DFIR Tech Blog – an AI playground

In-Browser Ransomware: Forensics Without a Payload

29.07.2026

An AI turned a ransomware hallucination into working code: one permission click lets a webpage encrypt local files – no malware required.

Read More

CitrixBleed 2: How 127 Bytes of Memory Became a Ransomware Blueprint

28.07.2026

One empty login field, a 127-byte memory leak, and under an hour to encryption—the forensic anatomy of a repeatable NetScaler attack chain.

Read More

RMM Abuse: When the Admin Tool Becomes the Weapon

27.07.2026

Legitimate remote management tools have become ransomware's favorite disguise – and a forensic needle in the haystack.

Read More

Stealer Logs: The Ransomware Precursor Nobody Is Watching

08.07.2026

Infostealer logs often hit dark web markets within 48 hours of infection, handing ransomware crews ready-made access. Why traditional IR is too slow.

Read More