Tag: triage
All the articles with the tag "triage".
-
TORA — Shift 7 SHIFT-20260508-024510 in Review
A five-day shift dominated by an active Okta-impersonation credential-harvest campaign, a multi-asset Remcos C2 deployment, and a persistent email gateway enforcement failure. All 11 escalations landed at P1 — no P2 or P3 cases were generated.
-
TORA — Shift 6 in Review
A five-day shift dominated by phishing domain noise and high-severity C2 and tunneling activity against production infrastructure, with a recurring CMDB coverage gap blocking triage on five alerts sourced from a single unenriched IP.
-
TORA Week in Review — Apr 20–24, 2026
A high-tempo week dominated by confirmed post-compromise C2 callbacks on critical infrastructure, active multi-host campaigns from repeat attacker IPs, and a persistent enrichment pipeline failure on the 10.10.6.0/24 segment that left high-confidence threats in holding. Twelve escalations, four forced-context holds, and no quiet days.
-
TORA Week in Review — Apr 13–17, 2026
A high-severity shift dominated by an active LockBit and Brute Ratel campaign spanning multiple internal hosts, with confirmed SSH-to-C2 compromise chains, a live DNS tunneling case, and a persistent unmanaged asset generating signals with no CMDB identity — this week revealed both active intrusions and structural gaps in asset inventory.
-
TORA Week in Review — Apr 6–10, 2026
A high-volume intrusion week dominated by confirmed SSH compromises and active C2 callbacks across critical infrastructure, with at least three distinct attacker IPs running coordinated multi-host campaigns against srv-ad-01.corp.local and srv-db-staging.corp.local. Fifteen P1 escalations, zero P2 or P3, and a persistent CMDB gap in 10.10.6.200 that blocked triage across four cases.
-
TORA Week in Review — Mar 30–Apr 3, 2026
A high-tempo week dominated by active C2 resolutions and confirmed SSH-to-C2 pivot chains across production and staging infrastructure, with BlackCat ransomware and QakBot emerging as the primary threat families. Twelve P1 escalations and four confirmed SSH brute-force successes define the shape of the week.