The DFIR Report ✓

@TheDFIRReport · thedfirreport.com/contact · joined 03 Apr 2020

Real Intrusions by Real Attackers, the Truth Behind the Intrusion

69 826Followers

0Following

1 828Posts total

38KViews on collected posts

Ultimi post

The DFIR Report ✓@TheDFIRReport18 Sep

🔒 Private DFIR Report: ViewState of Mind, Gladinet Exploit Opens the Door A binary, wacs.exe, was written to C:\CentreStack\ and executed, the Stowaway proxy tool, connecting to a remote server at 167.99.74[.]134:443 to establish deeper access and run initial discovery. 2.4K views · 16 likes · 5 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport17 Sep

"The threat actors have been using the associated Monero wallet for 738+ days and have netted around $5,159." Read the full report: https://t.co/r3MLgZip1Z #DFIR #ThreatIntel https://t.co/ibOsKFOMW1

2.5K views · 9 likes · 3 reposts · 2 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🛡️ Let the attackers tell you what they're after. Active Defense Threat Insights deploys strategic decoys that attract adversaries and capture their moves 24/7, turning real interactions into high-fidelity IOCs and mapped TTPs specific to your organization. Understand 2.5K views · 17 likes · 4 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Sep

🔎 Indicators from a case we are actively investigating: C2: 178[.]16[.]54[.]112:56001 Payload URL: hxxps://panaderiacoronado[.]com/temp/Frqzbx[.]exe node.exe running from AppData with an unusual flag: "C:\Users\<user>\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" 4.4K views · 69 likes · 21 reposts · 0 replies Open on X →

The DFIR Report ✓@TheDFIRReport16 Feb

New logo. New website. Same DFIR Report team. 🔎 Check out the incredible analysts behind the research: https://t.co/Gep8oGeKik 26.1K views · 231 likes · 23 reposts · 5 replies Open on X →

Rispetto ad account della stessa dimensione

4 post degli ultimi 90 giorni, accanto alla fascia di 10K–100K follower. copertura nella norma per la sua dimensione, reazione più debole della media.

Visualizzazioni mediane2 496questo account935mediana per 10K–100K

Copertura, %3.57%questo account3.43%mediana per 10K–100K

Interazione, %0.86%questo account1.54%mediana per 10K–100K

Metrica	Questo account	Mediana per 10K–100K	Rapporto
Visualizzazioni mediane per post	2 496	935	2.67×
Copertura (visualizzazioni ÷ follower)	3.57%	3.43%	1.04×
Tasso di interazione	0.86%	1.54%	0.55×

Altri account di questa fascia → Confronta con un altro account → Come sono costruiti questi parametri →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

26.1K16 Feb

4.4K16 Sep

2.5K

2.5K17 Sep

2.4K18 Sep

Last 5 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

1.00%16 Feb

2.02%16 Sep

0.86%

0.55%17 Sep

0.86%18 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.54%.

What the audience does

Likes64.7%342 in total

Reposts10.6%56 in total

Replies1.3%7 in total

Quotes0.2%1 in total

Bookmarks23.3%123 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.