✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 📍 Details here: 👉 buff.ly/oT8OtbE

Erik Hjelmvik will run a hands-on network forensic workshop at the upcoming Digital Forensics Research Conference in Sweden. Participants will get the chance to analyze: 🔪 Packets carved from memory dumps 🧅 Unencrypted Tor traffic dfrws.org/dfrws-eu-202...

Decoding #njRAT C2 traffic to extract screenshots, commands and transferred files netresec.com?b=262adb9

Some initial thoughts on recent disclosures concerning the December 2025 incident targeting the Polish electric sector - with a focus on #CTI elements such as attribution implications and methodology: pylos.co/2026/01/31/a...

Thank you for those kind words! 💜 www.linkedin.com/pulse/issue-...

The early bird discount, for our live online network forensics class, expires by the end of this week. Sign up if you’d like to analyze PCAP files together with Erik Hjelmvik (creator of NetworkMiner and PolarProxy). netresec.com?b=25A2e4f

DFRWS EU 2026 is seeking posters showcasing interesting digital forensics research for presentation in Linköping, Sweden, 24–27th March 2026. 📥 Submit via EasyChair (PDF) - Rolling notification until the program is full! #DFRWSEU2026 #DFRWS #DigitalForensics

🎬 Video: Decoding malware C2 with #CyberChef netresec.com?b=261f535

Extracting VNC screenshots and keylog data from #Latrodectus 🕷️ BackConnect netresec.com?b=25Cfd08

NetworkMiner 3.1 Released! 🔑 More usernames, passwords and hostnames from #PCAP 💻 Improved user interface 👾 Better details from malware C2 traffic netresec.com?b=25C4039

CN #APT targeting attendees of a diabetes conference in Singapore in December attd.z23.web.core[.]windows[.]net/ATTD-ASIA-2025.zip (live link, careful!) ATTD-ASIA-2025.lnk a12357ff6c0f7b021f32b0c9cd3d01c4 ATTD-ASIA-2025.zip a8082a80cef9ccee9d7a35f5366e3afb gzv.msi 32e7dcbd26b6455974d5b2c52c3ca421 🐴

I love the idea of calculating the decay rate of an IOC. It's not always strictly mathematical, because it also relies on threat actors' choices about how they use the IOCs, but as an estimate and for decision making, this seems promising. Also, I really like @netresec.com's ASCII art Pyramid. 😀

Monitoring for too many old indicators not only costs money, it can even inhibit detection of real intrusions. 📆 Include "last seen" date when publishing IOCs ❌ Prune old IOCs 📜 Prioritize long lived IOCs over short lived ones netresec.com?b=25Be9dd

🚨 The #DFRWSEU 2026 paper submission deadline has been extended to 10th October 2025 🎉 Submit your paper showcasing cutting-edge digital forensics research. 📤 Submit here: buff.ly/BN8Jlnb ℹ️ Conference details: buff.ly/KOw9Xpr #DFRWS #DigitalForensics #CFP

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT. netresec.com?b=259a5af

Video: Detecting #XenoRAT C2 connections using example traffic from known malware sample. 🔥 e0b465d3bd1ec5e95aee016951d55640 🔥 5ab23ac79ede02166d6f5013d89738f9 📡 Huy1612-24727.portmap[.]io:24727 📡 193.161.193.99:24727 📡 147.185.221.30:54661 netresec.com?b=258f641

How to identify #PureRAT (aka #ResolverRAT): ⛳️ C2 port is often 56001, 56002 or 56003 🔢 Bot sends 04 00 00 00, then TLS handshake 🔑 Client and server run TLS 1.0 🖊️ X.509 cert is self signed 📅 X.509 cert expires 9999-12-31 netresec.com?b=2589522

💧 Dropper connects to legitimate website 📄 Fake PDF is downloaded over HTTPS 💾 Fake PDF is decrypted to a #PureLogs DLL ⚙️ InstallUtil.exe or RegAsm.exe is started 💉 PureLogs DLL is injected into the running process 👾 PureLogs connects to C2 server netresec.com?b=257eead

CapLoader 2.0.1 Released ⚠️ IP lookup alert 🔎 Better protocol identification 🐛 Bug fixes netresec.com?b=2571527

Does anyone know what malware this is? C2 is on 104.16.0.0/13 (CloudFlare). C2 domains: 🔥 event-time-microsoft[.]org 🔥 windows-msgas[.]com 🔥 event-datamicrosoft[.]live 🔥 eventdata-microsoft[.]live PCAP from @malware-traffic-analysis.net infosec.exchange/@netresec/11...

Video: Detecting #PureLogs C2 traffic with #CapLoader netresec.com?b=256a8c4

CapLoader 2.0 released today! 🔎 Identifies over 250 protocols in #PCAP 🎨 Define protocols from example traffic 🇶 Extracts JA3, JA4 and SNI from QUIC 💻 10x faster user interface netresec.com?b=256dbbc

Thank you CISA, @ncsc.gov.uk, @bsi.bund.de et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting! www.cisa.gov/news-events/...

Comparison of tools that extract files from #PCAP 📖 #Chaosreader ⛏️ #NetworkMiner 🐿️ #Suricata 🌊 #tcpflow 🦈 #Wireshark 👁️ #Zeek netresec.com?b=255329f

Did you know that NetworkMiner parses the #njRAT protocol? The following artefacts are extracted from njRAT C2 traffic: 🖥️ Screenshots of victim computer 📁 Transferred files 👾 Commands from C2 server 🤖 Replies from bot 🔑 Stolen credentials/passwords ⌨️ Keylog data netresec.com?b=2541a39

New instructions for installing NetworkMiner on Linux netresec.com?b=2542784

NetworkMiner 3.0 Released! 🔐 QUIC 🏭 CIP (EtherNet/IP) 🏭 UMAS (over Mobdus) 👾 Remcos RAT 🔍 Improved OS fingerprinting 🐧 Better Linux integration netresec.com?b=254caa9

How to set #PCAP as default savefile format in #Wireshark 📝 Edit 📃 Preferences 💡 Advanced ✍️ Change capture.pcap_ng to FALSE netresec.com?b=2523d40

Here's a feature request to have #Wireshark bring back PCAP as the default savefile format instead of pcapng. gitlab.com/wireshark/wi...

PolarProxy 1.0.1 Released 🆔 More #JA4 🔂 Fail-open on #TLS errors ⏩ Better performance netresec.com?b=2523c96

This is an interesting Kerberos relay attack! It leverages LLMNR spoofing/poisoning to trick victims to connect to the attacker's machine and authenticate using Kerberos.

A TLS firewall is similar to a DNS firewall, except it blocks connections to unwanted websites even if the DNS traffic is encrypted. netresec.com?b=2515cf0

We’ve now scheduled our next Network Forensics for Incident Response training 📅 Dates: May 12-15, 2025 🕑 Duration: Four half-days 🌐 Type: Live Online Network Forensics Training 💵 Price: € 960 EUR www.netresec.com?page=Training

APT29 / Midnight Blizzard / Earth Koshchei use RDP relays to gain control of victims’ machines. One RDP config pretends to be for Regeringskansliet (Swedish Gov). Thanks to @feikeh.bsky.social and @sjhilt.hilt.zip‬ for sharing indicators! www.trendmicro.com/en_us/resear... tria.ge/241023-qpfnl...

@piotrkijewski.bsky.social on Shadowserver & our unique non-profit approach to raising the bar on cybersecurity worldwide by sharing free threat intelligence, supporting LE in disrupting cybercrime & cybersecurity capacity building all around the planet! www.helpnetsecurity.com/2024/12/05/p...

#Socks5Systemz backconnect traffic now uses TCP port 2024 (previously 2023) infosec.exchange/@abuse_ch@io...

Remember the wiper attack against KA-SAT/Viasat during Russia's invasion of Ukraine? Joe (@pylos.co) provides a great overview of this campaign. The talk also covers alignment with #Sandworm, a little-known DHCP DoS attack and risks with satellite comms for ICS/SCADA. youtu.be/0a-qza6YSZA

Entry point is "gobayden" 🤷

Nice malware lab setup using FLARE VM, #PolarProxy and #REMnux to decrypt and inspect TLS traffic. www.koenmolenaar.nl/nl/write-ups...

Erik and Jonas's Network Fingerprinting talk at NetNod. It covers #JA4, #JARM, #p0f, Satori and a few other techniques. www.youtube.com/watch?v=1_Vb...

I just want to say a huge shout out to @netresec.bsky.social, they've always been such a huge support to me and my projects over the years. They create fantastic stuff like Network Miner, go check them out!!

Guest post on the APNIC blog: Three methods to decrypt TLS traffic, how each works, and when to use them. blog.apnic.net/2024/10/14/h...

Two network forensic classes scheduled: 🇺🇸 PCAP in the Morning US October 21-24, 2024 🇪🇺 PCAP in the Morning Europe November 18-21, 2024 netresec.com?b=2462e4f

Our network forensics class next week is almost sold out (2 seats left), but there are a few more available seats in our "PCAP in the Morning US" on March 25-28. You don’t need to be in the US to take this class. Hope to see you there!

Video: Hunting for Cobalt Strike in PCAP netresec.com?b=2410f02

Two new Network Forensics training events! 🇪🇺 PCAP in the Morning Europe, March 4-7 🇺🇸 PCAP in the Morning US, March 25-28 netresec.com?b=23C9979