Reports

Follow Reports
Share on
Copy link to clipboard

The Digital Forensics and Incident Response (DFIR) Report. Real Intrusions by Real Attackers, The Truth Behind the Intrusion. A new report comes out every month! Read the rest of the reports at https://thedfirreport.com/. In addition to our publicly available reports, we provide a range of specialized services to meet your needs, such as private reports, Command and Control tracking, personalized mentoring, and access to an exclusive detection ruleset. Explore our comprehensive offerings on our Services page at https://thedfirreport.com/services/.

The DFIR Report


    • May 19, 2025 LATEST EPISODE
    • monthly NEW EPISODES
    • 14m AVG DURATION
    • 20 EPISODES


    Search for episodes from Reports with a specific topic:

    Latest episodes from Reports

    Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

    Play Episode Listen Later May 19, 2025 6:04


    Report: ⁠https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

    Navigating Through The Fog

    Play Episode Listen Later Apr 28, 2025 3:43


    Report: ⁠https://thedfirreport.com/2025/04/28/navigating-through-the-fog/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠

    Fake Zoom Ends in BlackSuit Ransomware

    Play Episode Listen Later Mar 31, 2025 6:10


    Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

    Confluence Exploit Leads to LockBit Ransomware

    Play Episode Listen Later Feb 24, 2025 5:40


    Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomwareContact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

    Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

    Play Episode Listen Later Jan 27, 2025 8:02


    Report: ⁠⁠https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠

    DFIR Discussions: The Curious Case of an Egg-Cellent Resume

    Play Episode Listen Later Jan 20, 2025 39:51


    We discuss our latest report "The Curious Case of an Egg-Cellent Resume" Host: ⁠⁠⁠⁠@Kostastsale⁠⁠⁠⁠ Analysts: ⁠⁠⁠⁠⁠⁠@_pete_0, Zach Stanford (aka @svch0st) Report: ⁠⁠⁠⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠ Music by FASSounds from Pixabay

    The Curious Case of an Egg-Cellent Resume

    Play Episode Listen Later Dec 2, 2024 7:10


    Report: ⁠https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/ Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

    Inside the Open Directory of the “You Dun” Threat Group

    Play Episode Listen Later Oct 28, 2024 4:17


    Report: https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group Contact Us: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

    Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

    Play Episode Listen Later Sep 30, 2024 6:45


    Report: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware Contact Us: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

    BlackSuit Ransomware

    Play Episode Listen Later Aug 26, 2024 5:15


    Report: ⁠https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ Contact Us: ⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠

    Threat Actors' Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts

    Play Episode Listen Later Aug 12, 2024 5:45


    Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts Contact Us: https://thedfirreport.com/contact/⁠⁠⁠⁠⁠ Services: ⁠https://thedfirreport.com/services/⁠⁠⁠⁠

    IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

    Play Episode Listen Later Jun 10, 2024 7:24


    Report: https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/⁠ Contact Us: ⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠ Services: ⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠

    DFIR Discussions: From IcedID to Dagon Locker Ransomware in 29 Days

    Play Episode Listen Later May 13, 2024 56:46


    We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days" Host: ⁠⁠⁠@Kostastsale⁠⁠⁠ Analysts: ⁠⁠⁠@r3nzsec & @angelo_violetti  Special Guest: ⁠⁠@nas_bench Report: ⁠⁠⁠https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠ Music by FASSounds from Pixabay

    From IcedID to Dagon Locker Ransomware in 29 Days

    Play Episode Listen Later Apr 29, 2024 7:52


    Report: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days Contact Us: ⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠ Services: ⁠⁠⁠https://thedfirreport.com/services/⁠⁠

    DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 2

    Play Episode Listen Later Apr 15, 2024 21:37


    We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠⁠@Kostastsale⁠⁠ Analysts: ⁠⁠@iiamaleks⁠, ⁠@IrishD34TH⁠, & ⁠@Miixxedup⁠ Special Guest: ⁠@techspence⁠ Feedback: https://forms.office.com/r/LR9NsEWYye Report: ⁠⁠https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/⁠ Contact Us: ⁠⁠https://thedfirreport.com/contact/⁠⁠ Services: ⁠⁠https://thedfirreport.com/services/⁠⁠ Music by FASSounds from Pixabay

    DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 1

    Play Episode Listen Later Apr 9, 2024 25:51


    We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion Host: ⁠@Kostastsale⁠ Analysts: ⁠@iiamaleks, @IrishD34TH, & @Miixxedup Special Guest: @techspence Report: ⁠https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ Contact Us: ⁠https://thedfirreport.com/contact/⁠ Services: ⁠https://thedfirreport.com/services/⁠ Music by FASSounds from Pixabay

    From OneNote to RansomNote: An Ice Cold Intrusion

    Play Episode Listen Later Apr 1, 2024 7:15


    Full Report - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion Feedback: https://forms.office.com/r/YY6w3gwd6A

    DFIR Discussions: SEO Poisoning to Domain Control: The Gootloader Saga Continues

    Play Episode Listen Later Mar 11, 2024 52:13


    Our first DFIR Discussions podcast on our latest report SEO Poisoning to Domain Control: The Gootloader Saga Continues Host: @Kostastsale Analysts: @_pete_0, @malforsec, & @r3nzsec Special Guest: @HackingLZ⁠ Feedback: https://forms.office.com/r/mK2Jp8vPXj Report: https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/ Contact Us: https://thedfirreport.com/contact/ Services: https://thedfirreport.com/services/ Music by FASSounds from Pixabay

    SEO Poisoning to Domain Control: The Gootloader Saga Continues

    Play Episode Listen Later Feb 26, 2024 8:07


    Report - https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues Provide feedback for a chance to win free swag - https://forms.office.com/r/MwZXkBrUNv

    Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours

    Play Episode Listen Later Jan 29, 2024 6:08


    Report: https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ Feedback: https://forms.office.com/r/pPajTA4Vwy

    Claim Reports

    In order to claim this podcast we'll send an email to with a verification link. Simply click the link and you will be able to edit tags, request a refresh, and other features to take control of your podcast page!

    Claim Cancel