Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Compromised Credentials Enabled PowerSchool Data Exfiltration, CrowdStrike Report Finds
A CrowdStrike-led investigation found that compromised credentials enabled threat actors to access PowerSchool SIS data via the PowerSource portal. Data from student and teacher records was exfiltrated. No malware or further system access was detected. PowerSchool enforced MFA, SSO, and VPN restrictions and offered identity protection to affected users.
Urgent Patching Advised as CVE-2024-4577 Sees Widespread Exploitation
CVE-2024-4577, a PHP-CGI RCE flaw on Windows, is being actively exploited across multiple sectors, including technology, education, and telecom. Cisco Talos and GreyNoise report attacks involving Cobalt Strike, PowerShell payloads, and privilege escalation tools. Organizations are urged to patch immediately to prevent persistence, data theft, and further compromise.
#StopRansomware Features Medusa with Tight IAB Connections Pose Ongoing Threat to Critical Infrastructure
CISA warns Medusa ransomware poses a major threat to critical infrastructure, with over 300 victims across healthcare, education, manufacturing, and more. Medusa affiliates exploit CVEs, use phishing, disable EDR tools, and exfiltrate data before encryption. The group engages in double and triple extortion, often demanding cryptocurrency payments via Tor.
Microsoft Warns of Growing Cyber Risks in Rural Healthcare
Microsoft warns rural U.S. hospitals face escalating cyber threats from ransomware and nation-state actors. Limited resources and outdated tech leave them vulnerable, risking patient care and hospital viability. Microsoft calls for urgent investment, launching a cybersecurity program and urging government support to protect critical healthcare infrastructure.
Lotus Blossom Uses Sagerunex for Long-Term Access
Cisco Talos links Lotus Blossom to long-running cyber espionage using the Sagerunex backdoor. Active since 2016, Sagerunex variants integrate with Dropbox, Twitter, and Zimbra for covert C2. Targeting governments and telecoms in Asia, the threat actor focuses on stealth, persistence, and data exfiltration via cloud-based infrastructure.
Black Basta Operators Suspected of Pivoting to Cactus Ransomware Following Leaked Chats
Trend Micro reports a shift from Black Basta to Cactus ransomware, citing leaked chats and shared TTPs, malware, and infrastructure. Social engineering via Microsoft Teams and Quick Assist is central to both groups. The suspected pivot raises concerns for sectors already hit by Black Basta, including manufacturing and finance.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.svg)
