Live document - sections fill in as you complete them
Confidential // TLP:AMBER+STRICT // Intel - do not action outside SOC
Threat Assessment Report · foyl SecIntel
SUPPLY-001: Supply-Chain Staging
TA-003 SAPPHIRE FORGE · CAM-003 foyl SecIntel Recon · Pre-Attack Posture Assessment
Report ID
RPT-2026-SUP-001
Threat Actor
TA-003 SAPPHIRE FORGE
Campaign
CAM-003 foyl SecIntel Recon
Severity
-
Status
-
Assessment Type
-
Lookalike Domain
secintel-partner-hub.io
Confirmed Compromise
None observed
1 · Intelligence Summary
Pending - select what the intelligence actually supports
2 · Staging Timeline
Pending - reconstruct the observed staging activity
3 · IOC Decisions
Pending - decide what gets blocked, watched, and left alone
4 · Hunt & Hardening Plan
Pending - turn intelligence into proactive action
5 · MITRE ATT&CK Mapping
Pending - map the staging techniques
6 · Analyst Assessment
Pending - written in your own words
Prepared by analyst on shift foyl SecIntel ·
Assessment filed
SUPPLY-001 - Threat Assessment
All reports