We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Caution with Copy Pasting
In a blog post on Wizer, a security training platform, founder Gabriel Friedlander revealed that malicious JavaScripts can hide within a web page's HTML. These scripts use 'event listeners' to replace clipboard data, potentially tampering with commands users copy and paste into command terminals. This poses a significant risk as the modified commands can be executed without the user's awareness, either manually or with a new line.
BlackTech - "Flagpro"
NTT Security has observed the threat actor group BlackTech utilizing new malware named Flagpro to target Japanese companies. The attack begins with spear-phishing emails containing a zip attachment with a malicious Excel document. Upon macro execution, the Flagpro executable is dropped into the startup directory, executing on the next system launch. Flagpro communicates with its C2 server via base64 encoded traffic and can download additional tools, execute OS commands, and collect Windows authentication information. If the compromised host is deemed suitable, the attackers proceed to download the second stage malware.
Conti & Log4Shell from AdvIntel
AdvIntel's latest report highlights the Conti ransomware group's exploitation of the Log4Shell vulnerability. After a lack of viable attack vectors since November, Conti found an opportunity with Log4Shell, initiating scanning activities for the exploit. Conti members targeted specific vulnerable Log4J2 VMware vCenter systems, using these for lateral movement directly from compromised networks. This activity affected US and European victim networks, leveraging pre-existing Cobalt Strike sessions. AdvIntel confirms the ransomware group's renewed activity, posing significant risks to global networks.
Threat Group Aggah (TH-157)
Yoroi Malware ZLAB tracks Aggah (TH-157) targeting Eastern Europe with a nine-stage attack involving malicious PowerPoint macros, MSHTA execution, and AgentTesla infostealer. The group varies payload delivery infrastructure every 80 minutes, targeting Ukraine, Lithuania, Italy, and additional Eastern European countries for reconnaissance and data theft.
Sports Gear Sites Data Breach Impacts 1.8 Million People
A cyberattack on Tackle Warehouse, Running Warehouse, Tennis Warehouse, and Skate Warehouse compromised credit card information of 1.8 million customers. Disclosed by a representing law firm, the breach includes names, financial account numbers, credit/debit card numbers with CVV, and account passwords. Notices were sent to affected customers without identity protection services.
Malicious Microsoft Exchange IIS Module Owowa
Kaspersky has identified a malicious implant targeting Microsoft Exchange Outlook Web Access (OWA) applications, dubbed "Owowa." The implant enables remote command execution and captures user credentials from authenticated OWA users. Discovered in late 2020, Owowa has been circulating since April 2021 in parts of Europe, Malaysia, Mongolia, Indonesia, and the Philippines. The malicious module, named "ExtenderControlDesigner," is loaded via a PowerShell script.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
