iiinova — where your digital self keeps evolving

As usual, IoCs are available in our Community GitHub repository: buff.ly/5CISNsZ

000

Exvicy is already widespread in the wild. We identified dozens of active administration panels and more than 100 C2 servers. Its monthly price also jumped from $1,200 to $2,000 in mid-August 2026.

100

Exvicy reuses ErrTraffic's obfuscated JavaScript, ClickFix HTML, FNV-1a hashing and C2 actions. The main advertised change is the use of Win+R instead of Win+X for the ClickFix command.

100

Exvicy's affiliates compromise WordPress sites to display a fake Cloudflare Turnstile CAPTCHA in a fullscreen iframe. Victims are told to press Win+R, Ctrl+V, and Enter, executing Base64-encoded PowerShell that drops malware.

100

TDR analysts uncovered #Exvicy, an emerging #ClickFix MaaS sold on Exploit.IN since May 2026. We assess with high confidence that Exvicy is a copycat of #ErrTraffic, reusing its injected JavaScript, ClickFix HTML, and C2 communication logic. buff.ly/nKNSjMy

101

IT workers operating under false identities are part of this model too, functioning as a revenue channel and an insider threat. Read the full report, Beyond Lazarus: Organization of DPRK Cyber Capabilities buff.ly/vmqOr9d

001

One finding runs throughout the research: espionage and revenue generation are closely linked. Access obtained for financial gain can be reused for intelligence collection. Shared infrastructure can support both missions.

100

The analysis also covers the wider support structure behind North Korea’s cyber operations. Academic institutions train operators and provide cover. Front companies act as proxies across several regions. Criminal networks support fund movements.

100

By cross-referencing multiple taxonomies, the report breaks down the former Lazarus umbrella into six distinct sub-clusters. This provides a clearer view of who is operating and how.

100

It also addresses a persistent challenge in threat intelligence: cluster deconfliction. Aliases multiply. Boundaries shift between vendors. Different names can hide the same activity.

100

The research maps the institutions responsible for North Korea’s cyber offensive operations, including recent reorganizations and the intrusion sets operating under them.

110

North Korea’s cyber program was built to serve two purposes: intelligence collection and revenue generation. A new joint report from Sekoia #TDR and @KudelskiSec examines how that system is organized. buff.ly/vmqOr9d

223

- An Ongoing threat: The campaign's structure and persistence indicate a broader, long-term operation aiming directly at cyber defenders rather than an isolated, one-shot attack.

000

- Targeted Action & Persistence: While the malicious PyPI packages were immediately reported and removed, our analysis shows that parts of the core Command & Control (C2) infrastructure remain active.

100

- Infrastructure Uncovered: We mapped out a cluster of malicious GitHub repositories and backdoored Python (PyPI) specifically crafted to target the security community.

100

Recognising critical anomalies in the code and its malicious imports, the YesWeHack team joined forces with Sekoia’s threat intelligence experts to run a deep-dive investigation. The outcome of this collective defence effort:

120

It started when a suspicious GitHub repository, disguised as a harmless Proof of Concept (PoC) for a Nuclei template, was flagged.

100

Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits www.sekoia.com/blog/dont-ea... Discover our joint threat intelligence report with @YesWeHack.

100

As the threat landscape expands beyond traditional network perimeters, understanding the security risks of the AdTech ecosystem is becoming critical for enterprise defence.

000

- Ultimately, ADINT can be leveraged as a zero-click intrusion vector through code injection within the ad content, exploiting software vulnerabilities to deploy spyware.

100

- ADINT can be used for group-level profiling, identification of geolocation patterns or highly targeted near real-time geolocation tracking.

100

Key insights from the report: - ADINT can be defined as the weaponisation of legitimate AdTech mechanisms, notably the real-time bidding process and third-party SDKs, to collect, correlate, and operationalise large-scale data for intelligence purposes.

100

Online advertising is no longer just a tool for marketers, it has become a sophisticated vector for surveillance and cyber espionage.

100

Our latest Threat Intelligence report dives deep into ADINT (Advertisement-based Intelligence) to expose how private companies weaponise AdTech mechanisms to harvest intelligence data, fueling the surveillance solutions they sell. www.sekoia.com/blog/sold-to...

123

This blog post details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators’ arsenal. Finally, it provides several analytical hypotheses regarding the MaaS operations and the organisation of these affiliate groups.

010

Our forensic analysis of compromised WordPress servers helped us to cluster ErrTraffic and map affiliates' TTPs and backdoors. We notably identified two distinct clusters: "Analytics" operated by a single threat actor, and "Beer" likely operated by LenAI for affiliates.

111

The ErrTraffic MaaS offering includes: - The EtherHiding technique to retrieve the C2 from Polygon smart contracts - A Traffic Distribution System (TDS) to filter unwanted traffic - Various ClickFix lures LenAI, the operator behind ErrTraffic, sells subscriptions for $380/month

110

#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework. ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures. blog.sekoia.io/unveiling-er...

243

This report is part of a broader coordinated effort, conducted since 2025 in collaboration with foreign and domestic law enforcement and government agencies, including the FBI, to limit APT28's activities and constrain GRU cyber operations.

000

- Return of custom implants: Deploying stealthy, modular toolsets (like Phantom Net Voxel) controlled via cloud infrastructures. - Delegating logic to AI: Experimenting with malware (like LameHug) that queries an LLM on the fly to generate attack commands.

100

Here are the three major shifts defining APT28's modern operations: - Infrastructure moved to the edge: Compromising SOHO devices and abusing cloud services to mask traffic.

100

Sekoia @sekoia.com · 08/06/2026

🇷🇺 Sekoia #TDR team has just released a comprehensive analysis of how #APT28's arsenal has evolved, from its early to its current operations. blog.sekoia.io/apt28-an-evo...

132

The second and third parts of our investigation into the #Gamaredon, the cyberespionage group operated by the Russian #FSB, are live! 🪆Part 2 — The loaders buff.ly/bBYZSKa 🪆Part 3 — The stealer & full infrastructure buff.ly/74WHuPd #CTI #TDR #Sekoia

011

Sekoia @sekoia.com · 01/06/2026

📄 Part 1 — Initial access & the worm → buff.ly/6hR2IMj 🔜 Part 2 — The loaders (Wednesday) 🔜 Part 3 — The stealer & full infrastructure (Thursday)

020

Sekoia @sekoia.com · 01/06/2026

The result: the most complete picture of Gamaredon's current operations to date. A massive campaign. Still running. Right now. We're releasing a 3-part investigation this week — starting today with Part 1: Initial access & the worm.

111

Sekoia @sekoia.com · 01/06/2026

Russia's #FSB-linked #Gamaredon has been hammering Ukraine's government, military & critical infrastructure for over a decade. We went behind the scenes. Tracked their infrastructure. Recovered artefacts from compromised machines. Here's what we found 🧵 buff.ly/6hR2IMj

241

Part 1 of our technical deep dive into EvilTokens: blog.sekoia.io/new-widespre...

000

We assess that EvilTokens is the first PhaaS to offer #AI-augmented post-compromise tooling, representing a significant shift in the BEC ecosystem by making advanced, victim-tailored fraud capabilities accessible to a broad audience of financially-motivated threat actors.

100

TDR analysts gained access to the #EvilTokens backend JavaScript and implemented device code phishing functions and token weaponisation. This script also includes #LLM #prompts to analyse large volumes of emails, construct BEC attack scenarios, and draft targeted #BEC emails.

101

The EvilTokens PhaaS runs via fully featured Telegram bots and continuously enhances its phishing kit with new capabilities.

100

Part 2 of our #EvilTokens analysis is live. TDR analysts uncovered the AI-augmented features that automate and scale #BEC workflows, marking a breakthrough in the #PhaaS ecosystem. blog.sekoia.io/eviltokens-a...

120

As usual, IoCs are available in our Community GitHub repository: github.com/SEKOIA-IO/Co...

011

Our report offers a technical analysis of the EvilTokens kit, its delivery campaigns, and the adversary's infrastructure.

100

Active since late February 2026 and rapidly adopted by cybercriminals, TDR analysts believe EvilTokens will become a serious competitor in the phishing and BEC landscape.

100

EvilTokens device code phishing pages allows attackers to capture Microsoft refresh and access token, weaponise them, harvest victims' mailbox, and automatically craft BEC emails using AI.

100