<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>dfir.buzz</title>
    <link>https://dfir.buzz</link>
    <description>Security engineering, DFIR, and whatever CTI thread I can't drop.</description>
    <language>en</language>
    <atom:link href="https://dfir.buzz/feed.xml" rel="self" type="application/rss+xml"/>
    
    <item>
      <title>The 12-Minute Help Desk: Tracking the SNOW Suite</title>
      <link>https://dfir.buzz/posts/2026-05-05-teams-impersonation/</link>
      <description>Former Black Basta affiliates built a framework to automate social engineering at scale. This is what it looks like when it runs.</description>
      <pubDate>Tue, 05 May 2026 00:00:00 GMT</pubDate>
      <guid isPermaLink="true">https://dfir.buzz/posts/2026-05-05-teams-impersonation/</guid>
      <dc:subject>Incident Response</dc:subject>
    </item>
    
  </channel>
</rss>
