Click here to download all references as Bib-File.
| 2021-10-04 ⋅ The DFIR Report ⋅ BazarLoader and the Conti Leaks BazarBackdoor Cobalt Strike Conti |
| 2021-09-13 ⋅ The DFIR Report ⋅ BazarLoader to Conti Ransomware in 32 Hours BazarBackdoor Cobalt Strike Conti |
| 2021-08-29 ⋅ The DFIR Report ⋅ Cobalt Strike, a Defender’s Guide Cobalt Strike |
| 2021-08-01 ⋅ The DFIR Report ⋅ BazarCall to Conti Ransomware via Trickbot and Cobalt Strike BazarBackdoor Cobalt Strike Conti TrickBot |
| 2021-07-19 ⋅ The DFIR Report ⋅ IcedID and Cobalt Strike vs Antivirus Cobalt Strike IcedID |
| 2021-06-28 ⋅ The DFIR Report ⋅ Hancitor Continues to Push Cobalt Strike Cobalt Strike Hancitor |
| 2021-06-20 ⋅ The DFIR Report ⋅ From Word to Lateral Movement in 1 Hour Cobalt Strike IcedID |
| 2021-06-03 ⋅ The DFIR Report ⋅ WebLogic RCE Leads to XMRig |
| 2021-05-12 ⋅ Conti Ransomware Cobalt Strike Conti IcedID |
| 2021-05-02 ⋅ The DFIR Report ⋅ Trickbot Brief: Creds and Beacons Cobalt Strike TrickBot |
| 2021-03-29 ⋅ The DFIR Report ⋅ Sodinokibi (aka REvil) Ransomware Cobalt Strike IcedID REvil |
| 2021-03-08 ⋅ The DFIR Report ⋅ Bazar Drops the Anchor Anchor BazarBackdoor Cobalt Strike |
| 2021-02-28 ⋅ The DFIR Report ⋅ Laravel Apps Leaking Secrets |
| 2021-02-15 ⋅ Twitter (@TheDFIRReport) ⋅ Tweet on Qakbot post infection discovery activity QakBot |
| 2021-02-11 ⋅ Twitter (@TheDFIRReport) ⋅ Tweet on Hancitor Activity followed by cobaltsrike beacon Cobalt Strike Hancitor |
| 2021-02-02 ⋅ Twitter (@TheDFIRReport) ⋅ Tweet on recent dridex post infection activity Cobalt Strike Dridex |
| 2021-01-31 ⋅ The DFIR Report ⋅ Bazar, No Ryuk? BazarBackdoor Cobalt Strike Ryuk |
| 2021-01-18 ⋅ The DFIR Report ⋅ All That for a Coinminer? Coinminer Monero Miner |
| 2021-01-11 ⋅ The DFIR Report ⋅ Trickbot Still Alive and Well Cobalt Strike TrickBot |
| 2020-12-13 ⋅ The DFIR Report ⋅ Defender Control |