# IONSEC

> IONSEC is a boutique Israeli digital forensics and incident response (DFIR) firm. We run 24/7 emergency incident response across IT, cloud, AI, OT and IoT networks with an assured four-hour response from first contact, publish open-source DFIR tooling, and track state-sponsored threat actors. The people who publish our APT research are the people who take your escalations.

Full text of every page and post is available at https://www.ionsec.io/llms-full.txt
Any individual post is also available as clean markdown by appending `.md` to its URL.

## Core pages

- [Incident response](https://www.ionsec.io/incident-response): What incident response is, how an engagement runs, and every incident response case study and tool we have published.
- [Digital forensics (DFIR)](https://www.ionsec.io/digital-forensics): What digital forensics and incident response is, the evidence sources it depends on, and our open-source forensic tooling.
- [Cyber research](https://www.ionsec.io/cyber-research): Our published research on state-sponsored actors, wiper malware and live intrusions, and the forums where we present it.
- [AI security](https://www.ionsec.io/ai-security): Securing and investigating AI agent runtimes: why agents leave no disk to image, and what forensic readiness for agentic systems requires.
- [Services](https://www.ionsec.io/services): Cyber preparedness, Tier 3 as a Service, and 24/7 emergency incident response for IT, cloud, AI, OT and IoT networks.
- [Tooling & research](https://www.ionsec.io/tooling): Open-source DFIR tools and published threat research. Free to use, free to read, no gate.
- [About IONSEC](https://www.ionsec.io/about): A boutique house of responders and researchers. Leadership, how we work, and standing in the ecosystem.
- [Resources](https://www.ionsec.io/resources): Knowledge base — blogs, articles, case studies, tools and news.
- [Contact](https://www.ionsec.io/contact): Reach the IONSEC team. 24/7 emergency WhatsApp line, or info@ionsec.io for general enquiries.
- [Under attack?](https://www.ionsec.io/under-attack): Active breach or live incident — reach on-call responders 24/7, with a do/do-not checklist while you wait.

## Services

- [Cyber Preparedness](https://www.ionsec.io/services/cyber-preparedness): Map your IT, cloud, AI, OT and IoT estate, close the visibility gaps an investigation depends on, and rehearse your incident response before you need it.
- [T3aaS — Tier 3 as a Service](https://www.ionsec.io/services/t3aas): On-demand senior escalation for your SOC: threat hunting, malware analysis and reverse engineering, and detection engineering, without carrying the headcount.
- [Emergency Incident Response](https://www.ionsec.io/services/emergency-ir): 24/7 emergency incident response with an assured four-hour response from first contact: containment, full attack-chain reconstruction, and guided recovery.

## Open-source tooling

- [INSITO](https://www.ionsec.io/resources/insito-rhysida-esxi-recovery): Recovers files encrypted by the Rhysida ESXi locker without the attacker's key: finds the clock second that seeded every per-file key from the encrypted files alone. One static binary, runs on the ESXi shell, fully offline. Source: https://github.com/ionsec/insito
- [gha-injection-detector](https://www.ionsec.io/resources/github-actions-input-injection-cloud-takeover): Finds ${{ }} interpolated into run blocks, and the dispatch + environment + injectable-step chain that turns one workflow input into stolen cloud credentials. Four rules, text/JSON/SARIF out, standard library only.
- [node2shell-detector](https://www.ionsec.io/resources/node2shell-brotli-decoder-rce-cve-2026-111497): Local + network detections for Node2Shell (CVE-2026-111497): runtime posture, Brotli decoder fingerprints, dependency exposure and log fingerprints in one stdlib-only CLI, with Sigma, Suricata, ModSecurity, YARA and edge rules beside it. Source: https://github.com/ionsec/node2shell-detector
- [php2shell-detector](https://www.ionsec.io/resources/php2shell-two-php-core-rce-vulnerabilities): Local + network detections for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): host posture, access-log fingerprints and binary drift in one stdlib-only CLI, with Sigma, Suricata and ModSecurity rules beside it. Source: https://github.com/ionsec/php2shell-detector
- [MAES](https://www.ionsec.io/resources/maes-the-m365-analyzer-extractor-suite): The M365 Analyzer & Extractor Suite: extract, analyze and preserve evidence from Microsoft 365 tenants with SHA-256 chain of custody. Source: https://github.com/ionsec/maes-platform
- [Forti-DFIR](https://www.ionsec.io/resources/forti-dfir-open-source-framework-for-fortinet-forensics-incident-response): Open-source framework giving security teams the tooling they need for forensic investigations and incident response in Fortinet environments. Source: https://github.com/ionsec/Forti-DFIR
- [RansomProtect](https://www.ionsec.io/resources/ransomprotect---open-source-defense-against-ransomware-wipers): Detects and blocks ransomware and wipers early in the infection chain, where built-in OS defenses fall short. Source: https://github.com/ionsec/RansomProtect
- [FlareInspect](https://www.ionsec.io/resources/flareinspect): CLI assessment framework for evaluating and monitoring an organization’s Cloudflare security posture. Source: https://github.com/ionsec/FlareInspect
- [DO Audit Log Scraper](https://www.ionsec.io/resources/do-audit-log-scraper-v2-0): Chrome/Chromium extension enabling forensic-grade audit log extraction. Now at v2.0. Source: https://github.com/ionsec/DO-Audit-Log-Scraper
- [Tikun13 Checker](https://www.ionsec.io/resources/tikun13checker): Browser-based open-source checker helping Israeli organizations implement the requirements of Amendment 13 to the Privacy Protection Law. Source: https://github.com/ionsec/Tikun13checker

## Research and case studies

- [IONSEC TRACE: Leave No Model Untraced — Open-Source Forensics for the AI Harness](https://www.ionsec.io/resources/ionsec-trace-ai-harness-forensics): IONSEC TRACE is an open-source, forensically sound collector and analyzer for AI harness evidence — now 52 collectors, a Python CLI and a Go binary with near-identical capabilities, a 103-rule secret detector, and conversation secret hunting.
- [XSS2Shell: One Failed Login to PHP on the Server](https://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rce): CVE-2026-64638 is a reflected XSS on the WordPress login page — the finding most teams close as medium. Six gadgets sit between it and a PHP shell, and every one of them was already in core. Here is the chain, the log signatures, and what to harden after you patch.
- [XSS2Shell: מניסיון התחברות כושל אחד ועד PHP על השרת](https://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rce-he): CVE-2026-64638 היא חולשת XSS מוחזר בעמוד ההתחברות של וורדפרס — בדיוק הממצא שרוב הצוותים סוגרים כבינוני. בין החולשה הזו לבין הרצת PHP על השרת עומדים שישה שלבים נוספים, וכולם כבר היו בליבת המערכת. הנה השרשרת המלאה, חתימות הזיהוי בלוגים, וההקשחה שצריך לעשות אחרי העדכון.
- [The Machine Has No Disk: Forensic Readiness for AI Agent Runtimes](https://www.ionsec.io/resources/ai-agent-runtime-forensics): Forensic readiness for AI agent runtimes — Cloudflare Computer, NVIDIA OpenShell, and the collapse of the endpoint as an evidence source.
- [Coercion to krbtgt: NTLM Relay and ADCS ESC8 in 2026](https://www.ionsec.io/resources/coercion-to-krbtgt-ntlm-relay-and-adcs-esc8-in-2026): A full ESC8 walkthrough against a lab domain, then the forensic reconstruction — why the certificate serial, not the source IP, is the artifact that ties the whole chain together.
- [The 60-Minute Site: Phishing That Deletes Its Own Evidence](https://www.ionsec.io/resources/cloudflare-drop-60-minute-phishing): Cloudflare Drop publishes a site on a trusted workers.dev address with no account, then deletes it after an hour. That one-hour fuse burns your forensic evidence with it.
- [When Research Meets Reality](https://www.ionsec.io/resources/when-research-meets-reality): How Threat-Actor Campaigns Cast a Shadow on Legitimate npm Binaries (and What IONSEC IR Sees in the wild)
- [How a Weaponized Zoom Installer Opened the Door for BlueNoroff](https://www.ionsec.io/resources/how-a-weaponized-zoom-installer-opened-the-door-for-bluenoroff): IONSEC investigates a BlueNoroff intrusion that began with a weaponized Zoom installer, combining deepfakes, social engineering and evasive scripting.
- [Iranian Threat Actor Hijacks DNS](https://www.ionsec.io/resources/iranian-threat-actor-hijacks-dns): קבוצת התקיפה האיראנית פתח אלקודס פרצה לרשם דומיינים ישראלי ושינתה רשומות DNS ו-MX של יותר מ-1,000 דומיינים, והפנתה אותם לשרת זדוני ולדף תעמולה.
- [Why Malware Analysis Training is Vital: Lessons from Real-World Cyber Attacks](https://www.ionsec.io/resources/why-malware-analysis-training-is-vital-lessons-from-real-world-cyber-attacks): Picture this: airport metal detectors efficiently catch large, obvious weapons, but small components slip through unnoticed. Once inside, attackers assemble them into a complete weapon.
- [Reverse Engineering GodPotato (MSASCui.exe)](https://www.ionsec.io/resources/reverse-engineering-godpotato-msascui-exe): Privilege escalation is a critical technique employed by attackers to gain unauthorized access to higher system privileges, often leading to significant security breaches.
- [Clearing the Mist: Unveiling Fog Ransomware](https://www.ionsec.io/resources/clearing-the-mist-unveiling-fog-ransomware): A full analysis of the Fog Ransomware Group: the malware it deploys, the TTPs it relies on to infiltrate high-tech firms, and how defenders can disrupt it.
- [SovaTeam - New State-Sponsored APT](https://www.ionsec.io/resources/sovateam---new-state-sponsored-apt): How IONSEC and White-Hat traced the Sova Team threat actor through a ransom note to uncover a state-sponsored APT operating past strict security controls.
- [סקירה מודיעינית 2024 #OpIsrael](https://www.ionsec.io/resources/sqyrh-mvdy-ynyt-2024-opisrael): IONSEC הינה חברת בוטיק לשירותי אבטחת מידע ותגובה לאירועי סייבר (24/7) העוסקת במחקר ותגובה לאיומים מתקדמים ומספקת פתרונות אבטחה מותאמים אישית לחברות ברחבי העולם.

## Appearances

- [GISEC Global 2025 (2025)](https://www.ionsec.io/resources/gisec-2025): Israeli Pavilion, Dubai — preview of our next-generation DFIR platform.
- [IMPROVATE CISO Summit (2025)](https://www.ionsec.io/resources/ionsec-at-the-improvate-ciso-summit): Connecting with Israel’s leading cybersecurity executives.
- [HackExpo 2024 (2024)](https://www.ionsec.io/resources/ionsec-at-hackexpo-2024---breach-at-the-frontline): Breach at the frontline — responding to fintech exploits under live pressure.
- [GPEC 2024 (2024)](https://www.ionsec.io/resources/ionsec-at-gpec-2024---showcasing-apt-research-on-the-global-stage-98do0-brms0): Showcasing APT research among 471 exhibitors from 32 countries.
- [3rd MIRROR Forum with the Israel National Cyber Directorate (2024)](https://www.ionsec.io/resources/ionsec-joins-the-3rd-mirror-forum-with-incd): Third forum of 15 Israeli IR companies, convened by the national cyber directorate.
- [Czech delegation wiper malware briefing (2024)](https://www.ionsec.io/resources/ionsec-shares-wiper-malware-research-with-czech-delegation-in-israel): Hosted a Czech delegation in Israel to present our wiper malware research, including the campaign we track as Operation HANDALA.

## People

- [Nir Halfon](https://www.ionsec.io/about#nir-halfon): Founder & Chief Executive Officer. Leads IONSEC's research and response practice. Presented at HackExpo 2024 on responding to exploits in fintech first-party applications under live pressure, and represents IONSEC in the INCD MIRROR Forum.
- [Moran Halfon](https://www.ionsec.io/about#moran-halfon): Chief Operating Officer. Runs engagement delivery and the on-call rota that backs the four-hour response commitment — scoping, scheduling and keeping the reporting readable for boards, insurers and regulators.

## Contact

- 24/7 emergency incident response: https://www.ionsec.io/under-attack
- Email: info@ionsec.io
- Phone / WhatsApp: +972 54 318 1773