{"product_id":"39390","title":"ClickFix leads to Tsundere Bot, Tunnels, RMM's and Double Theft - Private Case #39390","description":"\u003cp class=\"p1\"\u003eThis case is based on a Private Threat Brief detailing a single workstation compromise that launches a weeks long intrusion where the threat actor(s) return again and again bringing new tools and just one more RMM to the case before exfiltrating data from the environment. Not once, but twice. Throw in some tunneling and is that a virtual machine they dropped?\u003c\/p\u003e\n\u003cp class=\"p1\"\u003eThis case was featured in the 2026 \u003ca href=\"https:\/\/dfirlabs.thedfirreport.com\/dfirchallenge\" target=\"_blank\" rel=\"noopener\"\u003eDFIR Challenge\u003c\/a\u003e.\u003c\/p\u003e\n\u003cp\u003eTo read more about DFIR Labs click \u003ca rel=\"noopener\" href=\"https:\/\/thedfirreport.com\/services\/dfir-labs\/\" target=\"_blank\"\u003ehere\u003c\/a\u003e.\u003c\/p\u003e\n\u003cdiv class=\"license-type-notice p-4 mb-4 bg-blue-50 border-l-4 border-blue-500 rounded-md\"\u003e\n\u003ch4 class=\"font-bold text-gray-900 mb-2\"\u003eImportant: Choose the Correct License Type\u003c\/h4\u003e\n\u003cdiv class=\"grid grid-cols-1 md:grid-cols-2 gap-4 mb-3\"\u003e\n\u003cdiv class=\"p-3 bg-white border border-gray-200 rounded-md\"\u003e\n\u003cdiv class=\"flex items-center mb-2\"\u003e\n\u003cspan class=\"w-8 h-8 bg-blue-100 rounded-full flex items-center justify-center mr-2\"\u003e \u003ci class=\"fas fa-user text-blue-500\"\u003e\u003c\/i\u003e \u003c\/span\u003e\n\u003ch5 class=\"font-semibold\"\u003ePersonal License\u003c\/h5\u003e\n\u003c\/div\u003e\n\u003cp class=\"text-sm text-gray-600\"\u003eFor individuals paying out of their own pocket for personal skill development only.\u003c\/p\u003e\n\u003cul class=\"text-sm text-gray-600 mt-2 list-disc list-inside\"\u003e\n\u003cli\u003eSelf-funded learning\u003c\/li\u003e\n\u003cli\u003ePersonal skill improvement\u003c\/li\u003e\n\u003cli\u003eNo organizational benefit\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"p-3 bg-white border border-green-200 rounded-md\"\u003e\n\u003cdiv class=\"flex items-center mb-2\"\u003e\n\u003cspan class=\"w-8 h-8 bg-green-100 rounded-full flex items-center justify-center mr-2\"\u003e \u003ci class=\"fas fa-building text-green-500\"\u003e\u003c\/i\u003e \u003c\/span\u003e\n\u003ch5 class=\"font-semibold\"\u003eEnterprise License\u003c\/h5\u003e\n\u003c\/div\u003e\n\u003cp class=\"text-sm text-gray-600\"\u003e\u003cstrong\u003eRequired\u003c\/strong\u003e if any organization benefits from your use, including:\u003c\/p\u003e\n\u003cul class=\"text-sm text-gray-600 mt-2 list-disc list-inside\"\u003e\n\u003cli\u003eCompany-sponsored training\u003c\/li\u003e\n\u003cli\u003eSkills used for work purposes\u003c\/li\u003e\n\u003cli\u003eEducational institutions\u003c\/li\u003e\n\u003cli\u003eTeam learning activities\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"bg-yellow-50 p-3 rounded-md border-l-4 border-yellow-400 text-sm\"\u003e\n\u003cp\u003e\u003cstrong\u003eImportant:\u003c\/strong\u003e If your employer is paying for this lab OR if the skills learned will benefit your employer\/organization in any way, you \u003cstrong\u003emust\u003c\/strong\u003e purchase an Enterprise license. This applies even if you're paying personally but using the skills for work.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cp\u003e\u003cstrong\u003eYou will receive an email within 5 minutes of purchase with instructions on how to activate the lab. Buy now, use anytime within the next 3 months. Enjoy!\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cem\u003e\u003cstrong\u003eDisclaimer\u003c\/strong\u003e\u003c\/em\u003e\u003c\/p\u003e\n\u003cp\u003eAll information in the DFIR Labs and analysis of that information shall be treated as TLP:RED. This classification mandates that the information is not shared publicly or privately without explicit permission from The DFIR Report.\u003c\/p\u003e\n\u003cp\u003eThe difficulty of each DFIR Lab case is inherently subjective and may vary based on the participant's individual skills and experience.\u003c\/p\u003e","brand":"My Store","offers":[{"title":"2 days \/ Elastic \/ Personal","offer_id":53968477356326,"sku":null,"price":24.99,"currency_code":"USD","in_stock":true},{"title":"2 days \/ Elastic \/ Business\/Organization","offer_id":53968477389094,"sku":null,"price":119.99,"currency_code":"USD","in_stock":true},{"title":"2 days \/ Splunk \/ Personal","offer_id":53968477421862,"sku":null,"price":29.99,"currency_code":"USD","in_stock":true},{"title":"2 days \/ Splunk \/ Business\/Organization","offer_id":53968477454630,"sku":null,"price":124.99,"currency_code":"USD","in_stock":true},{"title":"7 days \/ Elastic \/ Personal","offer_id":53968477487398,"sku":null,"price":59.99,"currency_code":"USD","in_stock":true},{"title":"7 days \/ Elastic \/ Business\/Organization","offer_id":53968477520166,"sku":null,"price":154.99,"currency_code":"USD","in_stock":true},{"title":"7 days \/ Splunk \/ Personal","offer_id":53968477552934,"sku":null,"price":64.99,"currency_code":"USD","in_stock":true},{"title":"7 days \/ Splunk \/ Business\/Organization","offer_id":53968477585702,"sku":null,"price":159.99,"currency_code":"USD","in_stock":true},{"title":"14 days \/ Elastic \/ Personal","offer_id":53968477618470,"sku":null,"price":99.99,"currency_code":"USD","in_stock":true},{"title":"14 days \/ Elastic \/ Business\/Organization","offer_id":53968477651238,"sku":null,"price":204.99,"currency_code":"USD","in_stock":true},{"title":"14 days \/ Splunk \/ Personal","offer_id":53968477684006,"sku":null,"price":109.99,"currency_code":"USD","in_stock":true},{"title":"14 days \/ Splunk \/ Business\/Organization","offer_id":53968477716774,"sku":null,"price":214.99,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0824\/5225\/0918\/files\/39390.png?v=1790694937","url":"https:\/\/store.thedfirreport.com\/products\/39390","provider":"The DFIR Report","version":"1.0","type":"link"}