Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
Threat Group "Cyber Toufan" Emerges with Capabilities Beyond Typical Hacktivist Collectives
Cyber Toufan, tracked by Kevin Beaumont, shows unusual capabilities for a hacktivist group. With focused attacks on organizations including Israeli state entities, they've caused substantial damage, erasing data and disrupting operations. Using tools like Tor and shred, Cyber Toufan's operations are a warning of evolving cyber threats.
UAC-0099's Persistent Cyber Campaigns Target Ukrainians Abroad
UAC-0099, active since mid-2022, specifically targets Ukrainians abroad. Employing PowerShell and VBScript, they use deceptive emails and exploit WinRAR vulnerabilities (CVE-2023-38831). Their methods include LNK files, HTA applications, and ZIP files, all disguised as court summons, indicating a targeted, consistent approach in their cyber campaigns.
AsyncRAT Campaign Exploits Microsoft Processes
Trend Micro's Managed XDR team exposes a sophisticated AsyncRAT campaign exploiting Microsoft's aspnet_compiler.exe. The malware, known for keylogging and remote control, uses intricate scripts for evasion and persistence. Monitoring for unusual activities and process injections is vital to detect and defend against these evolving cyber threats.
Akira Ransomware Escalates Threat with Expanding Cyber Attacks
Sophos MDR Threat Intelligence reveals the escalating threat of Akira ransomware. Targeting multiple sectors, Akira employs complex cyber attacks, including the Megazord variant. Sophos's analysis highlights the group's advanced tactics and emphasizes the need for robust cybersecurity measures in response to these evolving threats.
APT29 Targets Tech Companies via TeamCity Flaw
CISA's advisory focuses on the Russian threat group APT29 (also known as the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard) exploiting the JetBrains TeamCity vulnerability, CVE-2023-42793. This high-severity flaw, rated 9.8/10, has been targeted at technology companies since late September 2023.
MuddyWater's Campaign Focuses on Telecom Sector in Three African Nations
Symantec's Threat Hunter team has uncovered that MuddyWater, an Iranian espionage group also known as Seedworm, is actively targeting telecommunications companies in Egypt, Sudan, and Tanzania as of November 2023. This marks a notable expansion of MuddyWater's activities beyond the Middle East. The group uses a complex attack chain involving PowerShell, scheduled tasks, WMIExec, SOCKS5 proxy tool Revsocks, and remote access software like SimpleHelp and AnyDesk.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
Trusted by leading teams at
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
