Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
New AsyncRAT & 3LOSH Crypter Malware Campaigns
Cisco Talos research tracks the use of 3LOSH crypter in malware campaigns distributing AsyncRAT and LimeRAT. These campaigns begin with an ISO disk image and use PowerShell scripts to create persistence and evade detection in corporate environments, showing increased activity over recent months.
Nordex Group's Cyber Attack
Nordex Group, a wind turbine manufacturer, experienced a cyberattack on March 31, 2022, leading to a precautionary shutdown of IT systems globally. The company's incident response team, comprising internal and external experts, was activated immediately to contain the issue and assess potential exposure. No further updates have been provided.
ALPHV Ransomware Hits North Carolina A&T University
North Carolina A&T University was targeted by ALPHV ransomware between March 7-11, disrupting vital network services and compromising personal data. Recovery is ongoing, with significant student impact.
APT10/Cicada Espionage Attacks
Symantec reports an expanded espionage campaign by APT10 (Cicada) targeting government and NGO entities across Europe, Asia, and North America. Techniques include exploiting Microsoft Exchange Servers and using tools like Sodamaster and Mimikatz.
Mandiant's Research of FIN7
Mandiant's updated research tracks the evolution of threat group FIN7 from late 2021 to early 2022, revealing its associations with ransomware operations like Maze, Darkside, Blackmatter, and ALPHV/Blackcat. FIN7 targets multiple industries, including financial services, food, medical, technology, transportation, and utilities. Mandiant tracks multiple uncategorized threat groups (UNCs) affiliated with FIN7. The group has refined its tools, with newer intrusions frequently using their PowerShell backdoor, PowerPlant, over older malware like LOADOUT and GRIFFON.
Lambda Malware, Denonia
Cado Security has identified Denonia, a new malware targeting AWS Lambda environments to deploy cryptominers. Written in Go, Denonia uses GitHub libraries and contains XMRig cryptominer software. The malware utilizes DNS over HTTPS (DoH) for encrypted DNS queries. It can also run on select Linux systems. The exact deployment method is unknown, but it may involve compromising AWS Access and Secret Keys to manually deploy into Lambda environments.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
