DiscoverReports
Reports
Claim Ownership

Reports

Author: The DFIR Report

Subscribed: 22Played: 264
Share

Description

The Digital Forensics and Incident Response (DFIR) Report. Real Intrusions by Real Attackers, The Truth Behind the Intrusion.

A new report comes out every month! Read the rest of the reports at https://thedfirreport.com/.

In addition to our publicly available reports, we provide a range of specialized services to meet your needs, such as private reports, Command and Control tracking, personalized mentoring, and access to an exclusive detection ruleset. Explore our comprehensive offerings on our Services page at https://thedfirreport.com/services/.
25 Episodes
Reverse
Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠⁠
Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusionContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
Report: ⁠⁠⁠⁠https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deploymentContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
We dive into our latest public report with Randy Pargman, Jake Ouellette, Kostas T., and Mangatas Tondang.Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠Music by FASSounds from Pixabay
Report: ⁠https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠
Report: ⁠https://thedfirreport.com/2025/04/28/navigating-through-the-fog/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠
Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomwareContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
Report: ⁠⁠https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
We discuss our latest report "The Curious Case of an Egg-Cellent Resume" Host: ⁠⁠⁠⁠@Kostastsale⁠⁠⁠⁠ Analysts: ⁠⁠⁠⁠⁠⁠@_pete_0, Zach Stanford (aka @svch0st) Report: ⁠⁠⁠⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠ Music by FASSounds from Pixabay
Report: ⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
Report: https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group Contact Us: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
Report: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware Contact Us: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
BlackSuit Ransomware

BlackSuit Ransomware

2024-08-2605:15

Report: ⁠https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts Contact Us: https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠https://thedfirreport.com/services/⁠⁠⁠⁠
Report: https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/⁠ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠
We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days" Host: ⁠⁠⁠@Kostastsale⁠⁠⁠ Analysts: ⁠⁠⁠@r3nzsec & @angelo_violetti  Special Guest: ⁠⁠@nas_bench Report: ⁠⁠⁠https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠ Music by FASSounds from Pixabay
Report: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠
We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠⁠@Kostastsale⁠⁠ Analysts: ⁠⁠@iiamaleks⁠, ⁠@IrishD34TH⁠, & ⁠@Miixxedup⁠ Special Guest: ⁠@techspence⁠ Feedback: https://forms.office.com/r/LR9NsEWYye Report: ⁠⁠https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/⁠ Contact Us: ⁠⁠https://thedfirreport.com/contact/⁠⁠ Services: ⁠⁠https://thedfirreport.com/services/⁠⁠ Music by FASSounds from Pixabay
loading
Comments 
loading