Real-world cyber attacks, expert analysis, and the latest security trends from the IONSEC incident response team.https://www.ionsec.ioen-ushttps://www.ionsec.io/resources/coercion-to-krbtgt-ntlm-relay-and-adcs-esc8-in-2026https://www.ionsec.io/resources/coercion-to-krbtgt-ntlm-relay-and-adcs-esc8-in-2026A full ESC8 walkthrough against a lab domain, then the forensic reconstruction — why the certificate serial, not the source IP, is the artifact that ties the whole chain together.Fri, 24 Jul 2026 00:00:00 GMTArticleadcsesc8ntlm-relayactive-directorydfirthreat-intelligenceIONSEC Teamhttps://www.ionsec.io/resources/cloudflare-drop-60-minute-phishinghttps://www.ionsec.io/resources/cloudflare-drop-60-minute-phishingCloudflare Drop publishes a site on a trusted workers.dev address with no account, then deletes it after an hour. That one-hour fuse burns your forensic evidence with it.Fri, 17 Jul 2026 00:00:00 GMTBlogphishingcloudflaredetection-engineeringthreat-huntingincident-responseIONSEC Teamhttps://www.ionsec.io/resources/maes-the-m365-analyzer-extractor-suitehttps://www.ionsec.io/resources/maes-the-m365-analyzer-extractor-suiteAt IONSEC, we’re excited to introduce MAES: The M365 Analyzer & Extractor Suite — an open-source platform purpose-built to simplify and accelerate Microsoft 365 (M365) forensic investigations.Wed, 20 Aug 2025 00:00:00 GMTToolsopen-sourcedfirmicrosoft-365cloud-forensicsIONSEC Teamhttps://www.ionsec.io/resources/tikun13checkerhttps://www.ionsec.io/resources/tikun13checkerTikun13 Checker הוא כלי קוד פתוח, מבוסס דפדפן, שפותח על ידי IONSEC כדי לסייע לארגונים בישראל ליישם את דרישות תיקון 13 לחוק הגנת הפרטיות.Sun, 17 Aug 2025 00:00:00 GMTToolsopen-sourcecomplianceprivacytikun-13israelIONSEC Teamhttps://www.ionsec.io/resources/do-audit-log-scraper-v2-0https://www.ionsec.io/resources/do-audit-log-scraper-v2-0The DO Audit Log Scraper is a Chrome/Chromium extension that enables forensic-grade audit log extraction.Mon, 11 Aug 2025 00:00:00 GMTToolsopen-sourcedfiraudit-logsdigitaloceanIONSEC Teamhttps://www.ionsec.io/resources/flareinspecthttps://www.ionsec.io/resources/flareinspectFlareInspect is a CLI-based assessment framework designed to revolutionize how organizations evaluate and monitor their Cloudflare security posture.Sun, 03 Aug 2025 00:00:00 GMTToolsopen-sourcecloudflarecloud-securitysecurity-assessmentIONSEC Teamhttps://www.ionsec.io/resources/forti-dfir-open-source-framework-for-fortinet-forensics-incident-responsehttps://www.ionsec.io/resources/forti-dfir-open-source-framework-for-fortinet-forensics-incident-responseAt IONSEC, we’re proud to introduce Forti-DFIR — an open-source initiative created to give security teams the tools they need for forensic investigations and incident response in Fortinet environments.Fri, 01 Aug 2025 00:00:00 GMTToolsopen-sourcedfirfortinetnetwork-forensicsincident-responseIONSEC Teamhttps://www.ionsec.io/resources/when-research-meets-realityhttps://www.ionsec.io/resources/when-research-meets-realityHow Threat-Actor Campaigns Cast a Shadow on Legitimate npm Binaries (and What IONSEC IR Sees in the wild)Sun, 06 Jul 2025 00:00:00 GMTCase Studysupply-chainnpmthreat-intelligenceincident-responseIONSEC Teamhttps://www.ionsec.io/resources/how-a-weaponized-zoom-installer-opened-the-door-for-bluenoroffhttps://www.ionsec.io/resources/how-a-weaponized-zoom-installer-opened-the-door-for-bluenoroffIONSEC investigates a BlueNoroff intrusion that began with a weaponized Zoom installer, combining deepfakes, social engineering and evasive scripting.Thu, 03 Jul 2025 00:00:00 GMTCase Studybluenoroffaptsocial-engineeringincident-responsemacosIONSEC Teamhttps://www.ionsec.io/resources/iranian-threat-actor-hijacks-dnshttps://www.ionsec.io/resources/iranian-threat-actor-hijacks-dnsקבוצת התקיפה האיראנית פתח אלקודס פרצה לרשם דומיינים ישראלי ושינתה רשומות DNS ו-MX של יותר מ-1,000 דומיינים, והפנתה אותם לשרת זדוני ולדף תעמולה.Wed, 02 Jul 2025 00:00:00 GMTCase Studydns-hijackingiranaptincident-responseisraelIONSEC Teamhttps://www.ionsec.io/resources/ransomprotect---open-source-defense-against-ransomware-wipershttps://www.ionsec.io/resources/ransomprotect---open-source-defense-against-ransomware-wipersRansomProtect is our open-source tool that detects and blocks ransomware and wipers early in the infection chain, where built-in OS defenses fall short.Tue, 01 Jul 2025 00:00:00 GMTToolsopen-sourceransomwarewiperendpoint-securityIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-the-improvate-ciso-summithttps://www.ionsec.io/resources/ionsec-at-the-improvate-ciso-summitTwo months ago, IONSEC had the privilege of participating in the CISO Summit by IMPROVATE — a premier platform for connecting with Israel’s leading cybersecurity executives and security professionals.Mon, 30 Jun 2025 00:00:00 GMTNewseventsconferencecisoIONSEC Teamhttps://www.ionsec.io/resources/gisec-2025https://www.ionsec.io/resources/gisec-2025IONSEC is proud to showcase an exclusive preview of our next-generation Digital Forensics and Incident Response (DFIR) platform at GISEC Global 2025, one of the world’s premier cybersecurity events in Dubai.Tue, 06 May 2025 00:00:00 GMTNewseventsgisecconferenceIONSEC Teamhttps://www.ionsec.io/resources/why-malware-analysis-training-is-vital-lessons-from-real-world-cyber-attackshttps://www.ionsec.io/resources/why-malware-analysis-training-is-vital-lessons-from-real-world-cyber-attacksPicture this: airport metal detectors efficiently catch large, obvious weapons, but small components slip through unnoticed. Once inside, attackers assemble them into a complete weapon.Wed, 11 Dec 2024 00:00:00 GMTArticlemalware-analysistrainingawarenessincident-responseIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-hackexpo-2024---breach-at-the-frontlinehttps://www.ionsec.io/resources/ionsec-at-hackexpo-2024---breach-at-the-frontlineAt HackExpo 2024, IONSEC CEO Nir Halfon shared practical strategies for responding to exploits in fintech first-party applications under live pressure.Thu, 28 Nov 2024 00:00:00 GMTNewseventsconferenceincident-responsefintechIONSEC Teamhttps://www.ionsec.io/resources/reverse-engineering-godpotato-msascui-exehttps://www.ionsec.io/resources/reverse-engineering-godpotato-msascui-exePrivilege escalation is a critical technique employed by attackers to gain unauthorized access to higher system privileges, often leading to significant security breaches.Sun, 10 Nov 2024 00:00:00 GMTBlogreverse-engineeringprivilege-escalationwindowsmalware-analysisIONSEC Teamhttps://www.ionsec.io/resources/clearing-the-mist-unveiling-fog-ransomwarehttps://www.ionsec.io/resources/clearing-the-mist-unveiling-fog-ransomwareA full analysis of the Fog Ransomware Group: the malware it deploys, the TTPs it relies on to infiltrate high-tech firms, and how defenders can disrupt it.Sun, 25 Aug 2024 00:00:00 GMTBlogransomwaremalware-analysisthreat-intelligencettpsIONSEC Teamhttps://www.ionsec.io/resources/ionsec-joins-the-3rd-mirror-forum-with-incdhttps://www.ionsec.io/resources/ionsec-joins-the-3rd-mirror-forum-with-incdOn June 28, IONSEC proudly participated in the third MIRROR Forum — a unique gathering of 15 Incident Response (IR) companies across Israel, convened by the Israel National Cyber Directorate (INCD).Fri, 28 Jun 2024 00:00:00 GMTNewseventsincdcollaborationIONSEC Teamhttps://www.ionsec.io/resources/ionsec-shares-wiper-malware-research-with-czech-delegation-in-israelhttps://www.ionsec.io/resources/ionsec-shares-wiper-malware-research-with-czech-delegation-in-israelIONSEC hosted a Czech delegation in Israel to present our Wiper malware research, including the campaign we track as Operation HANDALA.Sun, 02 Jun 2024 00:00:00 GMTNewswipermalware-analysisoperation-handalathreat-intelligenceeventsIONSEC Teamhttps://www.ionsec.io/resources/ionsec-at-gpec-2024---showcasing-apt-research-on-the-global-stage-98do0-brms0https://www.ionsec.io/resources/ionsec-at-gpec-2024---showcasing-apt-research-on-the-global-stage-98do0-brms0Wow — what a journey GPEC (General Police Equipment Exhibition & Conference) was this year. Standing among 471 exhibitors from 32 different countries was nothing short of inspiring. The scale, the diversity, and the energy of the event made it a true highlight of 2024.Wed, 08 May 2024 00:00:00 GMTNewseventsconferenceaptthreat-intelligenceIONSEC Teamhttps://www.ionsec.io/resources/sovateam---new-state-sponsored-apthttps://www.ionsec.io/resources/sovateam---new-state-sponsored-aptHow IONSEC and White-Hat traced the Sova Team threat actor through a ransom note to uncover a state-sponsored APT operating past strict security controls.Sun, 31 Mar 2024 00:00:00 GMTBlogaptransomwarethreat-intelligenceincident-responseIONSEC Teamhttps://www.ionsec.io/resources/sqyrh-mvdy-ynyt-2024-opisraelhttps://www.ionsec.io/resources/sqyrh-mvdy-ynyt-2024-opisraelIONSEC הינה חברת בוטיק לשירותי אבטחת מידע ותגובה לאירועי סייבר (24/7) העוסקת במחקר ותגובה לאיומים מתקדמים ומספקת פתרונות אבטחה מותאמים אישית לחברות ברחבי העולם.Sun, 24 Mar 2024 00:00:00 GMTBlogopisraelthreat-intelligencehacktivismisraelIONSEC Team