iiinova — where your digital self keeps evolving

Reposted by Pierre Le Bourhis

Catalin Cimpanu @campuscodi.risky.biz · 27/05/2025

Sekoia has identified Mimo, a threat actor that exploits a recently patched Craft CMS zero-day to deploy its own loader, cryptominers, and residential proxyware on hacked websites The operators appear to be based in the Middle East blog.sekoia.io/the-sharp-ta...

blog.sekoia.io

The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

132

Reposted by Pierre Le Bourhis

crep1x @crep1x.bsky.social · 06/03/2025

#ClearFake variant is now spreading #Rhadamanthys Stealer via #Emmenhtal Loader. cc @plebourhis.bsky.social @sekoia.io 1. ClearFake framework is injected on compromised WordPress and relies on EtherHiding 2. The #ClickFix lure uses a fake Cloudflare Turnstile with unusual web traffic ⬇️

232

Reposted by Pierre Le Bourhis

Phil Stokes ⫍🐠⫎ @philofishal.bsky.social · 20/01/2025

This #macOS backdoor uses /usr/bin/SetFile to hide itself in the Finder. SetFile was deprecated in Xcode 6 (that's 2014 to humans)...not sure why it makes sense to declare smth 'deprecated' then leave it in the OS for 10+ years. 🤷‍♂️ #apple #malware SHA1: 609088c54b99432aab212f35cfe74030b52f0320

Image of disassembly showing a new macOS backdoor using the deprecated CLI tool 'SetFile'.

2238

Pierre Le Bourhis @plebourhis.bsky.social · 28/11/2024

Proud to share an insightful article on ransomware-driven data exfiltration techniques, written by my colleagues at Sekoia.io! 👏🔐

sekoia.io

homepage

Sekoia.io provides cyber teams with a SOC platform that can respond to security incidents, regardless of the attack surface.

040