Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
The On Again, Off Again Emotet is Now Back On
Emotet malware is back with new campaigns as of March 7th, 2023. Researchers discovered spam emails containing weaponized Office documents with embedded macros. Once users enable content, the macros execute to retrieve Emotet DLLs from a remote site and run them on the host machine.
Parallax RAT Sets Aim at Cryptocurrency Organizations
Parallax RAT is targeting cryptocurrency organizations with phishing campaigns. Active since 2019, this malware reads login credentials, gathers keystrokes, and gains remote desktop control. Recent attacks use process hollowing for stealth and persistence, allowing attackers to communicate via Notepad and instruct victims to connect to a Telegram channel.
New And Emerging Dangers Hide Within OneNote
Since December 2022, weaponized OneNote files have been increasingly used in phishing campaigns. These files distribute malware such as Formbook, Qakbot, and AsyncRAT. A recent Trustwave report highlights infection chains involving fake product inquiries and malicious OneNote documents, leading to data exfiltration and system compromises.
Malware with “radio silence” Mode Sneaks into Southeast Asian Entities
Sharp Panda, a Chinese cyber-espionage group, targets Southeast Asian government entities using the 'Soul' malware framework. This malware features a 'radio silence' mode, enabling stealthy communication with the C2 server. The campaign focuses on strategic nations, exploiting Equation Editor vulnerabilities in DOCX attachments.
Lazarus Abused an Unknown Software To Breach a Financial South Korea Organization
The Lazarus Group breached a South Korean financial institution twice in 2022 by exploiting vulnerabilities in an undisclosed software. The attacks involved disabling security measures and installing backdoors to establish remote control, demonstrating sophisticated tactics and persistence.
How Healthcare is a Prime Target for Cybercriminals
Healthcare is a prime target for cybercriminals, accounting for 6% of attacks. Patient data is highly valuable, making hospitals vulnerable to ransomware and DDoS attacks. Recent attacks by groups like Killnet highlight the sector's susceptibility to disruption and ransom demands.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
