Reports

About Reports

The Digital Forensics and Incident Response (DFIR) Report. Real Intrusions by Real Attackers, The Truth Behind the Intrusion. A new report comes out every month! Read the rest of the reports at https://thedfirreport.com/. In addition to our publicly available reports, we provide a range of specialized services to meet your needs, such as private reports, Command and Control tracking, personalized mentoring, and access to an exclusive detection ruleset. Explore our comprehensive offerings on our Services page at https://thedfirreport.com/services/.

Publisher

The DFIR Report

Category

technology

Language

en

Explicit

No

First episode

29 Jan 2024

Latest episode

23 Feb 2026

Latest episodes

1 of 26 episodes have a transcript.

1. 

   23 Feb 2026TRANSCRIPT

   Apache MQ Exploit Leads to LockBit Ransomware

   The episode analyzes how the Apache ActiveMQ exploit enabled the LockBit ransomware attack, highlighting the critical vulnerabilities and potential impacts.

2. 

   17 Nov 2025

   Cat's Got Your Files: Lynx Ransomware

   Report: ⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/)⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/)⁠⁠⁠⁠⁠ (https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment)⁠⁠⁠ (https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/)⁠https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/ (https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/) Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/contact/) Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/services/)

3. 

   29 Sept 2025

   From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

   Report: ⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/)⁠⁠⁠⁠⁠ (https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/)⁠⁠⁠ (https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment)⁠ (https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/)https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion (https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion) Contact Us: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/contact/⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/contact/) Services: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thedfirreport.com/services/⁠⁠⁠⁠⁠⁠⁠ (https://thedfirreport.com/services/)

Inside a recent episode

Apache MQ Exploit Leads to LockBit Ransomware

Published 23 Feb 2026 · Transcript excerpt

[…] The threat actor was able to perform remote code execution, RCE, by using a Java Spring class and a custom Java Spring Bean configuration XML file. The malicious XML contained a command that downloaded a payload from a remote server using the Windows Cert -Yudal utility. The payload was successfully downloaded and executed on the beachhead host. This payload turned out to be a Metasploit Stager. Around 40 minutes after the initial exploit, we observed the threat actor's next actions. The first evidence of the GetSystem command was observed, resulting in the achievement of system -level permissions. […]

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

YouTube views

13,004

Score snapshot 15 Sept 2025

Apple Podcasts (US)

5.0 / 5

5 ratings

Spotify

5.0 / 5

16 ratings

Podcast Authority Score: 50 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

37

Social presence

0

YouTube

76

Engagement

82

Contact Reports

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.