Kevin Beaumont on Nostr: IR vendors have started sharing their #PitScaler write ups but they’re sharing ...

IR vendors have started sharing their #PitScaler write ups but they’re sharing webshell names (.sig files) and attacker IPs - which are unique per victim, so it’s helping me map out the victim orgs via network traffic.

If they failed to remediate you can also then access with the webshell name. One also uploaded their IR investigation to VirusTotal.