We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Dalbit Threat Group Runs Attack Campaigns Against Korean Companies
Dalbit, a threat group, has executed over 50 ransomware attacks on Korean companies since 2022. Targeting mid to small-sized firms across various industries, they exploit vulnerabilities and use Chinese tools for privilege escalation and data exfiltration, affecting sectors like technology, industrial, and manufacturing.
Chinese Espionage Group Exploits Systems with Equation Editor Vulnerability
Group-IB discovered Tonto Team, a Chinese espionage group, exploiting Microsoft Equation Editor vulnerabilities via phishing campaigns. Using the Royal Road RTF Weaponizer, they targeted industries including education, energy, and government, deploying Bisonal.DoubleT backdoor malware for data exfiltration and remote command execution.
Clop Ransomware Releases a Flawed Linux Encryptor
SentinelLabs identified a flaw in the new Linux variant of the Clop ransomware, enabling decryption. The encryptor, found in the wild on December 26th, 2022, is in its development stage with missing features and a critical encryption flaw involving a hardcoded RC4 master key.
ESXiArgs Ransomware Updates to Thwart Recovery Efforts
The ESXiArgs ransomware campaign has updated its encryption routine to thwart recovery efforts. The new routine encrypts 50% of data in files over 1MB, making recovery difficult. Initial exploitation methods remain unclear, with conflicting reports on vulnerabilities used.
North Korean Actors Seeks Funds from Critical Infrastructure Organizations
DPRK ransomware operations target critical infrastructure and healthcare sectors to generate revenue for state objectives. Exploiting vulnerabilities like Log4Shell and SonicWall flaws, North Korean actors use ransomware variants such as Maui and H0lyGh0st, demanding Bitcoin payments via Proton Mail.
Maritime-related Entities in Pakistan Target in Espionage Campaign
NewsPenguin targets Pakistan's maritime entities with a phishing campaign using PIMEC as a lure. The attack aims to collect sensitive data from military tech manufacturers and expo participants. The campaign uses weaponized Word documents and IP-based payload delivery.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
