adfind

adfind, blacksuit, cobaltstrike, ransomware

BlackSuit Ransomware

August 26, 2024

dagonlocker adfind cobaltstrike

dagonlocker, adfind, cobaltstrike, icedid

From IcedID to Dagon Locker Ransomware in 29 Days

April 29, 2024

nokoyawa adfind Exfiltrate Data

nokoyawa, adfind, Exfiltrate Data, icedid, ransomware

From OneNote to RansomNote: An Ice Cold Intrusion

April 1, 2024

nokoyawa adfind Attribution

nokoyawa, adfind, Attribution, icedid, ransomware

HTML Smuggling Leads to Domain Wide Ransomware

August 28, 2023

adfind Attribution cobaltstrike

adfind, Attribution, cobaltstrike, Exfiltrate Data, FIN11, FlawedGrace, Lace Tempest, truebot

A Truly Graceful Wipe Out

June 12, 2023

nokoyawa adfind cobaltstrike

nokoyawa, adfind, cobaltstrike, icedid, macro, ransomware, xls

IcedID Macro Ends in Nokoyawa Ransomware

May 22, 2023

quantum adfind cobaltstrike

quantum, adfind, cobaltstrike, icedid, ransomware, rclone, ShareFinder

Malicious ISO File Leads to Domain Wide Ransomware

April 3, 2023

adfind cobaltstrike ransomware

adfind, cobaltstrike, ransomware

Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware

November 28, 2022

adfind bumblebee cobaltstrike

adfind, bumblebee, cobaltstrike, Meterpreter

BumbleBee Zeros in on Meterpreter

November 14, 2022

adfind cobaltstrike Qbot

adfind, cobaltstrike, Qbot

Follina Exploit Leads to Domain Compromise

October 31, 2022

Access DFIR Labs Book a Demo

The DFIR Report provides in-depth, real-world intelligence based on observed intrusions, enabling security analysts and teams  to strengthen defenses, enhance detection,  and accelerate response.