Anvilogic Forge Threat Research Reports
Here you can find an accumulation of trending threats published weekly by the Anvilogic team.
We curate threat intelligence to provide situational awareness and actionable insights
Atomic detections that serve as the foundation of our detection framework.
Risk, pattern, and sequence-based detections utilizing the outputs of Threat Identifiers as a means of identifying actual threats.
• Threat News Reports
• Trending Threat Reports
• ResearchArticles
Forge Report: First Half Threat Trends of 2024
Featured Threat Reports
All Threat Reports
ESXiArgs Ransomware Updates to Thwart Recovery Efforts
The ESXiArgs ransomware campaign has updated its encryption routine to thwart recovery efforts. The new routine encrypts 50% of data in files over 1MB, making recovery difficult. Initial exploitation methods remain unclear, with conflicting reports on vulnerabilities used.
North Korean Actors Seeks Funds from Critical Infrastructure Organizations
DPRK ransomware operations target critical infrastructure and healthcare sectors to generate revenue for state objectives. Exploiting vulnerabilities like Log4Shell and SonicWall flaws, North Korean actors use ransomware variants such as Maui and H0lyGh0st, demanding Bitcoin payments via Proton Mail.
Maritime-related Entities in Pakistan Target in Espionage Campaign
NewsPenguin targets Pakistan's maritime entities with a phishing campaign using PIMEC as a lure. The attack aims to collect sensitive data from military tech manufacturers and expo participants. The campaign uses weaponized Word documents and IP-based payload delivery.
TA866: A Financially Motivated Group with a Custom Toolset
TA866 targets US and German organizations with phishing emails to distribute custom malware tools like AHK Bot, WasabiSeed, Screenshotter, and Rhadamanthys stealer. Active since October 2022, the group's sophisticated attacks have escalated to tens of thousands of emails daily by January 2023.
BYOVD Combos with the Sliver Framework to Exploit Sunlogin Vulnerabilities
Threat actors exploit Sunlogin vulnerabilities to deploy the Sliver framework and BYOVD malware, disabling security products. ASEC researchers highlight the use of remote code execution vulnerabilities and PowerShell to launch malicious payloads, including GhostRAT and XMRig CoinMiner.
QakBot Pairs with OneNote
QakBot malware campaigns now exploit OneNote, distributing weaponized files through spam emails. Sophos researchers found that recipients are tricked into clicking a link or attachment, leading to QakBot infections via malicious OneNote documents.
.png)
Intelligence Levels for Threat Reports
Tactical
Detectable threat behaviors for response with threat scenarios or threat identifiers.
Strategic
General information security news, for awareness.
.png)
Whitepapers
The World's Best SOC Teams Use Anvilogic
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
