Reports
The DFIR Report is a podcast about Digital Forensics and Incident Response. It presents real intrusions by real attackers and the truth behind those incidents. A new report is released every month, with additional reports available at thedfirreport.com. The team also offers specialized services such as private reports, command and control tracking, personalized mentoring, and an exclusive detection ruleset. More details about these services can be found on their website.
Episodes
Apache MQ Exploit Leads to LockBit Ransomware
Report: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/Contact Us: https://thedfirreport.com/contact/
Cat's Got Your Files: Lynx Ransomware
Report: https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Report: https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusionContact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs
Report: https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Hide Your RDP: Password Spray Leads to RansomHub Deployment
Report: https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deploymentContact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
DFIR Discussions: Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
We dive into our latest public report with Randy Pargman, Jake Ouellette, Kostas T., and Mangatas Tondang.Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/Music by FASSounds from Pixabay
Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
Report: https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Navigating Through The Fog
Report: https://thedfirreport.com/2025/04/28/navigating-through-the-fog/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Fake Zoom Ends in BlackSuit Ransomware
Report: https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/Contact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Confluence Exploit Leads to LockBit Ransomware
Report: https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomwareContact Us: https://thedfirreport.com/contact/Services: https://thedfirreport.com/services/
Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware
Report: https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
DFIR Discussions: The Curious Case of an Egg-Cellent Resume
We discuss our latest report "The Curious Case of an Egg-Cellent Resume"
Host: @Kostastsale
Analysts: @_pete_0, Zach Stanford (aka @svch0st)
Report: https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Music by FASSounds from Pixabay
The Curious Case of an Egg-Cellent Resume
Report: https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Inside the Open Directory of the “You Dun” Threat Group
Report: https://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
Report: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
BlackSuit Ransomware
Report: https://thedfirreport.com/2024/08/26/blacksuit-ransomware/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Threat Actors' Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts
Report: https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment
Report: https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
DFIR Discussions: From IcedID to Dagon Locker Ransomware in 29 Days
We discuss our latest report "From IcedID to Dagon Locker Ransomware in 29 Days"
Host: @Kostastsale
Analysts: @r3nzsec & @angelo_violetti
Special Guest: @nas_bench
Report: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Music
From IcedID to Dagon Locker Ransomware in 29 Days
Report: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 2
We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion
Host: @Kostastsale
Analysts: @iiamaleks, @IrishD34TH, & @Miixxedup
Special Guest: @techspence
Feedback: https://forms.office.com/r/LR9NsEWYye
Report: https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
Contact Us: https://thedfirreport.com/contact/
Services: h
DFIR Discussions: From OneNote to RansomNote: An Ice Cold Intrusion - Part 1
We discuss our latest report From OneNote to RansomNote: An Ice Cold Intrusion
Host: @Kostastsale
Analysts: @iiamaleks, @IrishD34TH, & @Miixxedup
Special Guest: @techspence
Report: https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
Contact Us: https://thedfirreport.com/contact/
Services: https://thedfirreport.com/services/
Music by FASSounds from Pix
From OneNote to RansomNote: An Ice Cold Intrusion
Full Report -
https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion
Feedback: https://forms.office.com/r/YY6w3gwd6A
DFIR Discussions: SEO Poisoning to Domain Control: The Gootloader Saga Continues
Our first DFIR Discussions podcast on our latest report SEO Poisoning to Domain Control: The Gootloader Saga Continues
Host: @Kostastsale
Analysts: @_pete_0, @malforsec, & @r3nzsec
Special Guest: @HackingLZ
Feedback: https://forms.office.com/r/mK2Jp8vPXj
Report: https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/
Contact Us: https://thedfirrepo
SEO Poisoning to Domain Control: The Gootloader Saga Continues
Report - https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues
Provide feedback for a chance to win free swag - https://forms.office.com/r/MwZXkBrUNv
Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours
Report: https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
Feedback: https://forms.office.com/r/pPajTA4Vwy
Recommended
The Joe Rogan Experience
English Vocabulary Help
TED Talks Daily
Learn English B1 with Daily News | English Listening Practice
Talk About Talk - Executive & Leadership Communication Skills
English with Olivia | Slow Conversations & Vocabulary
Stand In The Circle
SLOW ENGLISH PODCAST (A1-A2) With Subtitles | Daily Videos | English With Us Podcast
Learn English A2 with Daily News | Simple English Listening Practice
پلی لیست | PlayList
Conspiracy Files with Paige Carter
Bad Friends
