Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
DarkWatchman - Fileless Malware
Prevailion’s Adversarial Counterintelligence Team (PACT) uncovered DarkWatchman, a fileless JavaScript-based RAT. Utilizing Domain Generation Algorithms (DGA) for C2 and achieving persistence via the registry, DarkWatchman avoids disk writes, pairs with a C# keylogger, and leverages LOLbins.
McMenamins Suffers Conti Ransomware Attack
On December 12, 2021, Portland brewery and hotel chain McMenamins suffered a ransomware attack by Conti, disrupting operations. The attack impacted point-of-sale systems, servers, and workstations, forcing the company to shut down its IT systems. The investigation is ongoing, and it is currently unknown if customer data has been compromised.
ALPHV/BlackCat ransomware - Technical Information from Symantec
Symantec's examination of the ALPHV/BlackCat ransomware reveals a targeted attack using SMB, registry manipulation, and PsExec to deploy malware and disable security systems on November 18, 2021.
APT31 Intrusion Set from ANSSI
ANSSI tracks APT31's intrusion tactics since January 2021, using methods like brute force, valid accounts, and Proxylogon exploits. Persistent actions include task scheduling, lateral movement via RDP/FTP/SMB, and data exfiltration through email, DNS, and SMB.
CVE-2021-44228 / Log4Shell Vulnerability
A zero-day exploit named CVE-2021-44228 (Log4Shell) was discovered in the Log4j library, affecting versions 2.0-beta9 to 2.14.1. This vulnerability allows remote code execution and impacts major services. Update to log4j-2.15.0-rc2 to mitigate the threat.
NSO Spyware Compromises US State Department Employees' Phones
Apple informed nine US State Department employees that their iPhones were compromised by NSO Pegasus spyware. The affected officials were either based in Uganda or focused on East African matters. The compromises occurred over the past several months, as reported by two Reuters sources.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
