Incident Response Checklist

🚨 Immediate Actions (0-24 hours)

• Alert all affected institutions and partners in the targeted regions.
• Block known malicious domains (e.g., mofa-gov-bd[.]filenest[.]live) at the network perimeter.
• Update email filters to detect and quarantine spear-phishing emails with similar characteristics.
• Distribute indicators of compromise (IOCs) to all relevant teams for immediate action.
• Initiate a threat hunt focused on identifying ClickOnce applications and suspicious DLL activity.