Do Son A six-day RansomHub attack exploited RDP, used Atera/Splashtop RMM, Mimikatz, and Rclone to breach an enterprise, exfiltrate data, and deploy ransomware.
DFIR Report
DFIR Report exposes the Fog ransomware group's sophisticated use of SonicWall exploits, Sliver C2, and credential theft across tech, retail, and education sectors.