cobaltstrike

Hive, cobaltstrike, ransomware, wmiexec

From ScreenConnect to Hive Ransomware in 61 hours

September 25, 2023

adfind Attribution cobaltstrike

adfind, Attribution, cobaltstrike, Exfiltrate Data, FIN11, FlawedGrace, Lace Tempest, truebot

A Truly Graceful Wipe Out

June 12, 2023

nokoyawa adfind cobaltstrike

nokoyawa, adfind, cobaltstrike, icedid, macro, ransomware, xls

IcedID Macro Ends in Nokoyawa Ransomware

May 22, 2023

quantum adfind cobaltstrike

quantum, adfind, cobaltstrike, icedid, ransomware, rclone, ShareFinder

Malicious ISO File Leads to Domain Wide Ransomware

April 3, 2023

cobaltstrike Exfiltrate Data ursnif

cobaltstrike, Exfiltrate Data, ursnif, wmiexec

Unwrapping Ursnifs Gifts

January 9, 2023

adfind cobaltstrike ransomware

adfind, cobaltstrike, ransomware

Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware

November 28, 2022

adfind bumblebee cobaltstrike

adfind, bumblebee, cobaltstrike, Meterpreter

BumbleBee Zeros in on Meterpreter

November 14, 2022

adfind cobaltstrike Qbot

adfind, cobaltstrike, Qbot

Follina Exploit Leads to Domain Compromise

October 31, 2022

adfind bumblebee cobaltstrike

adfind, bumblebee, cobaltstrike, Meterpreter

BumbleBee: Round Two

September 26, 2022

adfind cobaltstrike emotet

adfind, cobaltstrike, emotet, Exfiltrate Data, Kerberoast, ShareFinder

Dead or Alive? An Emotet Story

September 12, 2022

Access DFIR Labs Book a Demo

The DFIR Report provides in-depth, real-world intelligence based on observed intrusions, enabling security analysts and teams  to strengthen defenses, enhance detection,  and accelerate response.