Skip to content
  • Analysts
  • Contact Us
  • Services
  • Subscribe

The DFIR Report

Real Intrusions by Real Attackers, The Truth Behind the Intrusion

  • Analysts
  • Contact Us
  • Services
  • Subscribe
Monday, March 20, 2023

Category: yara

Ryuk in 5 Hours
adfind bazar cobaltstrike ransomware rdp ryuk yara

Ryuk in 5 Hours

October 18, 2020

Intro The Ryuk threat actors went from a phishing email to domain wide ransomware in 5 hours. They escalated privileges using Zerologon (CVE-2020-1472), less than 2 hours after the initial … Read More

adfindbazarcobalt strikekegtapmalspamryuk
Dridex – From Word to Domain Dominance
dridex empire yara

Dridex – From Word to Domain Dominance

August 3, 2020
Snatch Ransomware
Meterpreter ransomware rdp yara

Snatch Ransomware

June 21, 2020

Another RDP brute force ransomware strikes again, this time, Snatch Team! Snatch Team was able to go from brute forcing a Domain Administrator (DA) account via RDP, to running a … Read More

The Little Ransomware That Couldn’t (Dharma)
ransomware rdp yara

The Little Ransomware That Couldn’t (Dharma)

June 16, 2020

Ransomware continues unabated in the year of continually mounting pressure. But for every big game actor out there compromising Fortune listed companies there are the little guys that maybe just … Read More

Lockbit Ransomware, Why You No Spread?
ransomware rdp yara

Lockbit Ransomware, Why You No Spread?

June 10, 2020

RDP brute forcing continues to be a favorite entry point for ransomware actors. In this past month we saw activity from the Lockbit ransomware family. Initial Access: RDP login from … Read More

Tweets by TheDFIRReport

Copyright 2023 | The DFIR Report | All Rights Reserved