ShinyHunters has outlasted forum takedowns, arrests, and its founders' convictions. Learn the group's tactics, from stolen S3 buckets to zero-day exploits.

Co-authored by Sekoia and Kudelski Security, this report maps North Korea’s cyber ecosystem, from state institutions and APT clusters to IT worker operations.

This article details a campaign targeting vulnerability researchers with "ChocoPoC" malware embedded inside trojanised Python dependencies. Exploiting the pressure to quickly test new vulnerabilities,...

This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.

Context Sekoia’s Threat Detection & Research (TDR) team has been tracking APT28 for several years. The intrusion set, also known as Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm or Sednit and public...

Part 1 of our FSB Matryoshka series. Discover the context behind Gamaredon's cyberespionage campaigns, introducing GammaPhish and GammaWorm operations.

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud

Track the 2025-2026 shift of China-based Silver Fox from financial crime to APT espionage. Discover how they exploit tax-themed phishing and RMM tools to target South Asian entities.

Unmasking OysterLoader's evasion: from API hammering to custom LZMA. Explore the 4-stage infection chain and its ties to Rhysida ransomware.

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

Explore the 2025 landscape of Adversary-in-the-Middle phishing threats with data, trends, and top detection insights.

Sekoia.io on collaborating with Europol, dynamic behavior modelling for Gen AI threats, and pooling CTI from various sources

Discover ViciousTrap, a newly identified threat who turning edge devices into honeypots en masse targeting

ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.

Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.

ClearFake spreads malware via compromised websites, using fake CAPTCHAs, JavaScript injections, and drive-by downloads.

Discover PolarEdge, a newly identified botnet targeting edge devices via CVE-2023-20118, using a stealthy TLS backdoor.

Delve into Finance-related cyber threats in 2024. Our report highlights major actors and tactics impacting the financial sector.

Discover the challenges of ClickFix12 and the newly identified I2PRAT. Uncover the advanced techniques employed by this multi-stage RAT.

Discover the power of detection engineering and how it can help scale your cybersecurity projects efficiently.

Sekoia.io recrute un(e) Sr Technical Threat Researcher !

Sekoia.io recrute un(e) Sr Technical Threat Researcher !

In this blog post, learn about the supply chain attack targeting Chrome browser extensions and the associated targeted phishing campaign.

In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.

​The U.S. Department of Justice announced today that the FBI has deleted Chinese PlugX malware from over 4,200 computers in networks across the United States.

U.S law enforcement accused the People’s Republic of China of paying hackers that are part of a well-known group called Mustang Panda to deploy the PlugX malware — which allows them to “infect, contro...

The Justice Department and FBI today announced a multi-month law enforcement operation that, alongside international partners, deleted “PlugX” malware from thousands of infected computers worldwide. A...

Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28

Discover how we successfully disinfected thousands of computers infected with the PlugX worm using two remote disinfection methods.

Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements.

Discover how Sekoia.io addresses SOC and Detection Engineering challenges with innovative continuous monitoring and review approaches.

Introduction This report focuses on the exfiltration techniques leveraged by ransomware and extortion groups in lucrative campaigns. It aims to provide a comprehensive analysis of the techniques and…

Introduction This report focuses on the exfiltration techniques leveraged by ransomware and extortion groups in lucrative campaigns. It aims to provide a comprehensive analysis of the techniques and t...

Comprehensive Analysis of Helldown: Tactics, Techniques, and Procedures (TTPs) and Exploitation of Zyxel Vulnerabilities %

Sekoia TDR analysts conduct an assessment of threats regarding the major elections that will occur in 2024.

Sekoia TDR analysts conduct an assessment of threats regarding the major elections that will occur in 2024.

Learn about key concepts and different crypters-related activities as well as the lucrative ecosystem of malicious groups that exploit them.

Learn how DiceLoader (also known as Icebot), a malware used by the FIN7 intrusion set, works.

This report provides an overview of the various cyber operations likely to impact the next Olympic and Paralympic Games (Paris 2024).

Discover activities linking Korinets to CALISTO doxxing in our investigation. Uncover details from emails, domains & servers used to target UK Parliament & Cambridge University.