After our initial #PolarEdge #botnet write-up, we’re happy to announce the second part: “Defrosting PolarEdge’s Backdoor,” a full technical deep-dive into its TLS-based implant. blog.sekoia.io/polaredge-ba...

Je recherche un Threat Researcher pour l’équipe TDR de @sekoia.io ! Vous aimez faire des règles #Sigma et #Yara ? Vous adorez pivoter et traquer les infrastructures (C2) d’attaques des cybercriminels ? Alors cette offre d’emploi est faite pour vous ! www.welcometothejungle.com/en/companies...

📱 Silent Smishing: The Hidden Abuse of Cellular Router APIs Our latest #CTI investigation from Sekoia #TDR team uncovers a novel #smishing vector abusing Milesight industrial cellular router APIs to send phishing #SMS at scale. blog.sekoia.io/silent-smish...

🐻 #APT28 – Operation Phantom Net Voxel: deep-dive into the latest spear-phishing campaign targeting Ukrainian military administrative staff. blog.sekoia.io/apt28-operat...

[Threat investigation alert 🚨] Predators for Hire: A Global Overview of Commercial Surveillance Vendors ➡️ blog.sekoia.io/predators-fo...

🔥 Hot summer, sizzling crypto... and scammers turning up the heat 🔥 Back in March, Sekoia #TDR team published a deep-dive report on a #Lazarus cluster we dubbed #ClickFake Interview, leveraging the #ClickFix technique in their #ContagiousInterview campaign.

A few weeks ago, we published our global analysis of Adversary-in-the-Middle #phishing threats, providing actionable intelligence on multiple #AitM phishing kits. This report includes 11 sheets covering the most widespread #AitM phishing kits as of Q1 2025.

📝 Our latest #TDR report delivers an in-depth analysis of Adversary-in-the-Middle (#AitM) #phishing threats - targeting Microsoft 365 and Google accounts - and their ecosystem. This report shares actionable intelligence to help analysts detect and investigate AitM phishing.

🧀 The Sharp Taste of #Mimo’lette: Analyzing Mimo’s Latest Campaign targeting #Craft CMS blog.sekoia.io/the-sharp-ta...

🪤 Sekoia #TDR's new exclusive research uncovers the #ViciousTrap, a honeypot network deployed on compromised edge devices. blog.sekoia.io/vicioustrap-...

Our new report describes one of the latest observed infection chains (delivering #AsyncRAT) relying on the #Cloudflare tunnel infrastructure and the attacker’s #TTPs with a principal focus on detection opportunities. blog.sekoia.io/detecting-mu...

Since the apparition of the #Interlock ransomware, the Sekoia #TDR team observed its operators evolving, improving their toolset (#LummaStealer and #BerserkStealer), and leveraging new techniques such as #ClickFix to deploy the ransomware payload. blog.sekoia.io/interlock-ra...

🎉 It's not about a CTI investigation or a Detection Engineering topic, but today we are happy to announce that Sekoia.io has raised €26m! www.sekoia.io/en/presse/se...

🇰🇵 Sekoia #TDR team investigated a malicious campaign that employs fake job interview websites to deliver backdoors on Windows and macOS - #GolangGhost using #ClickFix tactic. Dubbed #ClickFake Interview, this campaign has been attributed to #Lazarus APT blog.sekoia.io/clickfake-in...

TDR analysts published an analysis of the new #ClearFake variant that relies on compromised websites injected with the malicious JavaScript framework, the #EtherHiding technique, and the #ClickFix social engineering tactic. buff.ly/vbiVbsN

TDR analysts published an analysis of the new #ClearFake variant that relies on compromised websites injected with the malicious JavaScript framework, the #EtherHiding technique, and the #ClickFix social engineering tactic. buff.ly/vbiVbsN

The conclusion (part three) of our series on #DetectionEngineering is finally here! buff.ly/dijB0fy

Using our #honeypots, we uncovered an unreported #botnet that has been operational since at least the end of November 2023. This #PolarEdge botnet has been focusing on #edge devices, particularly those made by #Cisco, #Asus, #QNAP, and #Synology. https://buff.ly/4ibOEo8

Cyber threats impacting the financial sector: focus on the main actors We're thrilled to announce the release of the latest strategic report by Sekoia #TDR. This analysis highlights key cyber threats to the #financial sector in 2024. https://buff.ly/3D3IZl7

🐭 RATatouille: Cooking Up Chaos in the I2P Kitchen 🔍 Our Threat Detection & Research (TDR) team has been analyzing a sophisticated new malware, #I2PRAT, featured in our latest FLINT report- now available in our blog! https://buff.ly/3WVWpqe

🐭 RATatouille: Cooking Up Chaos in the I2P Kitchen 🔍 Our Threat Detection & Research (TDR) team has been analyzing a sophisticated new malware, #I2PRAT, featured in our latest FLINT report- now available in our blog! https://buff.ly/3WVWpqe

🐭 RATatouille: Cooking Up Chaos in the I2P Kitchen 🔍 Our Threat Detection & Research (TDR) team has been analyzing a sophisticated new malware, #I2PRAT, featured in our latest FLINT report- now available in our blog! https://buff.ly/3WVWpqe

🔍 Large-scale detection engineering: part two! 🚀 In this article, we explore an innovative approach that transforms the execution of automated actions via CI/CD pipelines, enabling effective scaling and alignment with developer and DevOps practices.

🚨To strengthen the #investigation and #detection capabilities of the Sekoia.io Threat Detection & Research (TDR) team, we are looking for a Senior Technical Threat Researcher! www.welcometothejungle.com/fr/companies... #CTI #DetectionEngineering

TDR analysts analysed the supply chain attack targeting Chrome browser extensions, which potentially affected hundreds of thousands of end users in December 2024. https://buff.ly/4auQ0HN

Around 1,000 malicious domains are hosting webpages impersonating Reddit and WeTransfer, redirecting users to download password-protected archives These archives contain an AutoIT dropper, we internally named #SelfAU3 Dropper at @sekoia.io, which executes #Lumma Stealer IoCs ⬇️

🔍 TDR analysts discovered a new Adversary-in-the-Middle (#AiTM) #phishing kit, specifically targeting Microsoft 365 accounts and circumventing 2-step verification: Sneaky 2FA https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/ #detection #sneaky2fa

🇷🇺 #DoubleTap Campaign: #Russia-nexus APT possibly related to #APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations https://buff.ly/3WEwPG7

A look back at #PlugX #worm “sovereign disinfection” campaign

Please Santa please, gimme some #YARA 🎅🎄 This blog post on our use of #YARA rules is also an opportunity for us to announce the release of hundreds of our #YARA rules on GitHub, which are now directly integrated into VirusTotal for detection. https://blog.sekoia.io/happy-yara-christmas/

Please Santa please, gimme some #YARA 🎅🎄 This blog post on our use of #YARA rules is also an opportunity for us to announce the release of hundreds of our #YARA rules on GitHub, which are now directly integrated into VirusTotal for detection. https://blog.sekoia.io/happy-yara-christmas/

🛡️ Discover the first part of Sekoia.io's in-depth series on detection engineering at scale! This new report offers a holistic approach to tackle the myriad challenges faced by SOC and #DetectionEngineering teams. https://buff.ly/3ZWGU3c

🛡️ Discover the first part of Sekoia.io's in-depth series on detection engineering at scale! This new report offers a holistic approach to tackle the myriad challenges faced by SOC and #DetectionEngineering teams. https://buff.ly/3ZWGU3c

Ep. 8 of @intel471.bsky.social's Cybercrime Exposed podcast covers Raccoon Stealer, which was a popular and damaging infostealer. But its operator made a critical OPSEC error. Thanks to @crep1x.bsky.social of @sekoia.io. #infosec Full series on Apple and Spotify. intel471.com/resources/po...

🎯 Ransomware-driven data #exfiltration: techniques and implications Our new #TDR report focuses on the exfiltration techniques leveraged by #ransomware and #extortion groups. https://buff.ly/415o0ry #ThreatIntelligence #Detection

#Helldown #Ransomware: an overview of this emerging threat Our new report provides a comprehensive Analysis of Helldown: Tactics, Techniques, and Procedures (TTPs). blog.sekoia.io/helldown-ran...

🔐 #𝗗𝗦𝗜, #𝗥𝗦𝗦𝗜, face a l'𝗮𝘂𝗴𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗱𝗲𝘀 𝗰𝘆𝗯𝗲𝗿𝗺𝗲𝗻𝗮𝗰𝗲𝘀, manquez-vous de 𝘁𝗲𝗺𝗽𝘀 𝗼𝘂 𝗱𝗲 𝗿𝗲𝘀𝘀𝗼𝘂𝗿𝗰𝗲𝘀 pour réagir efficacement ? 💡New #𝗦𝗢𝗖 𝗯𝘆 #TIBCO, en partenariat avec #SEKOIA #TIBCO @sekoia-io.bsky.social Info sur la Solution SOC by TIBCO ℹ️ lotus-gamme-offres.tibco.fr/sentinelle

New paper ⤵️ blog.sekoia.io/the-architec...

🪪 Our new blog post explores the importance of Identity and Access Management (#IAM) event #detection. We focus at how Sekoia.io set up detection rules for @okta and @JumpCloud technologies. blog.sekoia.io/iam-detectio... #DetectionEngineering #Cloud #SOCplatform

🚨Our new report presents a technical analysis of the #ActiveMQ CVE-2023-46604 vulnerability exploited by #Kinsing and an in-depth analysis of this intrusion set, including its infrastructure and #cryptocurrency assets. blog.sekoia.io/activemq-cve...

🏦 Our latest report provides insights on the cyber threats impacting the #financial sector in 2023. We analysed the trends in lucrative and state-sponsored ecosystems and outlined the most notable evolutions. For more details, check out our blog post: blog.sekoia.io/unmasking-th...

#DarkGate gained popularity among threat actors (e.g: #TA577, #DuckTail), our #RE analysis details the internals of the malware, how it implements technique to evade defenses: Union-API, token theft via UpdateProcThreadAttribute, APC injection. blog.sekoia.io/darkgate-int...

🎮 We analyzed an ongoing campaign targeting online gamers. Multiple malware families are delivered through fake video game websites such as #Epsilon, #Doenerium, #BByStealer, and #NovaSentinel. blog.sekoia.io/game-over-ga... #CTI #infostealer

✨ En marge de l’European Cyber Week, nous organisons un nouvel EVINT le mardi 21 novembre prochain à partir de 19h à Rennes ! L'EVINT c'est une soirée conviviale dédiée à la Cyber Threat intelligence avec 3 interventions d'experts. N'hésitez pas à vous inscrire 👉 info.sekoia.io/evint-rennes...

Un belle soirée en perspective à Rennes avec @g0ul4g.bsky.social et @patriceauffret.bsky.social www.helloasso.com/associations...

🔍 We recently conducted an in-depth analysis of #AridViper, an intrusion set believed to have ties with #Hamas. Also known as APT C-23, #MoleRATs, #GazaCyberGang, or #DesertFalcon, AridViper has been reportedly active since 2012. blog.sekoia.io/aridviper-an... #CTI #APT