We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
ProxyShell Exploited with DatopLoader Leading to Qakbot
Cybereason reports the emergence of DatopLoader malware following the exploitation of ProxyShell and Exchange vulnerabilities. DatopLoader delivers Qakbot, establishing persistence and conducting reconnaissance using native tools and AdFind. The attack also involves lateral movement with Cobalt Strike via PsExec and credential access through registry hive collection.
MuddyWater Part of Iranian Intelligence Activities
U.S. Cyber Command connects MuddyWater to Iran's MOIS, revealing the group's focus on surveillance and espionage against Middle Eastern, European, and North American nations. MOIS conducts domestic and international surveillance through embassy agents, targeting regime opponents and anti-regime activists.
Microsoft Defender Weakness
SentinelOne researchers have identified a weakness in Microsoft Defender that allows local attackers to query the registry and find excluded locations. This vulnerability enables attackers to plant malware in these excluded directories without detection. Group Policy settings can also be queried from the registry tree, giving attackers greater visibility into the network. Tests by BleepingComputer showed that executing malware from an excluded folder resulted in no action from Defender, while executing from a non-excluded location triggered a block. This issue affects Windows 10 versions 21H1 and 21H2 but not Windows 11.
APT35 CharmPower & Log4j
CheckPoint reports APT35 exploiting the Log4j vulnerability (CVE-2021-44228) to distribute their PowerShell toolkit, CharmPower. The exploitation chain involves encoded PowerShell commands triggered by a malicious Java class to download and execute modules from an Amazon S3 bucket. CharmPower's capabilities include downloading additional payloads, system enumeration, data collection, and exfiltration.
BlueNoroff Cryptocurrency Focused APT Group
Kaspersky's research on BlueNoroff, an APT group associated with Lazarus, reveals a focus on targeting cryptocurrency startups. Initially tracked after the 2016 attack on Bangladesh’s Central Bank, BlueNoroff specializes in abusing trust, whether through internal bank server communications or compromised cryptocurrency exchange software updates. This year, the group has been using Google Drive and LinkedIn messages as lures to deliver malicious documents or compressed files containing LNK files. These documents, when executed, launch PowerShell or VBScript to conduct system fingerprinting, credential collection, or cryptocurrency theft. The group operates with patience, blending activities to study their target environments.
Ukraine Organizations Targeted with "Destructive" Malware
Microsoft Threat Intelligence Center (MSTIC) reports DEV-0586, a destructive malware, targeting Ukraine since January 13, 2022. The malware renders systems inoperable, providing ransom notes without recovery options. Government, non-profit, and IT sectors are affected. The attack uses a two-stage process with "stage1.exe" overwriting the Master Boot Record and "Stage2.exe" corrupting files.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
