We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Massachusetts Utility Targeted by Advanced Persistent Threat Linked to China
A Dragos investigation revealed VOLTZITE, tied to China’s Volt Typhoon, breached a Massachusetts utility in 2023, maintaining OT network access for over 300 days. The group exfiltrated critical grid data but avoided customer PII. LELWD has since enhanced network defenses and segmentation to prevent future intrusions.
Compromised Credentials Enabled PowerSchool Data Exfiltration, CrowdStrike Report Finds
A CrowdStrike-led investigation found that compromised credentials enabled threat actors to access PowerSchool SIS data via the PowerSource portal. Data from student and teacher records was exfiltrated. No malware or further system access was detected. PowerSchool enforced MFA, SSO, and VPN restrictions and offered identity protection to affected users.
Urgent Patching Advised as CVE-2024-4577 Sees Widespread Exploitation
CVE-2024-4577, a PHP-CGI RCE flaw on Windows, is being actively exploited across multiple sectors, including technology, education, and telecom. Cisco Talos and GreyNoise report attacks involving Cobalt Strike, PowerShell payloads, and privilege escalation tools. Organizations are urged to patch immediately to prevent persistence, data theft, and further compromise.
#StopRansomware Features Medusa with Tight IAB Connections Pose Ongoing Threat to Critical Infrastructure
CISA warns Medusa ransomware poses a major threat to critical infrastructure, with over 300 victims across healthcare, education, manufacturing, and more. Medusa affiliates exploit CVEs, use phishing, disable EDR tools, and exfiltrate data before encryption. The group engages in double and triple extortion, often demanding cryptocurrency payments via Tor.
Microsoft Warns of Growing Cyber Risks in Rural Healthcare
Microsoft warns rural U.S. hospitals face escalating cyber threats from ransomware and nation-state actors. Limited resources and outdated tech leave them vulnerable, risking patient care and hospital viability. Microsoft calls for urgent investment, launching a cybersecurity program and urging government support to protect critical healthcare infrastructure.
Lotus Blossom Uses Sagerunex for Long-Term Access
Cisco Talos links Lotus Blossom to long-running cyber espionage using the Sagerunex backdoor. Active since 2016, Sagerunex variants integrate with Dropbox, Twitter, and Zimbra for covert C2. Targeting governments and telecoms in Asia, the threat actor focuses on stealth, persistence, and data exfiltration via cloud-based infrastructure.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
