Vietnam
Vietnam: checking the StormEncryptor warning and RMM security
A public warning and N-able's notice raise questions about centralized administration. Reference analysis, not a report of a new attack.
Ransomware.VNVerifiedTechnical analysis
From indicators to conclusions: check structure, behavior and evidence before attribution.
International
Warlock: use the SharePoint → SYSVOL chain to prioritize investigation
Symantec and Carbon Black's 1 October report highlights SharePoint entry and SYSVOL deployment. A focused reading for enterprise defenders.
Ransomware.VNVerified
Technical analysis
Do not identify a ransomware family from a file extension alone
Extensions and ransom notes are leads. Attribution requires comparable samples, behavior and timelines, with an explained confidence level.
Tùng TEKVerified
Forensic
Forensic timelines: reconstruct incidents from verifiable timestamps
Combine logs, metadata and storage artifacts into a sourced timeline while retaining gaps and clock discrepancies.
Tùng TEKVerified
International
CVE-2024-37085: lessons in ESXi and Active Directory administrator permissions
Reference analysis of Microsoft's 2024 research, with questions for reviewing access and protecting virtualization infrastructure.
Tùng TEKVerified
Technical analysis
Ransomware .PIZ via MSSQL: comparing the attack chain with CyRadar's source
Correcting attribution in the archive: separate CyRadar's MSSQL report from .PIZ, AnyDesk and Safe Mode hypotheses; retain log checklists and technical material for comparison.
No.Ransomware.VNNot independently verified
Technical analysis
Ransomware 2026: interpreting claim data and preparing recovery
Preserves the original Cyble, downtime, partial-encryption and RFC analysis while distinguishing claim publication from intrusion/encryption dates.
No.Ransomware.VNNot independently verified