Real Intrusions by Real Attackers, the Truth Behind the Intrusion
thedfirreport.com/contact
- Tweets 1,862
- Following 0
- Followers 70,493
- Likes 755
Pinned Tweet
New logo. New website. Same DFIR Report team. π
Check out the incredible analysts behind the research:
thedfirreport.com/company/anβ¦
6
24
233
27,536
π οΈ Tool Tuesday: AnyDesk
Legitimate remote-support software, and a common attacker backdoor. We repeatedly see AnyDesk silently installed as a service for persistent hands-on-keyboard access.
π Hunt tip: alert on unattended AnyDesk installs, service creation, and connections from unfamiliar AnyDesk IDs.
See it across real intrusions π buff.ly/NA1hVgK
1
1
12
1,480
"All of the newly created accounts have usernames that mimic legitimate accounts already present in the environment. For the rest of the report we will refer to these accounts as: 'administratr', 'Lookalike 1', and 'Lookalike 2'."
Read the full report: buff.ly/kJ1ukVK
#DFIR #ThreatIntel
2
8
48
4,048
π Private DFIR Reports
Context-rich, ground-truth intrusion analysis from real investigations: unredacted command lines, evidence-based timelines with exact timestamps, and annotated forensic artifacts, process trees, registry keys, and command outputs.
Built for detection engineering, IR, red teaming, analyst training, and AI/ML security models.
Contact us π buff.ly/AXx8KQQ
#DFIR #ThreatIntel
3
18
2,501
π¨ Early warning, from real adversary activity.
Active Defense monitors attacker interactions with your decoys around the clock and delivers customer-specific threat intelligence, so you detect and disrupt targeted activity before it reaches production.
Learn more π buff.ly/GvI6WMo
7
2,332
Nice write-up from the @GreyNoiseIO team on the proxyjacking activity we've been seeing.
We recently shared our observations from a compromised Linux server running Pawns.app. Their research adds some great context around the broader activity.
Always great to see the community sharing information!
H/T @ImposeCost for sharing π
greynoise.io/blog/proxyjackiβ¦
𧲠We recently saw a threat actor compromise an exposed Linux server and install Pawns.app, a legitimate "earn money from your bandwidth" agent, registered to their own account. The goal was to get paid while strangers route traffic through the victim's IP.
On the box, the threat actor:
πΉ dropped a JSP webshell and ran quick recon (id, uname -a, ip addr)
πΉ pulled the Pawns CLI with wget and hid copies as .p in /tmp, /var/tmp, /opt and /home
πΉ tried to persist with an @reboot cron entry
πΉ launched the agent with -email= -device-name= -accept-tos
Threat actors like proxyjacking for a few reasons:
πΉ The binary is the vendor's official app, so antivirus has nothing to catch
πΉ There's no CPU spike, just HTTPS to a well-known service
πΉ The abuse reports land on your IP, not theirs
IOCs:
Threat actor infrastructure (Pawns CLI pulled via wget):
144[.]172[.]86[.]173
209[.]99[.]190[.]80
Pawns account: skynox7@proton[.]me
Files: /tmp/.p, /var/tmp/.p, /opt/.p, /home/.p, /tmp/gotoschool
State file: /var/tmp/.config/pawns-cli/pawns-consent.log
To hunt for it, watch for web server processes spawning wget or curl, proxyware launch flags, and servers talking to services like Pawns, Honeygain, EarnApp or PacketStream.
Add proxyware to your hunt list next to miners and stealers.
2
5
39
3,765
π Congratulations to the top 5 winners of our 2026 DFIR Labs Digital Forensics Challenge, all hitting 9050 points!
π₯ 1st Place: @KoifSec
π₯ 2nd Place: gunturyk11
π₯ 3rd Place: @fs_alhumaid
π
4th Place: kapelo
π
5th Place: loadinGG
Players investigated Private Case #39390: ClickFix leads to Tsundere Bot, Tunnels, RMMs, and Double Theft, tracking a weeks-long intrusion featuring multiple RMMs, tunneling, a dropped VM, and double exfiltration.
Missed out or want another go?
Grab the Elastic/Splunk lab now π
π¬ DFIR Labs Subscribers: dfirlabs.thedfirreport.com/
π Purchase Case #39390: store.thedfirreport.com/prodβ¦
6
17
2,944
"EtherRAT used decentralized infrastructure for C2 resolution, querying Ethereum smart contracts through 1rpc[.]io to resolve its current C2 URL."
Read the full report: buff.ly/2MhA5Az
#DFIR #ThreatIntel
4
36
138
6,543
Just because an EXE is signed doesn't mean everything it loads is safe.
We came across an interesting infection chain where threat actors used legitimate, signed executables from SonicWall, IBM, Blue Iris, and ON1 to ultimately deploy SectopRAT (ArechClient2).
They took legitimate DLLs shipped with these applications, modified their import tables to reference a threat actor-controlled DLL, and let Windows do the rest.
When the signed application started, it loaded the modified vendor DLL, which then pulled in the malicious DLL.
The final payload, SectopRAT, ran in memory and retrieved its C2 configuration from a smart contract on the BNB Smart Chain.
We observed four different DLL sideloading chains:
πΉ SWGVC.exe β SWIsaCmn.dll β toolJ.dll
πΉ WinWrapIDE.exe β wwide9.dll β format.dll
πΉ BlueIris.exe β libfftw3-3.dll β ApiTag.dll
πΉ ON1Photoshop.exe β opencv_flann453.dll β modPro.dll
A few things worth hunting for:
π Signed applications running from unusual locations, especially AppData\Local.
π DLLs sitting alongside signed executables that return HashMismatch when checked with Get-AuthenticodeSignature.
π Unexpected unsigned DLLs loaded by otherwise legitimate applications.
π Vendor DLLs with unusual or newly added imports.
Some IOCs from the activity:
C2:
93[.]152[.]220[.]219:443
96[.]62[.]218[.]59:443
BNB Smart Chain contract:
0xb11613acf39ad3b4dde427c27068d278fafa8998
#DFIR #ThreatHunting #SectopRAT #BlueTeam
6
40
215
13,172
𧲠We recently saw a threat actor compromise an exposed Linux server and install Pawns.app, a legitimate "earn money from your bandwidth" agent, registered to their own account. The goal was to get paid while strangers route traffic through the victim's IP.
On the box, the threat actor:
πΉ dropped a JSP webshell and ran quick recon (id, uname -a, ip addr)
πΉ pulled the Pawns CLI with wget and hid copies as .p in /tmp, /var/tmp, /opt and /home
πΉ tried to persist with an @reboot cron entry
πΉ launched the agent with -email= -device-name= -accept-tos
Threat actors like proxyjacking for a few reasons:
πΉ The binary is the vendor's official app, so antivirus has nothing to catch
πΉ There's no CPU spike, just HTTPS to a well-known service
πΉ The abuse reports land on your IP, not theirs
IOCs:
Threat actor infrastructure (Pawns CLI pulled via wget):
144[.]172[.]86[.]173
209[.]99[.]190[.]80
Pawns account: skynox7@proton[.]me
Files: /tmp/.p, /var/tmp/.p, /opt/.p, /home/.p, /tmp/gotoschool
State file: /var/tmp/.config/pawns-cli/pawns-consent.log
To hunt for it, watch for web server processes spawning wget or curl, proxyware launch flags, and servers talking to services like Pawns, Honeygain, EarnApp or PacketStream.
Add proxyware to your hunt list next to miners and stealers.
4
10
36
7,399
β‘ Track attacker infrastructure, feed your detections.
The DFIR Report Threat Feed turns the command-and-control frameworks and clusters we track into blockable, high-fidelity indicators, updated as the infrastructure moves, not weeks later.
Get early warning π buff.ly/g2RNnRd
1
3
15
2,630
While enumeration was ongoing, the actor returned to the backup server for more credential theft via COMSVCS. A new service was installed, then executed, spawning a process tree that dumped credentials to a file in the temp directory.
Request access or a demo π buff.ly/AXx8KQQ
#DFIR #ThreatIntel
5
14
2,518
"Fortunately the threat actor had bad opsec and reused a password so we were able to decrypt the file using the βrclone config showβ command"
Read the full report: buff.ly/t3MPa7p
#DFIR #ThreatIntel
1
8
44
3,558
π‘οΈ Prevent, detect, train your AI, and purple team, all from one subscription.
All Intel gives your team The DFIR Report's full non-public intelligence:
πΉ Threat Feed, high-fidelity indicators tied to real intrusions
πΉ Private DFIR Reports
πΉ Near real-time intrusion tracking
πΉ C2 configurations
πΉ Long-term infrastructure tracking
πΉ and more
How defenders put it to work:
πΉ Prevent: block emerging infrastructure before it reaches you
πΉ Detect: engineer detections from real exploit chains before public disclosure
πΉ Train AI: ground your models in real intrusion data
πΉ Purple team: exercise against current, real-world TTPs
Learn more π buff.ly/IDE6zab
3
10
2,567
π οΈ Tool Tuesday: AdFind
A free AD query tool, and a recon staple in ransomware playbooks. We see AdFind, often via a batch wrapper, enumerate users, groups, computers, and trusts to plan lateral movement.
π Hunt tip: flag adfind.exe with objectcategory queries and the classic recon batch scripts.
See it across real intrusions π buff.ly/sDS3XpA
2
8
35
3,400
"This single-paged document contained a picture with instructions, attempting to lure the victim into enabling macros."
Read the full report: buff.ly/LCFCbkh
#DFIR #ThreatIntel
3
21
3,919
π€ Analyst Spotlight: Almedin Santic
Based in Norway, Almedin ('Dino') has worked in cybersecurity for 8 years, mainly in SOC, IR, and Detection Engineering, and enjoys forensic analysis and playing CTFs.
Explore their work on The DFIR Report: buff.ly/oyuI5Rb
1
11
2,710
"It uses the above methods to crawl a list of IPs/URLs looking for specific strings in the response such as PayPal, AWS_KEY, SES_KEY, Twilio, sendgrid, office365, zoho, mailgun and others."
Read the full report: buff.ly/xOBtD7m
#DFIR #ThreatIntel
2
11
41
3,969
π Indicators from a ClickFix intrusion we are actively investigating:
C2: 67[.]207[.]81[.]22:443 (sunyotech[.]com)
Malware dropped on lateral hosts:
C:\Windows\security\KeyUpdateAgent.exe
SHA256: ec9ada555d6dffa2fed08e86e26e29e7c6d15d90e0323cdf44e06e75461a04bf
If you defend a network, hunt your logs for these now.
Seeing the same thing, or have additional context? Get in touch π buff.ly/T6q5yvE
2
19
93
6,914
π‘οΈ Are your detection and investigation tools holding up against real attacks?
Active Defense gives security vendors, MDR providers, and AI security teams a way to run their own tooling against live adversary activity in real environments, not lab simulations or replayed samples. See how your stack detects, triages, and investigates attackers as they operate, not a delayed feed of indicators.
Every interaction becomes ground-truth validation data: real IOCs, mapped TTPs, and the intel-rich context you need to prove your tools work and tune what doesn't.
Put your tools to the test π buff.ly/HTlNND9
7
13
2,662