iiinova — where your digital self keeps evolving

The DFIR Report @thedfirreport.bsky.social · 28/04/2026

"The ransom note did not follow the normal LockBit format directing victims to a Tor leak site or TOX/Jabber communications; instead, it instructed them to download and use the Session private messaging application... Report: thedfirreport.com/2026/02/23/a...

011

The DFIR Report @thedfirreport.bsky.social · 23/04/2026

Day 9: Ransomware deployment. The threat actor RDP’d from the beachhead to backup & file servers and dropped the Lynx payload “w.exe” using a compromised Domain Admin account. Full breakdown 👇 thedfirreport.com/2025/12/17/c... #DFIR #Ransomware #ThreatHunting #BlueTeam #CyberSecurity

031

The DFIR Report @thedfirreport.bsky.social · 09/04/2026

Report: thedfirreport.com/2025/12/17/c... Services: thedfirreport.com/services/ Contact Us for pricing or a demo: thedfirreport.com/contact/

thedfirreport.com

000

The DFIR Report @thedfirreport.bsky.social · 09/04/2026

This Diamond Model from our “Cat’s Got Your Files: Lynx Ransomware” report illustrates the four core elements of the intrusion. See how all four vertices aligned for full-domain compromise 👇 thedfirreport.com/2025/12/17/c... #DFIR #ThreatIntel #Ransomware #BlueTeam #CyberSecurity

100

The DFIR Report @thedfirreport.bsky.social · 08/04/2026

"On some hosts, Microsoft Defender antivirus was active. On these systems, Defender detected and blocked execution of the service creation and Powershell execution..." Report:https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/

000

The DFIR Report @thedfirreport.bsky.social · 31/03/2026

"The threat actor also ran the command netstat -t, which displays active connections; however, -t is not a documented option for netstat on Windows." Report:https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/

120

The DFIR Report @thedfirreport.bsky.social · 30/03/2026

RDP bitmap cache artifacts revealed the threat actor opening the Veeam Backup & Replication console, reviewing backup jobs, tape & storage infrastructure — and removing backups from the configuration database. Full report 👇 thedfirreport.com/2025/12/17/c...

000

The DFIR Report @thedfirreport.bsky.social · 25/03/2026

We’re seeing a “Missing Font” ClickFix chain in the wild. Flow: 1️⃣ Fake “Missing Font” prompt 2️⃣ Leads to a BSOD-style recovery screen 3️⃣ Prompts users to open Terminal/PowerShell directly (skipping the Run dialog) and execute commands #infosec #DFIR #threatintel

032

The DFIR Report @thedfirreport.bsky.social · 19/03/2026

Defender Tip: Monitor for vol.exe or python.exe interacting with memory dump files in user temp folders. If you see Hashdump in your logs and it isn't your IR team... you have a live intrusion. Want more info? Get in touch!

000

The DFIR Report @thedfirreport.bsky.social · 19/03/2026

The Flow: A fake "Verify You Are Human" prompt leads to Node.js C2 (interlock RAT), followed by hands-on-keyboard activity where they use vol.exe from \AppData\Local\Temp\ to harvest credentials.

100

The DFIR Report @thedfirreport.bsky.social · 19/03/2026

➡️Dump RAM: Capturing mem.raw from the infected host. ➡️Extract Hashes: Using windows.hashdump to pull NTLM hashes. ➡️Steal Credentials: Using windows.cachedump to extract cached creds.

100

The DFIR Report @thedfirreport.bsky.social · 19/03/2026

Threat Actors are "Bringing Their Own Forensics" In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (vol.py) directly on victim machines. Commonly a tool for defenders, the TAs are using it to:

144

The DFIR Report @thedfirreport.bsky.social · 17/03/2026

"The IP 195.211.190[.]189 was hosted on infrastructure from Railnet LLC — a legal front for Russia-based bulletproof hosting provider Virtualine." Full report 👇 thedfirreport.com/2025/11/17/c... #DFIR #Ransomware #ThreatIntel #BlueTeam #CyberSecurity

110

The DFIR Report @thedfirreport.bsky.social · 16/03/2026

"On the Exchange email server, the threat actor used a legitimate Windows executable, SystemSettingsAdminFlows.exe, which allows users to customize or configure the system settings to user’s preference. This LOLBIN was used to disable Windows... " Report: thedfirreport.com/2026/02/23/a...

020

The DFIR Report @thedfirreport.bsky.social · 06/03/2026

➡️ The above is from a Private Threat Brief: "Fake WinSCP Software Serves Supper and Oyster " ➡️➡️Interested in receiving more details about this report? Contact us for a demo or pricing - thedfirreport.com/contact/

000

The DFIR Report @thedfirreport.bsky.social · 06/03/2026

"In the logs we first observed a new service being installed on the backup server. Following that we observed the service execute and spawn a process tree that included a command to use COMSVCS to output a credential dump to a file in the temp directory:"

120

The DFIR Report @thedfirreport.bsky.social · 05/03/2026

Low noise. High signal. If you get an alert from our feed in your environment, ping us. We’ll help triage it. That’s how much we trust the signal. 🔎 Actionable 🎯 High-confidence ⚡ Built for defenders thedfirreport.com/products/thr...

010

The DFIR Report @thedfirreport.bsky.social · 04/03/2026

Report: thedfirreport.com/2026/02/23/a... Services: thedfirreport.com/services/ Contact Us for pricing or a demo: thedfirreport.com/contact/

000

The DFIR Report @thedfirreport.bsky.social · 04/03/2026

"After the creation of the rdp.bat file, several commands were executed via a CMD process to modify the host configuration, specifically to permit RDP through the firewall and set the RDP port number to 3389..." Link to report ⬇️

100

The DFIR Report @thedfirreport.bsky.social · 03/03/2026

➡️ The above is from a Private Threat Brief: "Fake RVTools Installer Leads to PipeMagic, CLFS Exploit, and Ransomexx" ➡️➡️Interested in receiving more details about this report or future private reports? Contact us for a demo or pricing - thedfirreport.com/contact/

000

The DFIR Report @thedfirreport.bsky.social · 03/03/2026

"Around 50 minutes after the connection to this second domain controller the ransomware propagation began. Deployment of ransomware consisted of creating remote services on domain joined endpoints, and included distributing the files via SMB."

110

The DFIR Report @thedfirreport.bsky.social · 25/02/2026

"SoftPerfect NetScan was used extensively during the intrusion… evidence from Security Event ID 4688 logs showed mstsc.exe /v:<IP address> being launched by netscan.exe, confirming the use of NetScan’s Remote Desktop functionality." Full report 👇 thedfirreport.com/2025/11/17/c...

100

The DFIR Report @thedfirreport.bsky.social · 22/02/2026

🎉New report out Monday 2/23 by @malforsec, @lapadrino, and @PeteO! "The Base64 string $dsU contained the shellcode. We decoded it and used SpeakEasy..." If you would like to be notified when we publish the report 👉️ thedfirreport.com/subscribe/ #DFIR #IncidentResponse

020

The DFIR Report @thedfirreport.bsky.social · 21/02/2026

🎉New report out Monday 2/23 by @malforsec, @lapadrino, and @PeteO! "The first step in the exploitation was to send a maliciously crafted OpenWire command to the ActiveMQ server" If you would like to be notified when we publish the report 👉️ thedfirreport.com/subscribe/ #DFIR

000

The DFIR Report @thedfirreport.bsky.social · 19/02/2026

➡️ The above is from a Private Threat Brief: "Fake RVTools Installer Leads to PipeMagic, CLFS Exploit, and Ransomexx" ➡️➡️Interested in receiving more details about this report or would like IOCs in near real time? Contact us for a demo or pricing - thedfirreport.com/contact/

thedfirreport.com

000

The DFIR Report @thedfirreport.bsky.social · 19/02/2026

SEO poisoning ➡️ Fake RVTools ➡️ Python backdoor ➡️ PipeMagic ➡️ CVE-2025-29824 ➡️ #Ransomexx — domain-wide in <19 hrs. The Python backdoor connected to azure-secure-agent[.]com (87.251.67[.]241), enabling cmd/PowerShell exec, payload download, screenshots, and IP discovery.

120

The DFIR Report @thedfirreport.bsky.social · 18/02/2026

🧪 DFIR Labs | ALPHV Case #24952 Follow a real intrusion where IcedID led to ScreenConnect, custom C# tooling, and an ALPHV ransomware deployment. Hands-on analysis of attacker tradecraft from access to impact. 👉 dfirlabs.thedfirreport.com/auth/login

020

The DFIR Report @thedfirreport.bsky.social · 13/02/2026

Don’t just block threats — disrupt them. Our IR-driven Threat Feed helps you: 🔎 Detect attacker infrastructure early ⚡ Hunt for active footholds 🛡️ Reduce false positives with continuously verified intel Get the edge: thedfirreport.com/contact/ #ThreatIntel #BlueTeam #DFIR

010

The DFIR Report @thedfirreport.bsky.social · 12/02/2026

🐱 Cat’s Got Your Files: Lynx Ransomware Attackers abused valid credentials to access RDP, created high-privilege accounts for persistence, mapped the environment, and exfiltrated data before deploying Lynx ransomware. Report 👇 thedfirreport.com/2025/11/17/c...

000

The DFIR Report @thedfirreport.bsky.social · 11/02/2026

🤝 We’ve partnered with @13CubedDFIR to level up your #DFIR training. 🔹 DFIR Labs users: Finish a quiz & get $100 OFF 13Cubed courses. 🔹 13Cubed users: Buy "Investigating Windows Endpoints" & get 20% OFF DFIR Labs! 👉 training.13cubed.com 👉 dfirlabs.thedfirreport.com

000

The DFIR Report @thedfirreport.bsky.social · 10/02/2026

🧪 DFIR Labs | BlueSky Ransomware Lab Dive into a real investigation where a SQL brute force attack led to rapid BlueSky ransomware deployment. Explore how attackers compromised MSSQL, then used Cobalt Strike and Tor2Mine to spread ransomware! 👉 dfirlabs.thedfirreport.com/auth/login

030

The DFIR Report @thedfirreport.bsky.social · 09/02/2026

➡️ The above is from a recent Private Threat Brief: "Job Interview or North Koreans: A Contagious Interview Intrusion" ➡️➡️Interested in receiving private reports like this one? Contact us for a demo or pricing - thedfirreport.com/contact/

thedfirreport.com

Visit the post for more.

000

The DFIR Report @thedfirreport.bsky.social · 09/02/2026

We analyzed a DPRK-linked Contagious Interview intrusion where fake job lures abused npm install for C2 using trusted packages. A modular toolset (OtterCookie, InvisibleFerret, Tsunami) enabled cross-platform access and data theft targeting wallets, creds, and docs.

111

The DFIR Report @thedfirreport.bsky.social · 07/01/2026

🧪 DFIR Labs | LockBit Ransomware Case #27244 Investigate a real intrusion where a compromised Confluence server led to rapid domain-wide access. Step through the investigation and see how LockBit was deployed end-to-end. 👉 dfirlabs.thedfirreport.com/auth/login

020

Reposted by The DFIR Report

The DFIR Report @thedfirreport.bsky.social · 26/12/2025

DFIR Labs is closing out the year with 25% off all cases and subscriptions. ✔ Buy now, redeem anytime over the next 3 months ⏰ Offer ends January 1 💳 Discount applied automatically at checkout dfirlabs.thedfirreport.com

011

The DFIR Report @thedfirreport.bsky.social · 26/12/2025

011

The DFIR Report @thedfirreport.bsky.social · 22/12/2025

➡️ The above is from a Private Threat Brief: "SSH by ClickFix: Node.js RAT Leads to SystemBC and S3 Exfiltration " ➡️➡️Interested in receiving reports like this one? Contact us for a demo or pricing - lnkd.in/gk-yfpJm

000

The DFIR Report @thedfirreport.bsky.social · 22/12/2025

"The unusual command copied to the user's clipboard abused the SSH ProxyCommand option to quietly invoke the Windows Installer (msiexec) and download a payload, marking the start of the intrusion."

120

The DFIR Report @thedfirreport.bsky.social · 22/12/2025

🎁 DFIR Labs Giveaway 🎁 We’re giving away 5 FREE DFIR Labs cases! How to enter: ➡️Post your favorite DFIR Report ➡️Tell us why it's your favorite That’s it! 🙌 We’ll select 5 winners before Christmas! DFIR Labs - dfirlabs.thedfirreport.com/auth/login Reports - thedfirreport.com

012

The DFIR Report @thedfirreport.bsky.social · 10/12/2025

➡️ The above is from a recent Private Threat Brief: "Signed Malware, PowerShell Abuse, and Azure Exfiltration in Fake WinSCP Intrusion" ➡️➡️Interested in receiving reports like this one? Contact us for a demo or pricing - thedfirreport.com/contact/

000

The DFIR Report @thedfirreport.bsky.social · 10/12/2025

We identified a malvertising campaign targeting users searching for legitimate software, leading to the download of a trojanized WinSCP installer that deployed Broomstick/OysterLoader. All files involved in the initial access phase were signed with valid certificates.

110

Reposted by The DFIR Report

The DFIR Report @thedfirreport.bsky.social · 24/11/2025

🎉 BLACK FRIDAY DEAL IS LIVE! 🎉 Now until December 1st, all swag in our store is 50% OFF — shirts, hoodies, and stickers, while supplies last! 🎁 Bonus: Every order comes with 2 FREE DFIR Report stickers! Don’t miss it — once it’s gone, it’s gone. store.thedfirreport.com/collections/...

011

The DFIR Report @thedfirreport.bsky.social · 24/11/2025

011

The DFIR Report @thedfirreport.bsky.social · 20/11/2025

000

The DFIR Report @thedfirreport.bsky.social · 20/11/2025

"...It's unclear why they scanned these external IPs. An interesting observation is that they scanned public IP ranges which hosted the C2 addresses used by Supper:"

100

The DFIR Report @thedfirreport.bsky.social · 20/11/2025

"Checking the registry and network traffic, we could identify ranges they scanned. They most likely ran several scans in Advanced IP scanner. We found evidence of scans for private IP ranges as well as multiple public IP ranges belonging to Microsoft and other entities..."

100