The DFIR Report

Reports

The Digital Forensics and Incident Response (DFIR) Report. Real Intrusions by Real Attackers, The Truth Behind the Intrusion. A new report comes out every month! Read the rest of the reports at https://thedfirreport.com/.In addition to our publicly available reports, we provide a range of specialized services to meet your needs, such as private reports, Command and Control tracking, personalized mentoring, and access to an exclusive detection ruleset. Explore our comprehensive offerings on our Services page at https://thedfirreport.com/services/.

Autor

The DFIR Report

Categoría

Technology

Web del podcast

thedfirreport.com

Último episodio

23 de feb. de 2026

¿Dónde escuchar?

Podcasts en la app Replaio Radio Muy pronto

Los podcasts llegarán muy pronto a la app. Instálala ahora y sé el primero en descubrir una forma totalmente nueva de vivir los podcasts

Descárgala en Google Play Instálala gratis Android 5 M+ de descargas · valoración de 4,8 iOS muy pronto

Episodios

Apache MQ Exploit Leads to LockBit Ransomware 23.02.2026

Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Cat's Got Your Files: Lynx Ransomware 17.11.2025

Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠⁠

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion 29.09.2025

Report: ⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs 08.09.2025

Report: ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

Hide Your RDP: Password Spray Leads to RansomHub Deployment 30.06.2025

Report: ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

DFIR Discussions: Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 16.06.2025

We dive into our latest public report with Randy Pargman , Jake Ouellette , Kostas T. , and Mangatas Tondang . Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠ Music by FASSounds from Pixabay

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 19.05.2025

Report: ⁠ https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

Navigating Through The Fog 28.04.2025

Report: ⁠ https://thedfirreport.com/2025/04/28/navigating-through-the-fog/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

Fake Zoom Ends in BlackSuit Ransomware 31.03.2025

Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

Confluence Exploit Leads to LockBit Ransomware 24.02.2025

Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware 27.01.2025

Report: ⁠⁠https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

DFIR Discussions: The Curious Case of an Egg-Cellent Resume 20.01.2025

We discuss our latest report "The Curious Case of an Egg-Cellent Resume" Host: ⁠⁠⁠⁠@Kostastsale⁠⁠⁠⁠ Analysts: ⁠ ⁠⁠⁠⁠ ⁠ @_pete_0 ,  Zach Stanford  (aka  @svch0st ) Report: ⁠⁠⁠ ⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠ Music by FASSounds from P...

The Curious Case of an Egg-Cellent Resume 02.12.2024

Report : ⁠ https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us : ⁠⁠⁠⁠ ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Inside the Open Directory of the “You Dun” Threat Group 28.10.2024

Report : https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group Contact Us : ⁠⁠⁠⁠ ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware 30.09.2024

Report : https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware Contact Us : ⁠⁠⁠⁠ ⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

BlackSuit Ransomware 26.08.2024

Report : ⁠https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ Contact Us : ⁠⁠⁠⁠ ⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Threat Actors' Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts 12.08.2024

Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts Contact Us: https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠https://thedfirreport.com/services/⁠⁠⁠⁠

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment 10.06.2024

Report : https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/⁠ Contact Us : ⁠⁠⁠⁠ https://thedfirreport.com/contact/⁠⁠⁠⁠ Services : ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠

DFIR Discussions: From IcedID to Dagon Locker Ransomware in 29 Days 13.05.2024

We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days" Host: ⁠⁠⁠@Kostastsale⁠⁠⁠ Analysts: ⁠ ⁠⁠ @r3nzsec & @angelo_violetti   Special Guest: ⁠⁠ @nas_bench Report : ⁠⁠⁠ https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ Contact Us : ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services : ⁠⁠⁠https://thedfirreport.com/services/⁠⁠...

From IcedID to Dagon Locker Ransomware in 29 Days 29.04.2024

Report : https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days Contact Us : ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services : ⁠⁠⁠https://thedfirreport.com/services/⁠⁠

DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 2 15.04.2024

We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠⁠@Kostastsale⁠⁠ Analysts: ⁠ ⁠@iiamaleks⁠ , ⁠@IrishD34TH⁠ , & ⁠@Miixxedup⁠ Special Guest: ⁠@techspence⁠ Feedback : https://forms.office.com/r/LR9NsEWYye Report : ⁠ ⁠https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/⁠ Contact Us : ⁠⁠https://thedfirreport.com/contact/⁠⁠ Servic...

DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 1 09.04.2024

We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠@Kostastsale⁠ Analysts: ⁠ @iiamaleks , @IrishD34TH , & @Miixxedup Special Guest: @techspence Report : ⁠ https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ Contact Us : ⁠https://thedfirreport.com/contact/⁠ Services : ⁠https://thedfirreport.com/services/⁠ Music by FASSounds f...

From OneNote to RansomNote: An Ice Cold Intrusion 01.04.2024

Full Report - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion Feedback: https://forms.office.com/r/YY6w3gwd6A

DFIR Discussions: SEO Poisoning to Domain Control: The Gootloader Saga Continues 11.03.2024

Our first DFIR Discussions podcast on our latest report SEO Poisoning to Domain Control: The Gootloader Saga Continues Host: @Kostastsale Analysts: @_pete_0 , @malforsec , & @r3nzsec Special Guest: @HackingLZ⁠ Feedback : https://forms.office.com/r/mK2Jp8vPXj Report : https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/ Contact Us : https://thedfir...

SEO Poisoning to Domain Control: The Gootloader Saga Continues 26.02.2024

Report - https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues Provide feedback for a chance to win free swag - https://forms.office.com/r/MwZXkBrUNv

Escucha el podcast Reports en Replaio

Radio y podcasts en una sola app - gratis y sin registro. Instálala hoy y no te pierdas el estreno

Descárgala en Google Play

Replaio no es editor de podcasts; los nombres de los programas, las portadas y el audio pertenecen a sus autores y se distribuyen a través de canales RSS públicos