From IcedID to Dagon Locker Ransomware in 29 Days

🌟Analysis & reporting completed by Renzon, Angelo Violetti & UC1

🎵Audio: Available on Spotify, Apple, YouTube and more!

🏹Services: thedfirreport.com/services/

📚Report: thedfirreport.com/2024/04/29/fro…

#ISFB #LDR4 - url > .zip > .js > CobaltStrike

Interesting campaign this week purporting to be Hays Recruitment.

DocuSign lure that leads to a site that drops a zip file that contains a .js loader for #CobaltStrike

(1/3)👇IOC's continued

🎁 Today I'm giving away 3 of our DFIR Labs! 🎁

To enter:
✅Follow me
✅RT & Like this post
✅Reply with which case you'd like to take

The winners will be selected in 24 hours. #Giveaway

Short post on an account takeover bug found when doing some hunting:
#bugbounty
rewscel.medium.com/account-takeov…