Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
MuddyWater Crafts Email Compromises to Install Remote Access Software
Between February and March 2024, MuddyWater, known for aligning with Iran's foreign policies, intensified its spear-phishing campaigns across the EMEA region, focusing on defense, energy, government, and telecommunications sectors. Malwation reports detail the group's utilization of Business Email Compromise (BEC) to deliver malicious PDFs, leading to the installation of Remote Administration Management software like Atera and ConnectWise ScreenConnect. This strategy allows unprecedented control over victims' devices, showcasing MuddyWater's evolving tactics in cyber espionage and the critical need for heightened cybersecurity awareness within targeted industries.
MacOS Info-Stealing Attacks with Ad Scams & Fake Apps
Jamf Threat Labs reveals two MacOS malware campaigns, targeting users with ad scams and counterfeit software, including an attack masquerading as the Arc web browser and another using fake collaboration software "Meethub." These attacks, which exploit user trust to steal sensitive information like crypto wallet details, highlight the increasing threat to MacOS users and the importance of vigilance, especially within the cryptocurrency community.
JSOutProx's Phishing Operations Surge in Asia, Middle East, and Africa
Since February 2024, the distribution of JSOutProx, a Javascript backdoor malware, has notably increased in the APAC and MENA regions, targeting the financial and government sectors. Visa and research from Resecurity shed light on its deceptive techniques and potential links to Chinese cyber espionage efforts, marking a significant threat to global cybersecurity.
Apple Users Flooded with Unrelenting Phishing Prompts
Apple's password reset functionality is under exploit by a phishing scheme, bombarding users with continuous system-level prompts, a tactic known as "push bombing." Victims, including high-profile individuals, face unyielding attempts to compromise their data, with fraudsters leveraging caller ID spoofing to mimic Apple Support. This campaign's persistence indicates a significant oversight in Apple's security framework, particularly the absence of rate-limiting for password reset requests, posing severe usability and privacy risks. Security experts advocate for immediate system design corrections to mitigate these vulnerabilities.
TA577 Expands Cyber Activities Beyond Initial Access
TA577, recognized for their role as initial access brokers, has significantly expanded their cyberattack strategies into post-exploitation activities. Proofpoint's research highlights their use of Impacket and thread hijacking emails to harvest NTLM authentication hashes, demonstrating a shift towards more invasive and sophisticated operations. This evolution emphasizes the need for robust security measures, including outbound SMB connection monitoring and timely software updates, to protect against these advanced threat tactics.
Kimsuky’s Campaigns Leverage CHM Files for Enhanced Espionage
North Korea's Kimsuky group is employing CHM files in its cyberespionage efforts, targeting the defense, nuclear, and research industries worldwide. Rapid7 Labs reveals Kimsuky's advanced techniques, including the use of living-off-the-land binaries and container files, to bypass security and gather intelligence. The group's adaptability and technical sophistication highlight the ongoing challenge of cybersecurity and the need for vigilant defense strategies against such state-sponsored actors.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
