When an intrusion is live, the first hours decide the cost. Aureon puts senior responders on the case within the hour, contains the adversary, reconstructs what happened and delivers evidence that holds up with boards, insurers, regulators and courts.
Aureon's DFIR practice is built for high-severity events: ransomware, business email compromise, insider misconduct, supply-chain intrusions, cloud account takeover and data theft. We work directly with the client's leadership and technical teams, or through the insurer, broker and breach counsel coordinating the claim.
Our responders are senior practitioners by design. Every engagement is led by someone who has run complex incidents end to end, and every finding is backed by artefacts that can be reproduced, cross-examined and audited.
Containment that comes too late, evidence lost to a hasty rebuild, a regulator notified without facts: most of the damage in an incident is done by decisions taken in the first three days. Our response is built around that window.
A single call activates a response lead and an analyst team. We take command of containment, evidence preservation and stakeholder communication from the first hour.
Forensically sound acquisition of endpoints, servers, hypervisors, mobile devices, cloud tenants and network evidence, with full chain of custody aligned with ISO/IEC 27037.
Timeline analysis across endpoint, identity, email, network and cloud telemetry to establish initial access, lateral movement, persistence, privilege escalation, exfiltration and impact.
Mailbox and identity forensics for invoice fraud, payment diversion and account takeover, including evidence packages for banks, insurers and law enforcement.
Investigation of Microsoft 365, Google Workspace, Entra ID, AWS, Azure and GCP incidents using native logs, audit trails and third-party telemetry.
Determination of what data left the environment, from where and in what volume, including structured review to support notification decisions under GDPR, UAE PDPL and sector rules.
Expert reports, affidavits and testimony. We support counsel in civil, criminal and regulatory proceedings in the EU, the UK and the GCC.
Pre-agreed terms, onboarding of your environment and guaranteed response times, so the first call during a crisis is to a team that already knows you.
Response lead assigned, scoping call held, immediate containment advice issued, evidence preservation started. Insurer and counsel briefed where the engagement is panel-based.
Endpoint detection deployed or tuned, identity locked down, adversary access severed, logs centralised, initial hypotheses documented.
Forensic imaging and analysis, timeline reconstruction, exfiltration assessment, threat actor identification, eradication plan validated against evidence.
Hardened rebuild supported, monitoring in place, executive and technical reports delivered, regulatory and contractual notifications supported, lessons learned workshop held.
Clear, usable outputs for executives, technical teams, insurers and regulators.
Yes. We are technology-agnostic and work with the EDR, SIEM, identity and backup platforms you already run. Where visibility is missing we deploy our own tooling for the duration of the engagement and remove it afterwards.
Yes. A large share of our work is instructed through cyber insurers, brokers, loss adjusters and breach counsel. We understand privilege, reserving and coverage requirements and report accordingly.
Every acquisition is documented with hashes, custody records and a reproducible methodology. Our reports are written to be examined by opposing experts, and our practitioners provide testimony where required.
Most response work starts remotely within the hour. On-site deployment across Europe, the Middle East and Africa is arranged where physical acquisition or executive presence is required.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
An unauthenticated command injection in the SNMP notification path of Zimbra Collaboration was probed before public disclosure and exploited at scale afterwards. Microsoft's reconstruction shows web shells, a route to root through PAM, credential dumps and a cloud exfiltration attempt. The fix is 10.1.20. The work starts after the patch.
Read articleFacing an active incident? Email the incident desk and a response lead will call you back.