We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Broward Health Data Breach
Florida-based Broward Health disclosed a data breach that occurred on October 15th, 2021, affecting 1,357,879 individuals. The organization detected the incident four days later and promptly notified the FBI and the US Department of Justice. The breach compromised a range of patient data, including names, birth dates, physical addresses, phone numbers, financial information, social security numbers, emails, and medical information/history.
Aquatic Panda
CrowdStrike's OverWatch team identified Aquatic Panda attempting to exploit the Log4Shell vulnerability on a VMware Horizon instance at an academic institution. The threat actor ran DNS lookups, executed Linux commands on a Windows host, and used PowerShell to download scripts. They also attempted to harvest credentials by dumping LSASS memory. The institution mitigated the attack by patching the vulnerable application.
Caution with Copy Pasting
In a blog post on Wizer, a security training platform, founder Gabriel Friedlander revealed that malicious JavaScripts can hide within a web page's HTML. These scripts use 'event listeners' to replace clipboard data, potentially tampering with commands users copy and paste into command terminals. This poses a significant risk as the modified commands can be executed without the user's awareness, either manually or with a new line.
BlackTech - "Flagpro"
NTT Security has observed the threat actor group BlackTech utilizing new malware named Flagpro to target Japanese companies. The attack begins with spear-phishing emails containing a zip attachment with a malicious Excel document. Upon macro execution, the Flagpro executable is dropped into the startup directory, executing on the next system launch. Flagpro communicates with its C2 server via base64 encoded traffic and can download additional tools, execute OS commands, and collect Windows authentication information. If the compromised host is deemed suitable, the attackers proceed to download the second stage malware.
Conti & Log4Shell from AdvIntel
AdvIntel's latest report highlights the Conti ransomware group's exploitation of the Log4Shell vulnerability. After a lack of viable attack vectors since November, Conti found an opportunity with Log4Shell, initiating scanning activities for the exploit. Conti members targeted specific vulnerable Log4J2 VMware vCenter systems, using these for lateral movement directly from compromised networks. This activity affected US and European victim networks, leveraging pre-existing Cobalt Strike sessions. AdvIntel confirms the ransomware group's renewed activity, posing significant risks to global networks.
Threat Group Aggah (TH-157)
Yoroi Malware ZLAB tracks Aggah (TH-157) targeting Eastern Europe with a nine-stage attack involving malicious PowerPoint macros, MSHTA execution, and AgentTesla infostealer. The group varies payload delivery infrastructure every 80 minutes, targeting Ukraine, Lithuania, Italy, and additional Eastern European countries for reconnaissance and data theft.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
