Anti-Forensics.com — Forensic Integrity Threat Feed

Anti-Forensics.com — Forensic Integrity Threat Feedhttps://anti-forensics.com/threat-feed/Bounded original-source selection with editorial annotations; retrospective reports, not a live incident stream.How Storm-2949 turned a compromised identity into a cloud-wide breachhttps://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/Microsoft reports cleanup of local forensic artifacts in a cloud-to-endpoint intrusion. Preserve the distinction between endpoint history and cloud audit coverage, and trace credential context through the available identity records before naming a person.ms-storm-2949-cloud-breach-2026:6d987f7c97f72659e595f8b258e5580f0e35f019beaa8165afc0b590ac5f83f7Mon, 18 May 2026 22:42:50 +0000VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisorshttps://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypassMandiant explicitly describes investigative challenges from disabled or altered logging and guest operations without default guest logs. Treat hypervisor, guest, and central logging as separate coverage questions and preserve surviving sources with their collection limits.mandiant-unc3886-esxi-logging-2023:6e12caf17b123dc636201775a8c53145ce5887bddfa6c64e86aadbf3ca7977faIndustroyer2: Industroyer reloadedhttps://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ESET and CERT-UA investigated an energy-sector attack involving Industroyer2 and destructive malware. ESET distinguishes observed deployment from assessed purpose; examine surviving remote records and source collections without assuming every affected system or copy had the same outcome.eset-industroyer2-caddywiper-2022:9a7ca0a4ce6072a57164fa1dacda9419f88bf3de48d489aab83e7a2336650f25Destructive malware targeting Ukrainian organizationshttps://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/Microsoft reports destructive effects on boot records and file content behind a ransom message. Evidence availability can be affected before collection; corroborate the reported behavior against preserved originals and independent records. This is a historical source, not a new incident alert.ms-destructive:01638b463ddd9e1c3c99674fa921ff682808e2786936b147d100103e1455fba4Sun, 16 Jan 2022 02:28:30 +0000Suspected Russian Activity Targeting Government and Business Entities Around the Globehttps://cloud.google.com/blog/topics/threat-intelligence/russian-targeting-gov-businessMandiant reports stopped Sysmon and Splunk logging alongside cleared Windows events. The combination illustrates why source generation, forwarding health, retained central copies, and cloud identity records must be reviewed as separate evidence paths.mandiant-russian-targeting-log-gaps-2021:81e840df9d6695190495bede0139061a9bfd0fdc90fef7495960a09390249741Human-operated ransomware attacks: A preventable disasterhttps://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/Microsoft describes event-log clearing within observed human-operated ransomware activity. The investigative implication is to compare native endpoint channels with retained central copies and collection status; a gap by itself does not attribute an actor.ms-human-operated-ransomware-2020:dec30451c17fbcae60fded55d5e1f19eeb82e94a06417bb01fc3f8b261be470fThu, 05 Mar 2020 17:00:31 +0000