Anvilogic Forge Threat Research Reports

Here you can find an accumulation of trending threats published weekly by the Anvilogic team.

We curate threat intelligence to provide situational awareness and actionable insights

Threat Identifier Detections

Atomic detections that serve as the foundation of our detection framework.

Threat Scenario Detections

Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.

Reports Hot Off the Forge

Threat News Reports
Trending Threat Reports
ResearchArticles

All Threat Reports

Levels

All
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
This is some text inside of a div block.
07
-
11
-
2024
Level:
Tactical
|
Source:

ASEC Unveils Xctdoor Malware Campaign Targeting South Korean Industries

ASEC has identified a cyber-espionage campaign by the North Korean group Andariel targeting South Korean defense and manufacturing sectors. The campaign uses Xctdoor malware to compromise enterprise environments, exfiltrate data, and monitor systems. The attackers exploit ERP software vulnerabilities to gain persistent access and execute further malicious activities.

Defense
Manufacturing
This is some text inside of a div block.
07
-
11
-
2024
Level:
Tactical
|
Source:

Misconfigured Ports Continue to Plague Docker Instances, Enabling Container Host Escapes via Bind

Datadog reports on Docker misconfigurations leading to host escapes and cryptojacking by the Spinning YARN campaign. Attackers exploit exposed Docker ports, bind containers to hosts, and deploy XMRig miners. This highlights the critical need for securing Docker instances and cloud assets against such vulnerabilities and attacks.

Global
This is some text inside of a div block.
07
-
11
-
2024
Level:
Tactical
|
Source:

GrimResource Attack Exploits Old XSS Flaw in Microsoft Management Console

Elastic researchers uncover GrimResource, a novel attack technique exploiting an old XSS flaw in Microsoft Management Console (mmc.exe). Attackers use this vulnerability to execute arbitrary code via a maliciously crafted MSC file, leading to unauthorized access and system takeover, ultimately deploying Cobalt Strike. Securing against this flaw is essential to prevent exploitation.

Global
This is some text inside of a div block.
07
-
11
-
2024
Level:
Strategic
|
Source:

New "regreSSHion" Vulnerability - CVE-2024-6387, Could Enable Remote Code Execution on Linux

The newly discovered regreSSHion vulnerability (CVE-2024-6387) in OpenSSH allows remote code execution on glibc-based Linux systems. Found by Qualys, this flaw affects versions 8.5p1 to 9.7p1. Updating to version 9.8p1 or later is essential to mitigate this severe threat and secure your systems.

Global
This is some text inside of a div block.
07
-
04
-
2024
Level:
Tactical
|
Source:

Ransomware in Espionage Blurring Lines Between Cybercrime and State Espionage

SentinelOne reports that cyber-espionage groups like ChamelGang are increasingly using ransomware to mask their activities. This trend blurs the line between state espionage and cybercrime, complicating attribution and increasing risks for global industries such as aviation, healthcare, and government. Enhanced collaboration between intelligence agencies and cybersecurity professionals is essential to address this evolving threat landscape.

Global
This is some text inside of a div block.
07
-
04
-
2024
Level:
Tactical
|
Source:

Dissecting the Multi-Stage Distribution of Fickle Stealer Malware

Fortinet researcher Pei Han Liao uncovers the complex distribution of Fickle Stealer malware, a Rust-based stealer targeting sensitive data. The malware uses multiple delivery vectors, including VBA droppers, link-based methods, and PowerShell scripts, to bypass security measures and establish persistence. By exploiting Windows' handling of trusted directories, the malware gains elevated privileges without User Account Control prompts. The final payload targets a wide array of sensitive information, posing significant threats to global industries.

Global

Intelligence Levels for Threat Reports

Tactical

Detectable threat behaviors for response with threat scenarios or threat identifiers.

Strategic

General information security news, for awareness.

The World's Best SOC Teams Use Anvilogic

Paypal Logo
Rubrik Logo
Deloitte Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
Sigma Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo
Paypal Logo
Rubrik Logo
Deloitte Logo
Ebay Logo
Regeneron Logo
SurveyMonkey Logo
TradeWeb Logo
Alteryx Logo
First Citizens Bank Logo
TJX Logo
Sigma Logo
Crypto.com Logo
Rakuten Mobile Logo
St. George's University Logo

Break Free from SIEM Lock-in

Break Free from SIEM Lock-in