We curate threat intelligence to provide situational awareness and actionable insights
Threat Identifier Detections
Atomic detections that serve as the foundation of our detection framework.
Threat Scenario Detections
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
Reports Hot Off the Forge
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Dragos: Manufacturing Industry Leads Amongst Ransomware Targets in 2022
Dragos' 2022 report highlights the manufacturing sector as the primary target for ransomware attacks, with LockBit as the top ransomware group. Other heavily targeted industries include food & beverage, energy, and pharmaceuticals, pointing to critical security challenges in network visibility and segmentation.
‘MortalKombat’ Ransomware Emerges
Cisco Talos discovers the ‘MortalKombat’ ransomware, which aggressively targets global systems by encrypting system files and applications. Often deployed with the Laplas clipper malware, it enters through exposed RDP ports or phishing campaigns. Victims span across the U.S., U.K., Turkey, and the Philippines.
New Sneaky 'Beep' Malware
The 'Beep' malware employs advanced evasion techniques, including anti-VM and analysis tactics. Identified by Minerva, it uses a three-component structure to persistently collect and exfiltrate data, avoiding detection with sophisticated methods. The malware is still in development, promising more advanced capabilities in the future.
Dalbit Threat Group Runs Attack Campaigns Against Korean Companies
Dalbit, a threat group, has executed over 50 ransomware attacks on Korean companies since 2022. Targeting mid to small-sized firms across various industries, they exploit vulnerabilities and use Chinese tools for privilege escalation and data exfiltration, affecting sectors like technology, industrial, and manufacturing.
Chinese Espionage Group Exploits Systems with Equation Editor Vulnerability
Group-IB discovered Tonto Team, a Chinese espionage group, exploiting Microsoft Equation Editor vulnerabilities via phishing campaigns. Using the Royal Road RTF Weaponizer, they targeted industries including education, energy, and government, deploying Bisonal.DoubleT backdoor malware for data exfiltration and remote command execution.
Clop Ransomware Releases a Flawed Linux Encryptor
SentinelLabs identified a flaw in the new Linux variant of the Clop ransomware, enabling decryption. The encryptor, found in the wild on December 26th, 2022, is in its development stage with missing features and a critical encryption flaw involving a hardcoded RC4 master key.
About the Forge & Threat Reports
Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever- changing threat landscape.
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
.svg)
.svg)
.png)
Build Detections You Want, Where You Want
