Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to incident-response.

59 more tags

AnalysisMembersConstructed

Incident report: Kesterline Components, 8 May 2026

A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.

1 Sept 2026about 2 hours of workT1566.002T1059.001T1003.001dfir-report ransomware incident-response timeline

Full write-up available to members subscribers. See what is included.