Anvilogic Forge Threat Research Reports

Here you can find an accumulation of trending threats published weekly by the Anvilogic team.

We curate threat intelligence to provide situational awareness and actionable insights

Threat Identifier Detections

Atomic detections that serve as the foundation of our detection framework.

Threat Scenario Detections

Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.

Reports Hot Off the Forge

• Threat News Reports
‍• Trending Threat Reports
‍• ResearchArticles

Forge Threat Report

Forge Report: First Half Threat Trends of 2024

Anvilogic Forge's latest report offers essential insights into key threat trends and adversarial tactics observed in the first half of 2024. From the pervasive use of PowerShell and remote access tools to sophisticated social engineering and attacks on the healthcare sector, this comprehensive analysis provides actionable intelligence and detection rules to bolster your defenses. Explore our key findings and access ready-to-deploy detection content to enhance your security posture.

Read the Full Report

Featured Threat Reports

2025

NetSupport RAT Campaign Expands with ClickFix Technique

A malware campaign using fake CAPTCHA pages continues into 2025, now leveraging the ClickFix technique to trick users into executing NetSupport RAT. eSentire reports attackers using mshta.exe and PowerShell for stealthy infections, reinforcing the campaign’s persistence. NetSupport RAT enables remote control, data theft, and further malware deployment.

See the Report

View the Detection

2025

"BadPilot" Campaign From Russian APT Pose Ongoing Cyber Threat to Western Nations

Microsoft has identified the "BadPilot" cyber campaign by Russian APT Seashell Blizzard, which targets critical sectors across Western nations. Exploiting vulnerabilities in Microsoft Exchange, Zimbra, and Fortinet, the group employs RMM tools, web shells, and credential theft to enable long-term espionage and cyber disruptions, aligning with Russia’s geopolitical objectives.

See the Report

View the Detection

All Threat Reports

This is some text inside of a div block.

2021

Level:

Source:

OWASP

Server-Side Includes(SSI) Injection

Server-Side Includes (SSI) allow dynamic code within static HTML pages but can lead to Remote Command Execution (RCE) if improperly configured. Most web servers disable the exec directive by default to prevent this. SSI injection is similar to scripting language injection vulnerabilities, necessitating careful security measures.

Cybersecurity

This is some text inside of a div block.

2021

Level:

Source:

GitHub

Rubeus Createnetonly

Rubeus createnetonly uses CreateProcessWithLogonW() API to create hidden processes with a NewCredentials logon type. This method allows for the application of specific Kerberos tickets while preserving existing TGTs in the current logon session, ensuring secure and efficient credential management.

Cybersecurity

This is some text inside of a div block.

2021

Level:

Source:

TREND Mico,

Publicly exposed Docker API

Publicly exposed Docker Remote APIs on ports 2375/2376 pose significant security risks. Combined with CVE-2019-5736, which allows root access from a container, these vulnerabilities can lead to a fully compromised host. By default, the remote API should only be accessible locally to prevent unauthorized access and potential network threats.

Information & Technology

This is some text inside of a div block.

2021

Level:

Source:

NIST, CISCO

CVE-2020-3452

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, identified as CVE-2020-3452, could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. This vulnerability arises from improper input validation of URLs in HTTP requests processed by the affected device. An attacker could exploit this by sending a crafted HTTP request with directory traversal character sequences to the device, allowing them to view arbitrary files within the web services file system. This vulnerability is relevant when the device is configured with WebVPN or AnyConnect features but does not grant access to ASA or FTD system files or underlying OS files.

Cybersecurity

Information & Technology

About the Forge & Threat Reports

Deploy and maintain detections and threat hunt across all of your logging platforms and security tools without centralizing your data or deploying new agents.

Our mission is to assess the operational behaviors of all threats to provide the community, and our customers, with actionable information and enterprise-ready detections in order to defend themselves in an ever-changing threat landscape.