We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Blackbyte Returns with Updates
Blackbyte ransomware re-emerges with version 2.0 and a new data leak site. The site offers extortion options such as extending data publishing, downloading, or destroying data. However, KELA researchers found issues with the site's Bitcoin and Monero wallet addresses.
RedAlpha's Espionage Activity
Recorded Future exposes RedAlpha's cyber-espionage activities targeting civil, government, and humanitarian sectors. The Chinese-aligned group uses spoofed domains to steal credentials and gain access to email accounts. Their campaigns focus on organizations in Taiwan and vulnerable communities.
APT29's TTPs Against Microsoft 365
Mandiant's research exposes APT29's advanced tactics targeting Microsoft 365, including disabling Purview Audit and exploiting MFA enrollment. The Russian espionage group focuses on organizations influencing NATO policies, using techniques to evade detection and access accounts.
Financially Motivated Group Eyes Hospitality and Travel Organizations
Proofpoint identifies TA558 as a financially motivated threat group targeting hospitality and travel sectors since 2018. Their phishing campaigns, focusing on Latin America, deploy various malware via reservation-themed emails. The group’s activity increased in 2022, using tactics like exploiting CVE-2017-11882 and PowerShell scripts.
Ukraine Remains Shuckworm's Focus
Shuckworm (Gamaredon) continues targeting Ukraine with recent campaigns distributing PowerShell malware. The malware captures screenshots and executes commands, adding to Shuckworm’s toolset of espionage tools. Symantec reports persistent efforts against Ukraine from July 15th to August 8th, 2022.
Microsoft Intervenes with SEABORGIUM’s Phishing Campaigns
Microsoft intervened against SEABORGIUM’s phishing campaigns targeting Baltics, Nordics, and Eastern Europe. SEABORGIUM, a Russian threat actor, focuses on espionage, using phishing and credential theft to exfiltrate data. Microsoft shut down accounts used by the group for surveillance and phishing.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
