The DFIR Report

Reports

Technology EN ↓ Odcinki: 26

The Digital Forensics and Incident Response (DFIR) Report. Real Intrusions by Real Attackers, The Truth Behind the Intrusion. A new report comes out every month! Read the rest of the reports at https://thedfirreport.com/.In addition to our publicly available reports, we provide a range of specialized services to meet your needs, such as private reports, Command and Control tracking, personalized mentoring, and access to an exclusive detection ruleset. Explore our comprehensive offerings on our Services page at https://thedfirreport.com/services/.

Koniecznie odwiedź stronę podcastu i wesprzyj twórcę: thedfirreport.com

Autor

The DFIR Report

Kategoria

Technology

Strona podcastu

thedfirreport.com

Ostatni odcinek

23 lut 2026

Gdzie słuchać?

Podcasty w aplikacji Replaio Radio Już wkrótce

Podcasty trafią do aplikacji już wkrótce. Zainstaluj teraz i jako pierwszy zobacz nowe podejście do podcastów

Zainstaluj za darmo Android 5 mln+ pobrań · ocena 4,8 iOS niedługo

Odcinki

Apache MQ Exploit Leads to LockBit Ransomware 23.02.2026 5:52

Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Cat's Got Your Files: Lynx Ransomware 17.11.2025 6:41

Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠⁠

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion 29.09.2025 6:27

Report: ⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs 08.09.2025 6:21

Report: ⁠⁠⁠⁠⁠ ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

Hide Your RDP: Password Spray Leads to RansomHub Deployment 30.06.2025 5:42

Report: ⁠⁠⁠ ⁠ https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠

DFIR Discussions: Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 16.06.2025 38:08

We dive into our latest public report with Randy Pargman , Jake Ouellette , Kostas T. , and Mangatas Tondang . Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠ Music by FASSounds from Pixabay

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 19.05.2025 6:04

Report: ⁠ https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

Navigating Through The Fog 28.04.2025 3:43

Report: ⁠ https://thedfirreport.com/2025/04/28/navigating-through-the-fog/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

Fake Zoom Ends in BlackSuit Ransomware 31.03.2025 6:10

Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

Confluence Exploit Leads to LockBit Ransomware 24.02.2025 5:40

Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware 27.01.2025 8:02

Report: ⁠⁠https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠ ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

DFIR Discussions: The Curious Case of an Egg-Cellent Resume 20.01.2025 39:51

We discuss our latest report "The Curious Case of an Egg-Cellent Resume" Host: ⁠⁠⁠⁠@Kostastsale⁠⁠⁠⁠ Analysts: ⁠ ⁠⁠⁠⁠ ⁠ @_pete_0 , Zach Stanford (aka @svch0st ) Report: ⁠⁠⁠ ⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠ Music by FASSounds from P...

The Curious Case of an Egg-Cellent Resume 02.12.2024 7:10

Report : ⁠ https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us : ⁠⁠⁠⁠ ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Inside the Open Directory of the “You Dun” Threat Group 28.10.2024 4:17

Report : https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group Contact Us : ⁠⁠⁠⁠ ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware 30.09.2024 6:45

Report : https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware Contact Us : ⁠⁠⁠⁠ ⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

BlackSuit Ransomware 26.08.2024 5:15

Report : ⁠https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ Contact Us : ⁠⁠⁠⁠ ⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services : ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

Threat Actors' Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts 12.08.2024 5:45

Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts Contact Us: https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠https://thedfirreport.com/services/⁠⁠⁠⁠

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment 10.06.2024 7:24

Report : https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/⁠ Contact Us : ⁠⁠⁠⁠ https://thedfirreport.com/contact/⁠⁠⁠⁠ Services : ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠

DFIR Discussions: From IcedID to Dagon Locker Ransomware in 29 Days 13.05.2024 56:46

We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days" Host: ⁠⁠⁠@Kostastsale⁠⁠⁠ Analysts: ⁠ ⁠⁠ @r3nzsec & @angelo_violetti Special Guest: ⁠⁠ @nas_bench Report : ⁠⁠⁠ https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ Contact Us : ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services : ⁠⁠⁠https://thedfirreport.com/services/⁠⁠...

From IcedID to Dagon Locker Ransomware in 29 Days 29.04.2024 7:52

Report : https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days Contact Us : ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services : ⁠⁠⁠https://thedfirreport.com/services/⁠⁠

DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 2 15.04.2024 21:37

We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠⁠@Kostastsale⁠⁠ Analysts: ⁠ ⁠@iiamaleks⁠ , ⁠@IrishD34TH⁠ , & ⁠@Miixxedup⁠ Special Guest: ⁠@techspence⁠ Feedback : https://forms.office.com/r/LR9NsEWYye Report : ⁠ ⁠https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/⁠ Contact Us : ⁠⁠https://thedfirreport.com/contact/⁠⁠ Servic...

DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 1 09.04.2024 25:51

We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠@Kostastsale⁠ Analysts: ⁠ @iiamaleks , @IrishD34TH , & @Miixxedup Special Guest: @techspence Report : ⁠ https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ Contact Us : ⁠https://thedfirreport.com/contact/⁠ Services : ⁠https://thedfirreport.com/services/⁠ Music by FASSounds f...

From OneNote to RansomNote: An Ice Cold Intrusion 01.04.2024 7:15

Full Report - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion Feedback: https://forms.office.com/r/YY6w3gwd6A

DFIR Discussions: SEO Poisoning to Domain Control: The Gootloader Saga Continues 11.03.2024 52:13

Our first DFIR Discussions podcast on our latest report SEO Poisoning to Domain Control: The Gootloader Saga Continues Host: @Kostastsale Analysts: @_pete_0 , @malforsec , & @r3nzsec Special Guest: @HackingLZ⁠ Feedback : https://forms.office.com/r/mK2Jp8vPXj Report : https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/ Contact Us : https://thedfir...

SEO Poisoning to Domain Control: The Gootloader Saga Continues 26.02.2024 8:07

Report - https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues Provide feedback for a chance to win free swag - https://forms.office.com/r/MwZXkBrUNv