The DFIR Report

The DFIR Report

SELECT XMRig FROM SQLServer

In March 2022, we observed an intrusion on a public-facing Microsoft SQL Server. The end goal of this intrusion was to deploy a coin miner.

The DFIR Report

Contact DFIR Report | Get in Touch with Our Team

Reach out to DFIR Report for inquiries, demos, or career opportunities. Connect with our team today to strengthen your cybersecurity program.

The DFIR Report

IcedID to XingLocker Ransomware in 24 hours

In this intrusion, we observed the threat actors use multiple DLL Beacons that would call out to different Cobalt Strike C2 channels. The threat actors used batch scripts during the intrusion for a number of purposes, primarily to disable antivirus programs and execute payloads.

DFIR Labs - Digital Forensics Challenge

The DFIR Report

The DFIR Report | Active Defense

Expose real attackers before they strike. DFIR’s Active Defense Threat Insights uses decoys and honeypots to deliver direct, actionable cyber intelligence.

The DFIR Report

Mattie Schuch - The DFIR Report

Hi, I’m Mattie—cyber threat hunter, detection enthusiast, and someone who genuinely enjoys chasing weird leads until they turn into something meaningful. I’ve spent almost a decade in cyber, mostly focused on building detections, tracking threat actors, and trying to make sense of the chaos they leave behind. I currently lead a detection team, but I’m […]

The DFIR Report

DFIR Labs | Hands-On DFIR Training with Real Intrusion Data

Investigate real cyberattacks in cloud-based DFIR Labs. Work in Elastic or Splunk with real logs and earn badges, certificates, and CPE credits.

The DFIR Report

DFIR Report | Access Private DFIR Reports with Forensic Intel

Get timely, unredacted threat intelligence. Private DFIR Reports provide forensic-level insights to power detection, response, and adversary emulation.

The DFIR Report

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira - The DFIR Report

Key Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to the same campaign. This report contains data from both intrusions. We plan to release a DFIR Labs […]

The DFIR Report

Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting - The DFIR Report

We recently discovered an exposed server that was used for multi-victim exploitation, staging, review, and validation. Claude Code and OpenClaw were used as an operator-side harness supporting exploitation activity and workflow orchestration. We identified a large-scale React2Shell (CVE-2025-55182) operation that scanned millions of targets and confirmed 900+ successful exploits. Logs showed an automated pipeline for exploitation, hit scoring, alerting, and secret harvesting.

The DFIR Report

Apache ActiveMQ Exploit Leads to LockBit Ransomware - The DFIR Report

Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon.  This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an exposed Apache ActiveMQ server. The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java Spring […]

The DFIR Report

Apache ActiveMQ Exploit Leads to LockBit Ransomware - The DFIR Report

Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon.  This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an exposed Apache ActiveMQ server. The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java Spring […]

The DFIR Report

Cat’s Got Your Files: Lynx Ransomware - The DFIR Report

Key Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system. Notably, there was no evidence of credential stuffing, brute forcing, or other failed authentication attempts from the source IP, indicating the […]

The DFIR Report

The DFIR Report | Subscribe

Stay ahead of cyber threats with The DFIR Report. Subscribe to receive the latest digital forensics and incident response analyses, ransomware insights, and expert threat intelligence — straight to your inbox.

The DFIR Report

The DFIR Report | Threat Feed

Gain early, actionable insight with DFIR’s human-curated threat feed. Detect C2 infrastructure fast, prevent attacks, and stay ahead of adversaries.

The DFIR Report

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware - The DFIR Report

In April, we observed an intrusion linked to the Atos-reported campaign where an EtherRAT was installed via a malicious MSI masquerading as a Sysinternals tool. Later in the intrusion, we observed the deployment of a new malware framework named TukTuk, first reported by Evangelos G, which, according to their analysis, is AI-generated. In addition to this, the threat actor used the RMM GoTo Resolve. Using this access, they successfully exfiltrated data to a cloud service and then deployed The Gen

DFIR Labs - Digital Forensics Challenge