Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jeremy Scion
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This article was originally distributed as a private report to our customers on 2 June 2026. As part of our threat intelligence and cybercrime mitigation efforts, the Sekoia TDR team actively monitors malware distribution campaigns leveraging the “ClickFix” social engineering technique. Consequently, we conducted an in-depth analysis of the ErrTraffic framework, a central component of this ecosystem.
Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader
Username or Email Address Password Remember Me In the third part of our series “Advent of Configuration Extraction”, we dissect SNOWLIGHT, a lightweight ELF downloader designed to retrieve and execute a remote payload on Linux systems. To extract the SNOWLIGHT configuration, and specifically the Command and Control (C2) port, we need to disassemble the main function and identify calls to dynamically imported functions based on their addresses.
Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration
In the second part of our “Advent of Configuration Extraction” series, we unwrap QuasarRAT, a popular .NET remote access trojan (RAT), and show how to extract its encrypted configuration out of the binary. The article begins by detailing the environment: Jupyter Notebook, pythonnet, dnSpy and friends—so every step is reproducible. Next, it presents the construction of a Python-based extractor for a clean QuasarRAT sample, then extends the approach to handle an obfuscated build.
Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing
This article is the opening chapter of a four-part Advent of Configuration Extraction series. The series outlines the methodology we employ at Sekoia’s Threat Detection & Research (TDR) team to automate the extraction of malware configuration data, from initial analysis to the production of usable intelligence.
Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers
This article was originally distributed as a private report to our customers. A Sekoia partner recently reported a phishing campaign targeting hospitality industry customers worldwide. The campaign was observed to involve either emails sent from a hotel’s compromised Booking.com account or messages distributed via WhatsApp.
Silent Smishing : The Hidden Abuse of Cellular Router APIs
This article on was originally distributed as a private report to our customers. The monitoring and analysis of vulnerability exploitations are among the primary responsibilities of Sekoia.io’s Threat Detection & Research (TDR) team. Using our honeypots, we monitor traffic targeting various edge devices and internet-facing applications. On 22 July 2025, suspicious network traces were observed via our honeypots.
The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS
This article on was originally distributed as a private report to our customers. Once upon a time, in the land of the CMS honeypot, a curious threat named Mimo crept silently through the digital woods. Unlike your typical fairytale villain, Mimo didn’t leave glass slippers—just suspicious payloads. Between February 28 and May 2, multiple exploitations of the CVE-2025-32432 were observed during our daily threat monitoring.
ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.
This article on was originally distributed as a private report to our customers. Key Takeaways Sekoia.io investigated a threat actor nicknamed ViciousTrap, who compromised over 5,500 edge devices, turning them into honeypots. More than 50 brands — including SOHO routers, SSL VPNs, DVRs, and BMC controllers — are being monitored by this actor, possibly to collect exploited vulnerabilities affecting these systems.
PolarEdge: Unveiling an uncovered ORB network
This report on was originally published for our customers on 19 february 2025. The monitoring and analysis of vulnerability exploitations are among the primary responsibilities of Sekoia’s Threat Detection & Research (TDR) team. Using our honeypots, we monitor traffic targeting various edge devices and internet-facing applications. On 22 January 2025, suspicious network traces were observed via our honeypots. Analysis indicated an attempt to exploit the CVE-2023-20118 vulnerability.
Helldown Ransomware: an overview of this emerging threat
This report on Helldown was originally published for our customers on 14 November 2024. Through our social media monitoring, Sekoia’s Threat Detection & Research (TDR) team identified a tweet posted on 31 October 2024 mentioning a Linux variant of the Helldown ransomware targeting Linux systems. The Helldown ransomware group is a relatively new and still largely undocumented Intrusion Set (IS), previously known to deploy ransomware exclusively on Windows systems.
ClickFix tactic: Revenge of detection
This report on ClickFix was originally published for our customers on 22 October 2024. In May 2024, a new social engineering tactic called ClickFix emerged, featuring a ClearFake cluster that the Sekoia Threat Detection & Research (TDR) team closely monitored and analysed in a private report. This tactic involves displaying fake error messages in web browsers to deceive users into copying and executing a given malicious PowerShell code, finally infecting their systems.
Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal
This report was originally published for our customers on 24 September 2024. On 17 September 2024, Sekoia’s Threat Detection & Research (TDR) team identified a notable infection chain targeting both Windows and Linux systems through our Oracle WebLogic honeypot. The attacker exploited CVE-2017-10271 and CVE-2020-14883 Weblogic vulnerabilities to deploy Python and Bash scripts, executing the K4Spreader malware, which then delivered the Tsunami backdoor and a cryptominer.
Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns
This report was originally published for our customers on 2 May 2024. As part of our critical vulnerabilities monitoring routine, Sekoia’s Threat & Detection Research (TDR) team deploys and supervises honeypots in different locations around the world to identify potential exploitations. Recently, our team observed an incident involving our MS-SQL (Microsoft SQL) honeypot.
ActiveMQ CVE-2023-46604 Exploited by Kinsing: Threat Analysis
This report was originally published for our customers on 27 November 2023. As part of our critical vulnerabilities monitoring routine, Sekoia’s Threat & Detection Research (TDR) team deploys and supervises honeypots in different locations around the world to identify potential exploitations. In early November, several reports described the exploitation of ActiveMQ vulnerability CVE-2023-46604 to deploy HelloKitty ransomware.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jeremy
Contact Jeremy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack