tdungan — Live Investigation Report

Campaign mode. nfury IOCs injected. Same C2 192.168.1.5/ads/, different httppump variant. T1566 Phishing confirmed as campaign initial access. SRL-Helpdesk NTLM matches nfury. 13 confirmed, 4 refuted. 15 minutes. ~$14.

Open full screen

---