We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Okta: 130+ DPRK Identities Linked to 6,500 Interviews at 5,000 Companies
Okta research reveals North Korea’s IT-worker program spans 130+ false identities tied to over 6,500 job interviews at 5,000 companies worldwide. The scheme targets technology, finance, healthcare, and government sectors, generating revenue and potential insider access. Okta warns of a mature, global threat using deception to gain remote roles.
TA415 Targets U.S.–China Policy Circles with VS Code Tunnel Intrusions
Proofpoint attributes a 2025 phishing campaign to TA415 / APT41, targeting U.S.–China policy, academic, and government sectors. Lures spoofed trade organizations and officials, dropping a Python loader that abuses Visual Studio Code’s Tunnel feature for remote command execution. The operation replaces traditional malware with living-off-the-land persistence.
Akira’s SonicWall Blitz: CVE-2024-40766 to Ransomware in Under 4 Hours
Arctic Wolf reports Akira campaigns (July 2025) exploiting SonicWall CVE-2024-40766 SSL VPN access to authenticate from VPS hosts, harvest credentials, and rapidly stage exfiltration and ransomware. Attacks compressed lateral movement and impact into minutes–hours. Arctic Wolf urges resetting VPN and AD credentials, revoking exposed keys, and tightening remote-access controls.
CISA Warns of ‘Shai-Hulud’ npm Worm: Review Dependencies, Rotate Developer Secrets
CISA warns that the “Shai-Hulud” npm worm compromised over 500 packages by stealing developer credentials and republishing tainted versions. The malware harvested GitHub tokens and cloud keys, spreading automatically across the npm ecosystem. CISA urges rotating secrets, enforcing MFA, and auditing dependencies to contain potential supply-chain impact.
SEO-poisoned GitHub Repos Push Atomic Stealer to macOS
LastPass researchers uncovered SEO-optimized GitHub repositories masquerading as Mac desktop apps to distribute the Atomic (AMOS) stealer. Victims are tricked into running a Terminal one-liner that downloads and executes a malicious installer, planting “/tmp/update.” The campaign spans dozens of fake repos targeting finance and technology users.
CISA Outlines Lessons Learned from the 2024 FCEB intrusion
CISA’s analysis of a 2024 FCEB intrusion attributes initial access to GeoServer CVE-2024-36401 exploitation, followed by China Chopper web shells, Stowaway proxy tunneling, and multi-platform reconnaissance. The incident highlights delayed patching, missing endpoint protection, and weak incident response coordination across a federal agency’s infrastructure.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
