Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Sekoia TDR
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This article was originally distributed as a private report to our customers on 2 June 2026. As part of our threat intelligence and cybercrime mitigation efforts, the Sekoia TDR team actively monitors malware distribution campaigns leveraging the “ClickFix” social engineering technique. Consequently, we conducted an in-depth analysis of the ErrTraffic framework, a central component of this ecosystem.
APT28, an evolution of tradecraft
Table of contents Context Conclusion Sekoia’s Threat Detection & Research (TDR) team has been tracking APT28 for several years. The intrusion set, also known as Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm or Sednit and publicly attributed to the GRU’s Unit 26165, is one of the most prolific and persistent state-sponsored actors we monitor.
FSB’s matryoshka #3/3 – Gamaredon’s gifts that keeps unpacking – GammaSteel
Username or Email Address Password Remember Me This investigation is published in three parts. Follow the links below to navigate through our findings: FSB’s matryoshka #1/3 – GammaPhish and GammaWorm FSB’s matryoshka #2/3 – GammaLoad FSB’s matryoshka #3/3 – GammaSteel Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine.
FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps unpacking – GammaLoad
This investigation is published in three parts. Follow the links below to navigate through our findings: FSB’s matryoshka #1/3 – GammaPhish and GammaWorm FSB’s matryoshka #2/3 – GammaLoad (coming soon) FSB’s matryoshka #3/3 – GammaSteel Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine.
FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm
This investigation is published in three parts. Follow the links below to navigate through our findings: FSB’s matryoshka #1/3 – GammaPhish and GammaWorm (coming soon) FSB’s matryoshka #2/3 – GammaLoad (coming soon) FSB’s matryoshka #3/3 – GammaSteel Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine.
From APT28 to RePythonNET: automating .NET malware analysis
This blogpost covers the tooling and methodology we use at TDR to reverse engineer .NET malware. In our daily work, we encounter a wide range of malware, sophisticated or not, and a significant portion of it is written in .NET. Yet, the .NET reverse engineering ecosystem remains surprisingly thin, with few dedicated tools and few in-depth write-ups, especially compared to the volume of .NET malware actually seen in the wild.
EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud – Part 2
A TLP:AMBER version of this post was originally distributed as a private FLINT report to our customers on 30 March 2026. As detailed in our previous blog post New widespread EvilTokens kit: device code phishing as-a-service – Part 1, EvilTokens is a new turnkey Microsoft device code phishing kit sold as Phishing-as-a-Service (PhaaS).
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
This post was originally distributed as a private FLINT report to our customers on 25 March 2026. In March 2026, through our monitoring of phishing-focused cybercrime communities, Sekoia’s Threat Detection & Research (TDR) team uncovered EvilTokens, a new turnkey Microsoft device code phishing kit sold as Phishing-as-a-Service (PhaaS).
Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader
Username or Email Address Password Remember Me In the third part of our series “Advent of Configuration Extraction”, we dissect SNOWLIGHT, a lightweight ELF downloader designed to retrieve and execute a remote payload on Linux systems. To extract the SNOWLIGHT configuration, and specifically the Command and Control (C2) port, we need to disassemble the main function and identify calls to dynamically imported functions based on their addresses.
Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration
In the second part of our “Advent of Configuration Extraction” series, we unwrap QuasarRAT, a popular .NET remote access trojan (RAT), and show how to extract its encrypted configuration out of the binary. The article begins by detailing the environment: Jupyter Notebook, pythonnet, dnSpy and friends—so every step is reproducible. Next, it presents the construction of a Python-based extractor for a clean QuasarRAT sample, then extends the approach to handle an obfuscated build.
French NGO Reporters Without Borders targeted by Calisto in recent campaign
Some portions of this article were first distributed as a private report to our customers in June 2025. In May and June 2025, TDR team analysts were contacted by two organisations — including the French NGO Reporters Without Borders (RSF) — over suspicions of a new spear phishing attempts by the intrusion set Calisto (also known as ColdRiver or Star Blizzard).
Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers
This article was originally distributed as a private report to our customers. A Sekoia partner recently reported a phishing campaign targeting hospitality industry customers worldwide. The campaign was observed to involve either emails sent from a hotel’s compromised Booking.com account or messages distributed via WhatsApp.
TransparentTribe targets Indian military organisations with DeskRAT
This post was originally distributed as a private FLINT report to our customers on 14 October 2025. It contains a complete list of IOCs, YARA rules, and a chapter dedicated to detection and hunting opportunities specific to this infection chain. In July 2025, CYFIRMA reported a phishing campaign attributed to TransparentTribe(also known as APT36 or Operation C-Major) targeting Linux-based operating systems of Indian governement entities with activity traced back to June 2025.
Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping
When users sign in to Microsoft’s cloud services, authentication events are recorded in two places: Microsoft Entra sign-in logs and Microsoft 365 audit logs. While these logs capture the same authentication events, they use different formats and fields to represent the information. Anyone who has spent time analysing Microsoft 365 sign-in events has encountered the UserAuthenticationMethod field.
PolarEdge Backdoor on QNAP (CVE-2023-20118)
Username or Email Address Password Remember Me This post was originally distributed as a private FLINT report to our customers on 15 July 2025. In early 2025, we published a blogpost reporting on a botnet we dubbed PolarEdge, first detected in January 2025, when our honeypots logged suspicious network activity. Analysis revealed an attempt to exploit CVE-2023-20118, resulting in remote code execution (RCE) that deployed a web shell on the target router.
APT28 Operation Phantom Net Voxel
This post was originally distributed as a private FLINT report to our customers on 12 August 2025. Sekoia.io’s Threat Detection and Response (TDR) team closely monitors APT28 as one of its highest-priority threat actors. In early 2025 a trusted partner provided two previously unseen malware samples attributed to APT28. These samples did not correspond to any publicly documented infection chain at the time, so we began to take a closer look.
Predators for Hire: A Global Overview of Commercial Surveillance Vendors
This blogpost is an abridged version of the report. The full version is available as a PDF. Introduction Key takeways Definitions 2010-2015. Emergence of early commercial spyware 2016-2021. Industrialisation of commercial surveillance vendors 2021-2024.
The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS
This article on was originally distributed as a private report to our customers. Once upon a time, in the land of the CMS honeypot, a curious threat named Mimo crept silently through the digital woods. Unlike your typical fairytale villain, Mimo didn’t leave glass slippers—just suspicious payloads. Between February 28 and May 2, multiple exploitations of the CVE-2025-32432 were observed during our daily threat monitoring.
ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.
This article on was originally distributed as a private report to our customers. Key Takeaways Sekoia.io investigated a threat actor nicknamed ViciousTrap, who compromised over 5,500 edge devices, turning them into honeypots. More than 50 brands — including SOHO routers, SSL VPNs, DVRs, and BMC controllers — are being monitored by this actor, possibly to collect exploited vulnerabilities affecting these systems.
Detecting Multi-Stage Infection Chains Madness
During our daily tracking and analysis routine at Sekoia TDR team (Threat Detection & Research), we have been monitoring an attacker infrastructure internally called “Cloudflare tunnel infrastructure to deliver multiple RATs”. This infrastructure is used by several actors to host malicious files and deliver remote access trojans (RAT).
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
Username or Email Address Password Remember Me This post was originally distributed as a private FLINT report to our customers on 21 March 2025. The report detailed findings about the Lazarus ClickFake Interview campaign. In March 2025, Bybit, an UAE-based crypto exchange platform, was targeted by Lazarus, a state-sponsored intrusion set attributed to the Democratic People’s Republic of Korea (DPRK), leading to the theft of $1.5 billion, which represents a record-breaking crypto heist in history.
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique. When it first emerged in July 2023, the injected code was designed to display a fake web browser download page, tricking users into downloading counterfeit browser updates.
Detection engineering at scale: one step closer (part three)
Following our first article explaining our detection approach and associated challenges, the second one detailing the regular and automated actions implemented through our CI/CD pipelines, we will now conclude this series by presenting the continuous improvement loop that allows us to achieve our long-term objectives, incorporating the principles of detection engineering.
PolarEdge: Unveiling an uncovered ORB network
This report on was originally published for our customers on 19 february 2025. The monitoring and analysis of vulnerability exploitations are among the primary responsibilities of Sekoia’s Threat Detection & Research (TDR) team. Using our honeypots, we monitor traffic targeting various edge devices and internet-facing applications. On 22 January 2025, suspicious network traces were observed via our honeypots. Analysis indicated an attempt to exploit the CVE-2023-20118 vulnerability.
Cyber threats impacting the financial sector in 2024 - focus on the main actors
This report will dive into cybercrime actors and state-sponsored intrusion sets tracked and documented by Sekoia. As this report is a synthesis of latest 2024 campaigns targeting financial entities, further information on the intrusion sets at the origin of the attacks and mentioned below can be found on the Sekoia.io platform, including a history of their past operations and descriptions of their tactics, techniques and procedures.
Targeted supply chain attack against Chrome browser extensions
On 26 December 2024, the data security company Cyberhaven informed its users about a compromise of their Chrome browser extension. The attacker exploited the extension developer’s permissions, which had been previously gained through a targeted phishing attack, to upload a malicious version of Cyberhaven to the Chrome Web Store.
Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations
This report was originally published for our customers on 12 December 2024. On Wednesday, 27 November 2024, Russian President Putin was on a 2-day state visit in Kazakhstan to discuss with local representatives the implementation of energy projects and to counter Chinese and Western influence.
PlugX worm disinfection campaign feedbacks
In September 2023, we successfully took ownership of one of the IP addresses used by the PlugX worm—a variant of PlugX associated with Mustang Panda, which possesses worming capabilities by infecting flash drives. Following this success, we studied the inner workings of this malware to determine whether there was any possibility, by using the access we had gained, to disinfect the thousands of computers making requests to our sinkhole every second.
Helldown Ransomware: an overview of this emerging threat
This report on Helldown was originally published for our customers on 14 November 2024. Through our social media monitoring, Sekoia’s Threat Detection & Research (TDR) team identified a tweet posted on 31 October 2024 mentioning a Linux variant of the Helldown ransomware targeting Linux systems. The Helldown ransomware group is a relatively new and still largely undocumented Intrusion Set (IS), previously known to deploy ransomware exclusively on Windows systems.
A three beats waltz: The ecosystem behind Chinese state-sponsored cyber threats
Username or Email Address Password Remember Me The People’s Liberation Army (PLA), the Ministry of State Security (MSS) and the Ministry of Public Security (MPS) are the three main state actors conducting state-sponsored offensive cyber operations for the interests of the Chinese Communist Party (CCP). From 2021 onward, Sekoia observed that operations attributed to China were mostly linked to the Ministry of State Security (MSS) rather than the People’s Liberation Army (PLA).
ClickFix tactic: Revenge of detection
This report on ClickFix was originally published for our customers on 22 October 2024. In May 2024, a new social engineering tactic called ClickFix emerged, featuring a ClearFake cluster that the Sekoia Threat Detection & Research (TDR) team closely monitored and analysed in a private report. This tactic involves displaying fake error messages in web browsers to deceive users into copying and executing a given malicious PowerShell code, finally infecting their systems.
Mamba 2FA: A new contender in the AiTM phishing ecosystem
In late May 2024, Sekoia’s Threat Detection & Research (TDR) team received an insight from a partner about an ongoing phishing campaign leveraging HTML attachments that mimicked Microsoft 365 login pages. The phishing pages were able to relay some methods of multi-factor authentication (MFA), and made use of the Socket.IO JavaScript library to communicate via websockets with a backend server.
SilentSelfie: Uncovering a major watering hole campaign against Kurdish websites
Key Takeaways In early 2024, Sekoia Threat Detection & Research team (TDR) was contacted about a suspicious script on a Kurdish website, which prompted users to activate their webcams and share their locations. Our investigation uncovered 25 kurdish websites compromised by four different variants of a malicious script, ranging from the simplest, which obtains the device’s location, to the most complex, which prompts selected users to install a malicious Android application.
Securing Gold : Hunting typosquatted domains during the Olympics
Anticipating Paris 2024 Olympics cyber threats, Sekoia.io has conducted over July and August 2024 a proactive hunting of Olympics-typosquatted domains registered by malicious actors – cybercrime related and possibly APT campaigns – in order to detect any kind of operations though the detection of connexion to typosquatted domains (phishing, C2). This work is complementary to our general assessment of cyber threats on Paris Olympics, published in January 2024.
A glimpse into the Quad7 operators' next moves and associated botnets
Username or Email Address Password Remember Me Key Takeaways The Sekoia TDR team has recently identified new staging servers, leading to the discovery of additional targets, implants, and botnet clusters tied to the Quad7 operators. The Quad7 botnet operators seem to be compromising several brands of SOHO routers and VPN appliances, including TP-LINK, Zyxel, Asus, Axentra, D-Link, and Netgear, using multiple vulnerabilities—some of which are previously unknown.
Solving the 7777 Botnet enigma: A cybersecurity quest
Key Takeaways Sekoia.io investigated the mysterious 7777 botnet (aka. Quad7 botnet), published by the independent researcher Gi7w0rm inside the “The curious case of the 7777 botnet” blogpost. This investigation allowed us to intercept network communications and malware deployed on a TP-Link router compromised by the Quad7 botnet in France.
MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
This report was originally published for our customers on 20 June 2024. Today, the Check Point Research (CPR) team published a report on the same implant, providing details of recent MuddyWater campaigns. On June 9 2024, ClearSky tweeted about a new campaign associated with the MuddyWater intrusion set, employed by the Iranian intelligence service MOIS (Ministry of Intelligence) against Western and Middle Eastern entities.
Exposing FakeBat loader: distribution methods and adversary infrastructure
Username or Email Address Password Remember Me Over the past few years, cybercriminals have increasingly used the drive-by download technique to distribute malware via user web browsing. This technique mostly involves SEO-poisoning, malvertising, and code injection into compromised websites to trick users into downloading fake software installers or browser updates.
PikaBot: a Guide to its Deep Secrets and Operations
Username or Email Address Password Remember Me Between 27 and 29 May 2024, international law enforcement agencies and partners conducted the Operation Endgame to disrupt criminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee. The Sekoia TDR team supported the French law enforcement agencies by providing valuable cyber threat intelligence, in particular on PikaBot.
Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign
This report was originally published for our customers on 14 May 2024. The DoppelGänger campaign is an ongoing influence campaign, starting from May 2022 and attributed to the Structura National Technologies (Structura) and the Social Design Agency (SDA), which are two Russian entities. The primary goal of DoppelGänger is to diminish support for Ukraine in the wake of Russian aggression and to foster divisions within nations backing Ukraine.
Elevating Cybersecurity: The Sekoia.io Methodology for Advanced Detection Engineering
In the constantly evolving cybersecurity landscape, Sekoia.io is at the forefront of crafting sophisticated detection engineering strategies. This blog post dives into our approach to security and more specifically in the creation of detection rules. Aimed at both our existing and future users, this article unveils the complexities of detection engineering. We will showcase how Sekoia.io does not only meet the current security demands but also anticipate future threats.
Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns
This report was originally published for our customers on 2 May 2024. As part of our critical vulnerabilities monitoring routine, Sekoia’s Threat & Detection Research (TDR) team deploys and supervises honeypots in different locations around the world to identify potential exploitations. Recently, our team observed an incident involving our MS-SQL (Microsoft SQL) honeypot.
Guarding Democracy: Assessing Cyber Threats to 2024 Worldwide Elections
In 2024 multiple worldwide elections will be held with 54% of the world population called to vote. Electoral results can potentially influence the geopolitical landscape, making elections a prime target for cyber offensive operations aimed to influence the outcome.
Unplugging PlugX: Sinkholing the PlugX USB worm botnet
Key Takeaways In September 2023, we successfully sinkholed a command and control server linked to the PlugX worms. For just $7, we acquired the unique IP address tied to a variant of this worm, which had been previously documented by Sophos. Almost four years after its initial launch, between ~90,000 to ~100,000 unique public IP addresses are still infected, sending distinctive PlugX requests daily to our sinkhole. We observed in 6 months of sinkholing more than 2,5M unique IPs connecting to it.
Securing Gold: Assessing Cyber Threats on Paris 2024
The next Olympic Games hosted in Paris will take place from 26 July to 11 August 2024, while the Paralympic Games will be carried out from 28 August to 8 September 2024. The Olympic and Paralympic Games, which bring together all the nations around sport competitions every two years, is a showcase for States in front of the world.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Sekoia
Contact Sekoia, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack