, along with vigilant monitoring of authentication processes, are recommended to counter these threats.

Retail
This is some text inside of a div block.
05
-
16
-
2024
Level:
Tactical
|
Source:

Russian-Linked APT28 Caught in Cyber Espionage Against Poland

Russian-linked APT28 (Fancy Bear) is targeting Polish government institutions with a phishing campaign, according to CERT-PL. The attack uses malicious ZIP archives to deploy DLL side-loading malware, gathering sensitive data from infected systems. CERT-PL advises enhanced email filtering and monitoring connections to services like run.mocky[.]io to mitigate these threats.

Government
This is some text inside of a div block.
05
-
16
-
2024
Level:
Tactical
|
Source:

Akira Ransomware Thrives in Post-BlackCat and LockBit Era

Akira ransomware has become a leading threat following the disruptions of BlackCat and LockBit. IBM's report details Akira's use of double extortion, exploitation of the Cisco ASA vulnerability CVE-2023-20269, and psychological tactics. Organizations are advised to enhance their vulnerability management and follow guidance from IBM and CISA to counter this emerging threat.

Global
This is some text inside of a div block.
05
-
16
-
2024
Level:
Tactical
|
Source:

MITRE Offers Initial Findings of the Cyberattack on Its NERVE Network

MITRE has released details of a cyberattack on its NERVE network, traced back to December 2023. The intrusion exploited Ivanti zero-day vulnerabilities and deployed various web shells. The attack, linked to the Chinese-aligned group UNC5221, involved extensive network profiling and data exfiltration efforts, highlighting the strategic use of zero-day vulnerabilities in cyber espionage.

Technology
This is some text inside of a div block.
05
-
09
-
2024
Level:
Strategic
|
Source:

JFrog Exposes Rampant Malware Disguised in Docker Hub Repositories

JFrog's research indicates a quarter of Docker Hub's repositories contain malware or spam. Highlighting three major malicious campaigns, JFrog collaborates with Docker to enhance security, underscoring the necessity for vigilance and stringent verification of repository integrity.

Global
This is some text inside of a div block.
05
-
09
-
2024
Level:
Tactical
|
Source:

Okta Issues Alert on Rising Credential Stuffing Attacks Via Residential Proxies

Okta reports a rise in credential stuffing attacks, highlighting the use of residential proxies for anonymity. Okta's new defenses include passwordless options and enhanced multi-factor authentication to combat these attacks, ensuring robust security against unauthorized access.

Global

Intelligence Levels for Threat Reports

Tactical

Detectable threat behaviors for response with threat scenarios or threat identifiers.

Strategic

General information security news, for awareness.

The World's Best SOC Teams Use Anvilogic

Paypal Logo
Rubrik Logo
Deloitte Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
St. George's University Logo
Paypal Logo
Sprinklr Logo
SAP Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo
Navan Logo
ADP Logo
Labcorp Logo
Dyson Logo
siemens Logo

Build Detections You Want,
Where You Want

Build Detections You Want,
Where You Want