The DFIR Report ✓

@TheDFIRReport · thedfirreport.com/contact · joined 03 Apr 2020

Real Intrusions by Real Attackers, the Truth Behind the Intrusion

69 826Followers

0Following

1 828Posts total

38KViews on collected posts

Derniers posts

The DFIR Report ✓@TheDFIRReport18 Sep

🔒 Private DFIR Report: ViewState of Mind, Gladinet Exploit Opens the Door A binary, wacs.exe, was written to C:\CentreStack\ and executed, the Stowaway proxy tool, connecting to a remote server at 167.99.74[.]134:443 to establish deeper access and run initial discovery. 2.4K views · 16 likes · 5 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport17 Sep

"The threat actors have been using the associated Monero wallet for 738+ days and have netted around $5,159." Read the full report: https://t.co/r3MLgZip1Z #DFIR #ThreatIntel https://t.co/ibOsKFOMW1

2.5K views · 9 likes · 3 reposts · 2 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🛡️ Let the attackers tell you what they're after. Active Defense Threat Insights deploys strategic decoys that attract adversaries and capture their moves 24/7, turning real interactions into high-fidelity IOCs and mapped TTPs specific to your organization. Understand 2.5K views · 17 likes · 4 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🔎 Indicators from a case we are actively investigating: C2: 178[.]16[.]54[.]112:56001 Payload URL: hxxps://panaderiacoronado[.]com/temp/Frqzbx[.]exe node.exe running from AppData with an unusual flag: "C:\Users\<user>\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" 4.4K views · 69 likes · 21 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Feb

New logo. New website. Same DFIR Report team. 🔎 Check out the incredible analysts behind the research: https://t.co/Gep8oGeKik 26.1K views · 231 likes · 23 reposts · 5 replies Open on X →

Face aux comptes de taille comparable

4 posts des 90 derniers jours, à côté de la tranche de 10K–100K abonnés. portée ordinaire pour sa taille, réaction plus faible que la moyenne.

Vues médianes2 496ce compte927médiane pour 10K–100K

Portée, %3.57%ce compte3.40%médiane pour 10K–100K

Engagement, %0.86%ce compte1.54%médiane pour 10K–100K

Indicateur	Ce compte	Médiane pour 10K–100K	Rapport
Vues médianes par post	2 496	927	2.69×
Portée (vues ÷ abonnés)	3.57%	3.40%	1.05×
Taux d'engagement	0.86%	1.54%	0.56×

Autres comptes de cette tranche → Comparer avec un autre compte → Comment ces repères sont établis →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

26.1K16 Feb

4.4K16 Sep

2.5K

2.5K17 Sep

2.4K18 Sep

Last 5 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

1.00%16 Feb

2.02%16 Sep

0.86%

0.55%17 Sep

0.86%18 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.54%.

What the audience does

Likes64.7%342 in total

Reposts10.6%56 in total

Replies1.3%7 in total

Quotes0.2%1 in total

Bookmarks23.3%123 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.