We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
From CL-STA-0043 to Phantom Taurus: Multi-Year Hunt Reveals New PRC Cyber Playbook
Unit 42 formally identifies Phantom Taurus, a PRC-aligned APT evolved from cluster CL-STA-0043. Active since 2023, it targets government and telecom networks across Africa, the Middle East, and Asia. The group employs the .NET-based NET-STAR suite, IIS in-memory persistence, timestomping, and SQL-focused data exfiltration for espionage objectives.
W-9 Lure Kicks Off 28-Day Intrusion Ending in Exfiltration With No Ransomware
A May 2024 intrusion beginning with a malicious W-9 JavaScript downloader developed into a patient 28-day operation. Operators used Brute Ratel, Cobalt Strike, Zerologon, and living-off-the-land techniques to harvest credentials, move laterally, and exfiltrate data. The campaign ended with eviction—no ransomware was deployed.
Okta: 130+ DPRK Identities Linked to 6,500 Interviews at 5,000 Companies
Okta research reveals North Korea’s IT-worker program spans 130+ false identities tied to over 6,500 job interviews at 5,000 companies worldwide. The scheme targets technology, finance, healthcare, and government sectors, generating revenue and potential insider access. Okta warns of a mature, global threat using deception to gain remote roles.
TA415 Targets U.S.–China Policy Circles with VS Code Tunnel Intrusions
Proofpoint attributes a 2025 phishing campaign to TA415 / APT41, targeting U.S.–China policy, academic, and government sectors. Lures spoofed trade organizations and officials, dropping a Python loader that abuses Visual Studio Code’s Tunnel feature for remote command execution. The operation replaces traditional malware with living-off-the-land persistence.
Akira’s SonicWall Blitz: CVE-2024-40766 to Ransomware in Under 4 Hours
Arctic Wolf reports Akira campaigns (July 2025) exploiting SonicWall CVE-2024-40766 SSL VPN access to authenticate from VPS hosts, harvest credentials, and rapidly stage exfiltration and ransomware. Attacks compressed lateral movement and impact into minutes–hours. Arctic Wolf urges resetting VPN and AD credentials, revoking exposed keys, and tightening remote-access controls.
CISA Warns of ‘Shai-Hulud’ npm Worm: Review Dependencies, Rotate Developer Secrets
CISA warns that the “Shai-Hulud” npm worm compromised over 500 packages by stealing developer credentials and republishing tainted versions. The malware harvested GitHub tokens and cloud keys, spreading automatically across the npm ecosystem. CISA urges rotating secrets, enforcing MFA, and auditing dependencies to contain potential supply-chain impact.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
