The DFIR Report

From a recent Threat Actor Insight report titled "Navigating Through The Fog" "The DFIR Report’s Threat Intel Group identified an open directory on 2024-12-09. The directory was likely linked to a ransomware operator associated with the Fog group, first observed in mid-2024. Analysis of its contents revealed a comprehensive toolkit used for reconnaissance, exploitation, credential theft, and command-and-control activities. Among the tools were SonicWall Scanner for exploiting VPN credentials, DonPAPI for extracting Windows DPAPI-protected credentials, Certipy for abusing Active Directory Certificate Services (AD CS), Zer0dump, and Pachine/noPac for exploiting Active Directory vulnerabilities like vulnerability CVE-2020-1472. Victim data found in the directory indicated targets across multiple industries, including technology, education, and logistics, with a geographic focus on Italy, Greece, Brazil, and the USA." Threat Intel Services: https://lnkd.in/gfTNqTHV Detection Rules: https://lnkd.in/gFjUk2vS Contact Us: https://lnkd.in/gk-yfpJm

??DFIR Labs CTF?? Our next CTF will be June 7 1630 UTC - 2030 UTC. ??Only $9.99 to join! ??Choose Elastic or Splunk as your SIEM ??Get access to a NEW, un-released case ??Top 5 are invited to join The DFIR Report team! Register: https://lnkd.in/gJTtb64f

We’re excited to be back at the SANS Ransomware Summit this year! This time, we’ll be delivering the keynote, sharing fresh insights on the ransomware landscape! It's free to join! ??

Another excellent report from our friends at Proofpoint!

PYSA/Mespinoza Ransomware ??TTR 7.5 hours ??Koadic and Empire for C2 ??7+ Credential Access techniques ??ADRecon, APS, quser, net, arp, and nltest for Discovery ??RDP and PsExec for Lateral Movement ??Files exfiltrated ??PYSA ransomware for Impact Report: https://lnkd.in/e_YRCCm Threat Intel Services: https://lnkd.in/gfTNqTHV Detection Rules: https://lnkd.in/gFjUk2vS Contact Us: https://lnkd.in/gk-yfpJm

From a recent Private Threat Brief titled "Unpacking the Threat: From EarthTime Comes SecTopRAT, and SystemBC" "The intrusion began when a user downloaded and executed an executable impersonating DeskSoft’s EarthTime application. This binary initiated a chain of execution leading to the deployment of SecTopRat, a .NET-based remote access trojan (RAT) with information-stealing capabilities. During our investigation we discovered an Uncontrolled Search Path vulnerability in DeskSoft's EarthTime installer, this could allow attackers to replace installation files with malicious versions, leading to code execution. This issue affects all DeskSoft software, and we are awaiting a CVE assignment from MITRE. The discovery of Grixba, a reconnaissance tool linked to Play ransomware and a previous NetScan output containing data from a company reportedly compromised by DragonForce ransomware, suggests the likely objective of this intrusion was ransomware deployment." Threat Intel Services: https://lnkd.in/gfTNqTHV Detection Rules: https://lnkd.in/gFjUk2vS Contact Us: https://lnkd.in/gk-yfpJm

?? Huge THANK YOU to everyone who joined the DFIR Labs CTF this weekend! Over 200 people from around the world jumped in to tackle challenges based on a real case—and we hope you all had fun, learned something new, and sharpened your DFIR skills ???? Keep an eye on our socials for the next DFIR Labs CTF announcement! ?? Interested in running a CTF at your organization? Please fill out this form and we’ll get in touch: https://lnkd.in/gfJFji_M The case featured in this CTF is now available: https://lnkd.in/g3ymsFab

?? Congratulations to our winners ?? ??1st Place: d1d1d1 @DreSecX ??2nd Place: Mohanasundaram Adaikkappan ??3rd Place: m.frithnz @Friffnz We hope everyone enjoyed playing in our #DFIRLabsCTF!

?? DFIR Labs CTF – Starts in 2 Hours! ?? Time is running out! Our next CTF kicks off at 16:00 UTC – there's still time to register! Register below ??

?? SOC L1/L2 Opening in #CPX in March 2025?? You want to directly access the technical interview with myself and my team members and get my referral for these positions ? Register to the next "the DFIR Report CTF" and finish with a better ranking than mine ! https://lnkd.in/d2k8f5Ta PS: No need to DM me before the end of the CTF. #CPX #thedfirreport