ransomware

lockbit, exploit, ransomware

Confluence Exploit Leads to LockBit Ransomware

February 24, 2025

lockbit cobaltstrike ransomware

lockbit, cobaltstrike, ransomware

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

January 27, 2025

blackcat cobaltstrike ransomware

blackcat, cobaltstrike, ransomware, sliver

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

September 30, 2024

adfind blacksuit cobaltstrike

adfind, blacksuit, cobaltstrike, ransomware

BlackSuit Ransomware

August 26, 2024

alphv cobaltstrike icedid

alphv, cobaltstrike, icedid, ransomware

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

June 10, 2024

dagonlocker adfind cobaltstrike

dagonlocker, adfind, cobaltstrike, icedid

From IcedID to Dagon Locker Ransomware in 29 Days

April 29, 2024

nokoyawa adfind Exfiltrate Data

nokoyawa, adfind, Exfiltrate Data, icedid, ransomware

From OneNote to RansomNote: An Ice Cold Intrusion

April 1, 2024

Exfiltrate Data ransomware rdp

Exfiltrate Data, ransomware, rdp, trigona

Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours

January 29, 2024

bluesky cobaltstrike ransomware

bluesky, cobaltstrike, ransomware

SQL Brute Force Leads to BlueSky Ransomware

December 4, 2023

Hive cobaltstrike ransomware

Hive, cobaltstrike, ransomware, wmiexec

From ScreenConnect to Hive Ransomware in 61 hours

September 25, 2023

Access DFIR Labs Book a Demo

The DFIR Report provides in-depth, real-world intelligence based on observed intrusions, enabling security analysts and teams  to strengthen defenses, enhance detection,  and accelerate response.