The DFIR Report details BengalSEO’s SEO-poisoning operation, which uses malicious lure pages and traffic filtering to deliver MayaBot malware or direct victims to tech-support scams.
A DFIR investigation details two July 2025 intrusions linked to a BumbleBee SEO-poisoning campaign, tracing trojanized software downloads through AdaptixC2, credential theft and data exfiltration to Akira ransomware deployment.
A DFIR investigation details an intrusion that began with a malicious MSI, used EtherRAT and TukTuk for access and C2, exfiltrated data to Wasabi, and ended in domain-wide The Gentlemen ransomware deployment.
DFIR Report researchers found an exposed server documenting Bissa Scanner’s large-scale React2Shell exploitation, credential harvesting, and victim-data collection, with Claude Code and OpenClaw supporting the operator’s workflow.
A threat actor exploited an unpatched Apache ActiveMQ server twice using CVE-2023-46604, then used stolen credentials and RDP to deploy LockBit ransomware across the network.
Attackers used valid RDP credentials to enter a network, create privileged accounts, exfiltrate files, and deploy Lynx ransomware on backup and file servers over a nine-day intrusion.
A DFIR investigation details a nearly two-month intrusion that began with a tax-themed JavaScript file and involved multiple malware families, credential theft, lateral movement, and data exfiltration. No ransomware deployment was observed.
An intrusion began with a fake EarthTime installer that delivered SectopRAT. The attacker used SystemBC and Betruger, stole credentials, and exfiltrated files over unencrypted FTP before being evicted; no ransomware was deployed.
A July 2025 SEO-poisoning campaign delivered Bumblebee through trojanized IT-tool installers, enabling attackers to steal credentials, exfiltrate data, and deploy Akira ransomware across enterprise domains.
Researchers report that KongTuke web injections and a FileFix delivery method are deploying a new PHP-based Interlock RAT, which profiles compromised Windows systems, communicates through Cloudflare Tunnels and fallback IPs, and can enable persistence and remote command