Reports

Folgen

• 
  Apache MQ Exploit Leads to LockBit Ransomware 23.02.2026 5Min.

  Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
• 
  Cat's Got Your Files: Lynx Ransomware 17.11.2025 6Min.

  Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠⁠
• 
  From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion 29.09.2025 6Min.

  Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusionContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
• 
  Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs 08.09.2025 6Min.

  Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
• 
  Hide Your RDP: Password Spray Leads to RansomHub Deployment 30.06.2025 5Min.

  Report: ⁠⁠⁠⁠https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deploymentContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠
• 
  DFIR Discussions: Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 16.06.2025 38Min.

  We dive into our latest public report with Randy Pargman, Jake Ouellette, Kostas T., and Mangatas Tondang.Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠Music by FASSounds from Pixabay
• 
  Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware 19.05.2025 6Min.

  Report: ⁠https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠
• 
  Navigating Through The Fog 28.04.2025 3Min.

  Report: ⁠https://thedfirreport.com/2025/04/28/navigating-through-the-fog/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠
• 
  Fake Zoom Ends in BlackSuit Ransomware 31.03.2025 6Min.

  Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
• 
  Confluence Exploit Leads to LockBit Ransomware 24.02.2025 5Min.

  Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomwareContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
• 
  Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware 27.01.2025 8Min.

  Report: ⁠⁠https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠
• 
  DFIR Discussions: The Curious Case of an Egg-Cellent Resume 20.01.2025 39Min.

  We discuss our latest report "The Curious Case of an Egg-Cellent Resume" Host: ⁠⁠⁠⁠@Kostastsale⁠⁠⁠⁠ Analysts: ⁠⁠⁠⁠⁠⁠@_pete_0, Zach Stanford (aka @svch0st) Report: ⁠⁠⁠⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠ Music by FASSounds from Pixabay
• 
  The Curious Case of an Egg-Cellent Resume 02.12.2024 7Min.

  Report: ⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
• 
  Inside the Open Directory of the “You Dun” Threat Group 28.10.2024 4Min.

  Report: https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group Contact Us: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
• 
  Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware 30.09.2024 6Min.

  Report: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware Contact Us: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
• 
  BlackSuit Ransomware 26.08.2024 5Min.

  Report: ⁠https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠
• 
  Threat Actors' Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts 12.08.2024 5Min.

  Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts Contact Us: https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠https://thedfirreport.com/services/⁠⁠⁠⁠
• 
  IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment 10.06.2024 7Min.

  Report: https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/⁠ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠
• 
  DFIR Discussions: From IcedID to Dagon Locker Ransomware in 29 Days 13.05.2024 56Min.

  We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days" Host: ⁠⁠⁠@Kostastsale⁠⁠⁠ Analysts: ⁠⁠⁠@r3nzsec & @angelo_violetti  Special Guest: ⁠⁠@nas_bench Report: ⁠⁠⁠https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠ Music by FASSounds from Pixabay
• 
  From IcedID to Dagon Locker Ransomware in 29 Days 29.04.2024 7Min.

  Report: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠