https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader — url
CASE-20260827-3A4F
MEDIUM
OPEN
Assignee: unassigned · Opened 15h ago
Opened from url https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader
🔄 Pivot:📁 url
Entities
1
linked to case
IoCs
0
indicators
Entity types
1
dimensions
Evidence events
2
chain of custody
➕ Add anything to this case
Attach any entity — region, country, APT, source, MITRE technique, IoC, nation-state, campaign, data point, mission domain, CVE, malware, ransomware — and all linked entities are pulled in automatically.
🤖 Case Operations
📜 Chain of Evidence (tamper-evident, hash-chained)
| When | Actor | Action | Entity | Source | Hash |
|---|---|---|---|---|---|
| 2026-08-27 15:29:35 | analyst | add | url: https://www.proofpoint.com/us/ | manual · primary | a2b93b7816 |
| 2026-08-27 15:29:35 | analyst | open | url: https://www.proofpoint.com/us/ | analyst · case created | 10b5725393 |
Each record's hash chains to the previous, so any tampering is detectable. Export the full trail via the Evidence report.
📝 Case Notes (0)
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Attach all related IoCs as artifacts
- Run a response playbook per case type
- Escalate to legal when needed