Resources & Insights

After finding a Discord bot token hardcoded into every WindowsAudit agent binary, we built a monitor, pulled the attacker's own loot dump, and identified 25+ victim organizations — before noticing the architectural flaw that handed us the entire botnet.

Profero IRT reverse engineered a .NET 8 RAT named WindowsAudit.exe recovered from a victim host in April 2026. It uses Discord as primary C2, runs as SYSTEM, tears down EDR in Safe Mode, and ships a full Active Directory attack toolkit.

Anthropic dropped Claude Mythos and the internet lost its mind. We read the red team report, the community briefing, and the PR machine — here's what actually changes for defenders.

Cardinal, Russian Legion, and RuskiNet are flooding Telegram with fabricated breach claims. We analyzed every major claim. All fake.

Anthropic shipped Claude Code's full source to npm because of a missing .npmignore file. Here's what was exposed, why it matters, and how to check if your organization's packages are leaking too.

Rapid-IR: Reforged is the IR platform built by an incident response team. Proprietary AI, continuous readiness, and a 20-minute guaranteed response.

A step-by-step walkthrough of how breach databases, stealer logs, and basic OSINT revealed the FBI Director's personal credentials — and what it means for executive security.

Profero IRT has uncovered a cryptocurrency wallet hijacking supply chain attack in the AppsFlyer Web SDK

OSINT validation of a Hebrew-language Telegram channel claiming to release doxxing data and breach material targeting Iranian judiciary figures, IRGC intelligence operations, and APT35 cyber units.

The complete analysis of Vietnamese Stealer - a Python-based info stealer using Telegram as a C2.

Recently Profero uncovered an AtomicStealer campaign using a fake Apple Support website designed to trick users into running a malicious bash command, infecting their machine with the stealer payload.

# The Letter That Started a Crisis

# From Friend to Foe: A New Era of Cybersecurity Incidents

On January 28, 2023, an ammunition factory belonging to the Iranian Defence Ministry in Isfahan was attacked by three drones. Iran later claimed that the drones had caused only minor damage to a build

Since the outset of the Russia-Ukraine war in early 2022, our Incident Response Team at Profero has been engaged in multiple investigations involving Russian threat actors across Europe, ranging from

In May 2025, Profero responded to multiple security incidents stemming from the active exploitation of two zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM):

Over the past month, the Profero Incident Response Team (IRT) conducted an exhaustive forensic investigation into a global phishing campaign targeting Microsoft 365 identities, specifically Azure Acti

Hello, tech enthusiasts! Today, we're going to explore the intriguing world of quantum cryptography. With all the buzz about quantum computers potentially jeopardizing current security systems, it’s e

In today's cyber security reality, security teams are drowning in acronyms. CTEM, CSPM, IDM and more: all are parts of a common defense lineup aiming to create robust protection around digital infrast

**Behind the Scenes: How Pager Apps** **Power 24/7 Incident Response Operations**

Some people go out into nature with a plant guide or a bird handbook to better understand what they see in front of them. Such a guide includes a catalogue organized by families (raptors, waterfowl, e

During 2024 Profero’s research and incident response teams tracked a trend of cyber-attacks that are based on security misconfigurations and leaking of secrets into the production environment.

Every year, as we deck the halls and prepare to celebrate major holidays like July 4th,

At the recent Cloud Security Alliance Conference, a compelling panel on cloud security from an attacker's perspective brought together industry experts to discuss emerging threats and defense strategi

This short blog post will run through a few ways the IT/Security teams can configure their existing Windows environment in order to improve forensics readiness using existing operating system capabili

At Profero, trust is the cornerstone of our relationships with clients. As a leading incident response company, we are entrusted with sensitive data and conduct sensitive operations. That's why we hav

On March 29th, 2024, our security team was alerted to a newly identified CVE, assigned a critical severity rating of 10.0. This vulnerability was found in xz-utils, a crucial component deeply embedded

On Nov 2nd, our security team received reports regarding a potential vulnerability in our on-premise software which was being actively exploited. We immediately initiated our incident response protoco

## Focus Shift: Parallels between Europe and Israel's Cyber Incident Response Preparedness

According to [**DebugBear**](https://www.debugbear.com/blog/counting-chrome-extensions), there were about 1.7 billion users with installed Chrome extensions in 2020, out of more than 2.5 billion users

see our previous [**blog post**](https://profero.io/posts/lastpass_breach/)

**disclaimer: this is based on our experience, expertise, and public sources**

Hackers commonly launch their attacks using compromised machines rather than directly from owned devices, which allows them to conceal their origin. In recent incident response, Profero’s Incident Res

Two-factor authentication (2FA) or multi-factor authentication ( MFA ) is a method to authenticate through a service that requires at least two proofs of recognition.

During a recent incident response engagement, the Profero IR team observed a sample of Hello Kitty ransomware. This version of ransomware is intriguing as this sample is packed with a packer written i

# Everyone heard of log4j by now

Our customers faced a serious issue, they did not know which servers on their internal network were vulnerable to log4j, and were reluctant to send information about vulnerable internal servers to 3rd

On December 9th, 2021 news broke about a newly discovered vulnerability affecting the java logging library, Log4j.

As an incident response team, we see a lot of cloud breaches that could have been prevented. Adequate protection requires in-depth knowledge of the cloud provider and its APIs and ample preparation. I

Since the sudden disappearance of the REvil ransomware operation, there has been a rise in other “ransomware as a service” (RaaS) operators attempting to claim their piece of the RaaS market share lef

A victim called the incident response teams of Global Threat Center, reporting a seemingly new stream of ransomware attack. Upon investigation, we determined the extension of the encrypted files was c

At the end of 2020, our team made up of SecurityJoes and Profero incident responders, led an investigation into a complex attack in which hundreds of machines were encrypted, knocking the victim compa

At the peak of the COVID-19 pandemic and economic crisis, our Global Incident Response and Cyber Crisis Management teams were engaged on several fronts around the world, fighting cybercrime, and even