X XFediYour place in the Fediverse
XFEDI

Remote profile

ActivityPub

The DFIR Report

@[email protected]

Real Intrusions by Real Attackers, the Truth Behind the Intrusion.
Detections: http://github.com/The-DFIR-Report | Services: http://thedfirreport.com/services |

Open remote profile ↗
Posts
The DFIR Report@[email protected]

"Despite the port number, this traffic was in fact SFTP traffic being used to transfer the data."

Read the full report: https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment

#DFIR #ThreatIntel

Media attachment
The DFIR ReportHide Your RDP: Password Spray Leads to RansomHub Deployment - The DFIR ReportKey Takeaways Case Summary This intrusion began in November 2024 with a password spray attack targeting an internet-facing RDP server. Over the course of several hours, the threat actor attempted logins against multiple accounts using known malicious IPs (based on OSINT). Several hours later they then logged in via RDP with one of the previously […]
↩ Reply ♡ 0 · ↻ 0 ↗ Original
The DFIR Report@[email protected]

🤖 100+ AI/ML training sets, built from years of real DFIR cases.

AI Training Ground gives you over 100 fully documented intrusions from The DFIR Report, system and network logs, memory, malware, and IOCs, capturing real threat-actor behavior end to end: initial access, lateral movement, credential theft, exfiltration, and impact.

The ground truth you need to train and validate your AI and ML security models.

Learn more 👉 https://thedfirreport.com/products/ai-training-ground/

The DFIR ReportDFIR Report | Cybersecurity Talent Accelerator & MentorshipAdvance your cybersecurity career or team with DFIR’s Talent Accelerator. Expert-led mentorship, coaching, and training to build world-class defenders.
↩ Reply ♡ 0 · ↻ 0 ↗ Original