EncapsulateJay @EncapsulateJ

I worked with @RussianPanda9xx and @TheDFIRReport to investigate and publish this flash alert. The trojanized payloads (disguised as legitimate tools like Greenshot, SyncTrayzor, DocFX, and Cake) established primary C2 channels through ClickHouse and Supabase, with secondary backup channels capable of dynamically falling back to Ably, Dropbox, direct HTTP, or even GitHub Issues. This campaign ultimately delivered The Gentleman Ransomware, with aggressive data exfiltration via Rclone and lateral movement using GoTo Resolve RMM. Read the flash report below ⬇️ #dfir #tuktukc2 #etherRAT

The DFIR Report @TheDFIRReport

a month ago

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware In April, we observed an intrusion that began with a malicious MSI masquerading as Sysinternals RAMMap and ended in domain-wide deployment of The Gentlemen ransomware. The intrusion featured EtherRAT,

4 38 99 27K 58

@xorJosh

Inspired by @Antonlovesdnb #ClaudeForBlueTeam, I wanted to use Claude for something productive & helpful, I decided to make Web extension that blocks clickfix, replaces clipboard content and alerts the user. joshallman.co.uk/posts/shipping… github.com/xorjosh/ClipSh…

Most SOC reports and write-ups are punchy, to-the-point, polished reports. After all, every investigation (regardless of vertical) starts out as a chaotic mix of different threads that we corral into order like a tired sheepdog dreaming of making it as an internet meme and retiring on the royalties. Unfortunately, these polished reports don't capture how we actually form our suspicions, the pivots, the dead ends, the moment it all starts to make some semblance of sense. If you've ever wondered what that process actually looks like, I've spun up a blog series that breaks down real MDR incidents to capture what it's like riding the investigation roller-coaster, so those new to the industry can see how we progress from start to end within the context of a SOC investigation. Please enjoy this breakdown of a threat actor's attempt to enumerate and pivot further into the victim's environment — made with 100% organic human analyst tears! jevonang.com/Investigations…

DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. 🍎 Introducing 𝗜𝗥𝗙𝗹𝗼𝘄 𝗧𝗶𝗺𝗲𝗹𝗶𝗻𝗲 — a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmerman’s Timeline Explorer. Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if it’s in the app, it’s because I needed it mid-case and realized the standard tools fell short. No dependencies. Zero setup. Just drag, drop, and analyze. #dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics

Really great report here from @malforsec, @lapadrino, and @PeteO @TheDFIRReport . Even easier on the eye with the site's new facelift, give it a read 🔥thedfirreport.com/2026/02/23/apa…

@Kostastsale Wishing you all the success In the world with this venture mate! No doubt it will be a high quality resource!

@TheDFIRReport crew have gone and done it again. Really interesting report here. Sneaky exposed RDP port lead to full blown ransomware. Great work @Friffnz @MittenSec

The DFIR Report @TheDFIRReport

7 months ago

🐈 Cat’s Got Your Files: Lynx Ransomware 🎉New report out by @Friffnz, Daniel Casenove & @MittenSec!🎉 Attackers used stolen creds to access RDP, quickly pivoted to a DC with a second compromised admin, created impersonation accounts, mapped the environment, and more.

4 36 115 18K 57

@Friffnz @SecBlueTeam Telling you, man, your handle should be Baba Yaga. Those who know know 🤣

@TheDFIRReport dropped the full report related to the CTF event that was held over the weekend. @RussianPanda9xx smashed it on this one 💣 thedfirreport.com/2025/09/29/fro…

Cheers to @TheDFIRReport team for all the guidance and mentorship. This was a really interesting case to work!

The DFIR Report @TheDFIRReport

9 months ago

🌟New report out today!🌟 Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Analysis and reporting completed by @r3nzsec, @EncapsulateJ, @rkonicekr, & Adam Rowe Audio: Available on Spotify, Apple, YouTube and more! Report:⬇️

3 42 115 31K 37

ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️ New variant drops Lumma after Defender exclusion: - Prompts for elevation till user accept - Add defender exclusion on %temp% - Drops & runs Lumma Multiple Sigma rules fired 💥 Process Tree👇

keyboard_arrow_left Previous keyboard_arrow_right Next

There's pretty much never been a better time to start learning or get hands on blue team experience through labs. The availability and quality of labs being released today compared to 4 years ago is night and day. Training providers like Xintra are paving the way for the future!

inversecos @inversecos

10 months ago

NEW LAB: Scattered Spider (UNC3944) 🕷️🕸️ Scattered Spider hits indie studio AB Projekt Blue, deploying ransomware and stealing unreleased game code. Test your skills on: 👀 Social Engineering & MFA Fatigue 👀 Credential Theft via OST Files 👀 Bring Your Own Vulnerable Driver

keyboard_arrow_left Previous keyboard_arrow_right Next

13 85 511 72K 277

If you’re running an SSLVPN (SonicWall, Fortigate, etc.) and not retaining those logs, you’re setting yourself up for disaster. It's not uncommon to see sub-10 minute slices of activity in the totality of exported logs; which is next to useless.

🚨 Case from @HuntressLabs 🔎 Cephalus seen side loading DLL 'SentinelAgentCore.dll' into legitimate 'SentinelBrowserNativeHost.exe' for ransomware execution ✏️ File extension for encrypted files - '.sss'

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 Search for software, end up getting ransomware! SEO-driven #Bumblebee malware campaigns observed throughout July led to domain compromise, data theft & #Akira ransomware. Tools included #AdaptixC2 & #Netscan. thedfirreport.com/2025/08/05/fro…

Anton bringing the heat as always!

Anton @Antonlovesdnb

11 months ago

Got a new @HuntressLabs blog out today taking a look at some intrusion analysis methodology with practical examples - check it out! huntress.com/blog/intrusion…

4 52 201 36K 142

@SecurityAura 100% something as simple as an org implementing a standardised naming convention for all workstations and servers ahead of time can help detect anomalies super quick during an IR engagement.

Proud to work alongside these two 🔥 Congrats to you both!

Huntress @HuntressLabs

11 months ago

Congratulations to @RussianPanda9xx & @polygonben for having talks accepted at #defcon33! Follow these folks and if you're headed to @defcon put it on you to-do list to be in attendance!

3 17 90 27K 9

Best case scenario: send the VPN logs to a SIEM solution for safekeeping. VPN compromises are on the rise, and this will save you a lot of heartache in the heat of an incident.

If not, some awkward conversations need to be had........

If your organisation uses a third-party managed IT provider, and said IT provider says you have a shiny VPN with logging enabled. Please challenge the provider to prove that the VPN logs are configured correctly. A trusted IT partner will be happy to do this.