Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#ransomware
Newest first
Crypto Address Investigation for SOC Analysts: What the Chain Can and Cannot Tell You
Ransom notes, sextortion emails, drainer kits and fake invoices all end in a wallet address. A practical primer on address formats, clustering heuristics, mixers and bridges, and the legal care an analyst needs before following the money.
Ransomware Response: The Decisions That Matter in the First 24 Hours
Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note