Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Stardust Chollima
CrowdStrike reports that North Korean hackers "Stardust Chollima" targeted Chinese security researchers in June 2021 with phishing emails containing malicious attachments. The emails, referencing Chinese security agencies, aimed to steal hacking techniques and zero-day exploits. The success of these attacks remains unknown.
RATDispenser a JavaScript Based Loader
HP Threat Research discovers RATDispenser, a JavaScript loader used to distribute multiple malware families like STRRAT, WSHRAT, RemcosRAT, and more. Operating under a malware-as-a-service model, RATDispenser spreads via malicious emails. Upon execution, it sets up a VBScript to download and execute the malware payload.
Tardigrade Targeting Bio-Manufacturing Facilities and Research Centers
BIO-ISAC reports Tardigrade's attacks on bio-manufacturing facilities and research centers, using a sophisticated SmokeLoader malware variant. First identified in Spring 2021, the malware spreads via phishing and USB sticks, impacting entities like Düsseldorf University and the European Medicines Agency, showing high autonomy and metamorphic capabilities.
PowerShortShell
SafeBreach Labs reports Iranian threat actors exploiting the MSHTML vulnerability (CVE-2021-40444) using the PowerShortShell script. The 153-line PowerShell script gathers data such as screen captures, Telegram files, and documents. The attack chain involves malicious emails, Word documents, and a DLL drop to the %temp% directory to execute PowerShortShell.
Google Cloud Threat Horizons
Google's Cybersecurity Action Team publishes its Threat Horizons report, revealing that 86% of compromised Google Cloud Platform (GCP) instances are used for crypto mining. Other malicious activities include public scanning (10%), launching attacks (8%), hosting malware (6%), hosting unauthorized content (4%), launching DDoS bots (2%), and sending spam (2%). Most successful attacks stem from weak passwords, authentication issues, vulnerable third-party software, misconfigurations, or leaked credentials. The report also tracks phishing by APT28/Fancy Bear and Black Matter ransomware.
InstallerFileTakeOver in use by Threat Actors
Security researcher Abdelhamid Naceri discovered the InstallerFileTakeOver vulnerability, a bypass of CVE-2021-41379 that wasn't properly patched by Microsoft in November 2021. This vulnerability allows users to escalate their privileges to admin. Cisco Talos has identified malware samples exploiting this vulnerability in the wild.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
