@pigerlin

Analyst @TheDFIRReport | Passionate about all things DFIR 🇳🇱

Joined April 2011
  • Tweets71
  • Following136
  • Followers744
4Media
New logo. New website. Same DFIR Report team. 🔎 Check out the incredible analysts behind the research: thedfirreport.com/company/an…

Meet The DFIR Report Analysts | Cybersecurity Experts

Discover the volunteer analysts behind The DFIR Report. Meet the experts documenting real-world intrusions and strengthening global cyber defense.

thedfirreport.com
6
24
1
233
27,535
🌟New report out today!🌟 From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Analysis/reporting completed by @RussianPanda, Christos Fotopoulos, Salem Salem, reviewed by @svch0st. Audio: Available on Spotify, Apple, YouTube and more! Report:⬇️
5
53
2
150
49,821
🌟New report out today!🌟 Hide Your RDP: Password Spray Leads to RansomHub Deployment Analysis and reporting completed by @tas_kmanager, @iiamaleks and UC2 🔊Audio: Available on Spotify, Apple, YouTube and more! thedfirreport.com/2025/06/30…

Hide Your RDP: Password Spray Leads to RansomHub Deployment - The DFIR Report

Key Takeaways Case Summary This intrusion began in November 2024 with a password spray attack targeting an internet-facing RDP server. Over the course of several hours, the threat actor attempted...

thedfirreport.com
1
37
110
10,131
🌟New report out today!🌟 Fake Zoom Ends in BlackSuit Ransomware Analysis and reporting completed by @pigerlin, UC1 and @Miixxedup Audio: Available on Spotify, Apple, YouTube and more! thedfirreport.com/2025/03/31…

Fake Zoom Ends in BlackSuit Ransomware - The DFIR Report

Key Takeaways Case Summary This case from May 2024 started with a malicious download from a website mimicking the teleconferencing application Zoom. When visiting the website and downloading a file...

thedfirreport.com
1
47
2
155
14,108
New report out Monday 12/4 by @yatinwad! ➡️This intrusion starts with a MSSQL server being brute forced and ends in BlueSky ransomware. ➡️The threat actor went from initial access to network wide ransomware in under 1 hour.
2
15
2
48
9,050
HTML Smuggling Leads to Domain Wide Ransomware ➡️Initial Access: Thread-Hijacked Email > HTML Attachment ➡️Credentials: LSASS Access, SessionGopher ➡️Lateral Movement: RDP, PsExec ➡️C2: IcedID, Cobalt Strike ➡️Impact: Nokoyawa Ransomware thedfirreport.com/2023/08/28… 1/X

HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved the threat...

thedfirreport.com
5
162
5
370
97,014
A Truly Graceful Wipe Out ➡️Initial Access: Email > TDS > Truebot download ➡️Credentials: LSASS & Registry Dump ➡️Persistence: Scheduled Task ➡️C2: Truebot, FlawedGrace, Cobalt Strike ➡️Exfiltration: FlawedGrace ➡️Impact: MBR Killer thedfirreport.com/2023/06/12… 1/X

A Truly Graceful Wipe Out - The DFIR Report

In this intrusion, dated May 2023, we observed Truebot being used to deploy Cobalt Strike and FlawedGrace (aka GraceWire & BARBWIRE) resulting in the exfiltration of data and the deployment of the...

thedfirreport.com
1
159
6
345
86,118
Here's an interesting batch script you'll see in an upcoming report: ➡️Do you know what it's doing? ➡️Would you struggle to do analysis on a system if it ran? Why or Why not? ➡️Are there any rules available to detect this activity? Post your answers below
25
34
4
143
61,010
Unwrapping Ursnifs Gifts ➡️Initial Access: Ursnif ISO/LNK/DLL ➡️Discovery: Get-ADComputer, nltest, net view, etc. ➡️Credentials: LSASS access ➡️Lateral: Impacket ➡️Persistence: Registry Run Key ➡️C2: Ursnif, Cobalt Strike thedfirreport.com/2023/01/09… 1/X

Unwrapping Ursnifs Gifts - The DFIR Report

In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the...

thedfirreport.com
1
91
6
225
50,701
📢New report out Monday 1/9 by @svch0st, @_pete_0 and UC1! If you subscribed, you'll receive an email when we publish the report. If you haven't subscribed - thedfirreport.com/subscribe/

The DFIR Report | Subscribe

Stay ahead of cyber threats with The DFIR Report. Subscribe to receive the latest digital forensics and incident response analyses, ransomware insights, and expert threat intelligence — straight to...

thedfirreport.com
1
8
1
41
10,190
How often do ya'll see emojis in command line params and can you detect them? Try hunting your environment using this sigma rule by @kostastsale - github.com/tsale/Sigma_rules… Was it easy or hard to hunt your env for emojis? Find anything? Thx to @0xToxin for sharing the sample!
2
23
3
74
Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware ➡️TTR: 154 hours ➡️Discovery: nltest, net group, ShareFinder, etc. ➡️Exfil: Rclone Transfer to Mega ➡️C2: CobaltStrike, AnyDesk, Tactical RMM Agent ➡️Impact: Quantum Ransomware thedfirreport.com/2022/11/28… 1/X

Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware - The DFIR Report

In June of 2022, we observed a threat actor gaining access to an environment via Emotet and operating over a eight day period. During this time period, multiple rounds of enumeration and lateral...

thedfirreport.com
1
140
4
269
BumbleBee Zeros in on Meterpreter ➡️Initial Access: Contact Forms/Stolen Images/ISO ➡️PrivEsc: WSReset & Slui UAC Bypass, Zerologon CVE2020-1472 ➡️Cred Access: Procdump LSASS, reg dump SAM/SEC/SYS hives ➡️C2: BumbleBee, Meterpreter, CobaltStrike thedfirreport.com/2022/11/14… 1/X

BumbleBee Zeros in on Meterpreter

In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector from a Contact Forms campaign. We have previously reported on two BumbleBee intrusions (1, 2), and this...

thedfirreport.com
1
103
7
208
Follina Exploit Leads to Domain Compromise ➡️Initial Access: Word Doc exploiting Follina ➡️Persistence: Scheduled Tasks ➡️Discovery: ADFind, Netscan, etc. ➡️Lat Movement: SMB, Service Creation, RDP ➡️C2: #CobaltStrike, Qbot, NetSupport, Atera/Splashtop thedfirreport.com/2022/10/31…

Follina Exploit Leads to Domain Compromise

In early June 2022, we observed an intrusion where a threat actor gained initial access by exploiting the CVE-2022-30190 (Follina) vulnerability which triggered a Qbot infection chain.

thedfirreport.com
3
175
8
362
Dead or Alive? An Emotet Story ➡️Initial Access: Emotet XLS ➡️Persistence: RegRunKeys, Atera ➡️Discovery: LOLbins, AdFind, ShareFinder ➡️Credentials: LSASS access, Kerberoast ➡️Lateral: SMB, Remote Services ➡️C2: Emotet, CobaltStrike ➡️Exfil: Rclone/Mega thedfirreport.com/2022/09/12…

Dead or Alive? An Emotet Story - The DFIR Report

In this intrusion from May 2022, we observed a domain-wide compromise that started from a malware ridden Excel document containing the never-dying malware, Emotet. The post-exploitation started very...

thedfirreport.com
5
118
6
285
BumbleBee Roasts Its Way to Domain Admin ➡️Initial Access: BumbleBee (zipped ISO /w LNK+DLL) ➡️Persistence: AnyDesk ➡️Discovery: VulnRecon, Seatbelt, AdFind, etc. ➡️Credentials: Kerberoast, comsvcs.dll, ProcDump ➡️C2: BumbleBee, CobaltStrike, AnyDesk thedfirreport.com/2022/08/08…

BumbleBee Roasts Its Way to Domain Admin - The DFIR Report

In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022....

thedfirreport.com
5
196
13
473
Weaponized disk images files are still a thing. Are you able to detect ISO files being downloaded from the internet? ISO files being mounted by end users? Process and network connections being started from a mounted drive? Check out the importance in our latest report. #DFIR
The DFIR Report
@TheDFIRReport8 Aug 2022
BumbleBee Roasts Its Way to Domain Admin ➡️Initial Access: BumbleBee (zipped ISO /w LNK+DLL) ➡️Persistence: AnyDesk ➡️Discovery: VulnRecon, Seatbelt, AdFind, etc. ➡️Credentials: Kerberoast, comsvcs.dll, ProcDump ➡️C2: BumbleBee, CobaltStrike, AnyDesk thedfirreport.com/2022/08/08…

BumbleBee Roasts Its Way to Domain Admin - The DFIR Report

In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022....

thedfirreport.com
21
72
Are you going to @Steel_Con Saturday (7/23)? If so, ➡️Check out @_pete_0's talk "Can you detect this? Inside The Ransomware Operator’s Toolkit" at 14:00 in Track 3! ➡️Find @_pete_0 and he'll give you a free t-shirt! while supplies last
16
27
SELECT XMRig FROM SQLServer ➡️Initial Access: Brute Force ➡️Execution: xp_cmdshell, batch scripts, certutil ➡️Persistence: Hidden accounts, schtasks, WMI event subscription via mof files ➡️Defense Evasion: Kill AVs, Disabling UAC ➡️Impact: XMRig Miner thedfirreport.com/2022/07/11…
1
88
4
202
Can you Detect This? | Inside The Ransomware Operator's Toolkit ➡️@_pete_0 and @yatinwad will be presenting @ 14:40 UTC on 6/16. Sign up for the free #RansomwareSummit ⬇️ sans.org/cyber-security-trai…
Jorge Orchilles@jorgeorchilles7 Jun 2022
Have you registered for the free #RansomwareSummit It is going to be awesome! I had the privilege of working with speakers for 2 different talks and so excited for them. One is from @TheDFIRReport which you all know I am a huge fan of. #ransomware sans.org/cyber-security-trai…
1
18
1
66
Load more