Amaury-Jacques GARÇON

Threat Researcher

Articles by
Amaury-Jacques GARÇON

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Snow-covered military signals site with satellite dishes, barbed wire and a Russian flag
Threat Research & Intelligence
TDR Team
APT
June 11, 2026

APT28, an evolution of tradecraft

Sekoia TDR looks back at how APT28's arsenal has evolved over two decades, from its signature X-Agent implants to disposable modules, edge-device infrastructure and the first LLM-driven malware.

By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Cartoon bear in military uniform opening matryoshka dolls that reveal malware creatures
Threat Research & Intelligence
TDR Team
APT
June 4, 2026

FSB’s matryoshka #3/3 - Gamaredon’s gifts that keeps unpacking - GammaSteel

Discover part 3 of our FSB Matryoshka investigation. We deep dive into Gamaredon's Gammasteel info-stealer, its data exfiltration TTPs, and indicators.

By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Cartoon bear in military uniform opening matryoshka dolls that reveal malware creatures
Threat Research & Intelligence
TDR Team
APT
June 3, 2026

FSB’s matryoshka #2/3 - Gamaredon’s gifts that keeps unpacking - GammaLoad

In part 2 of our FSB Matryoshka series, we analyze Gamaredon's Gammaload malware variant, dissecting its technical updates and deployment mechanisms.

By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Cartoon bear in military uniform opening matryoshka dolls that reveal malware creatures
Threat Research & Intelligence
TDR Team
APT
June 1, 2026

FSB’s matryoshka #1/3 - Gamaredon’s gifts that keeps unpacking - GammaPhish and GammaWorm

Part 1 of our FSB Matryoshka series. Discover the context behind Gamaredon's cyberespionage campaigns, introducing GammaPhish and GammaWorm operations.

By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
Cybercrime
January 29, 2026

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

By
Quentin Bourgue
By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
October 23, 2025

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

By
Amaury-Jacques GARÇON
By
Coline C.
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
September 16, 2025

APT28 Operation Phantom Net Voxel: BeardShell & Covenant

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

By
Amaury-Jacques GARÇON
By
Charles Meslay
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
March 31, 2025

From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic

Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.

By
Amaury-Jacques GARÇON
By
Coline C.
By
Félix AIME
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
January 13, 2025

Double-Tap Campaign: A Russia-Nexus APT Linked to APT28 Targets Kazakhstan's Diplomatic Relations

Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28

By
Amaury-Jacques GARÇON
By
Maxime ARQUILLIERE
By
Erwan CHEVALIER
By
Félix AIME
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
October 2, 2024

Bulbature, beneath the waves of GobRAT

Since mid 2023, Sekoia Threat Detection & Research team (TDR) investigated an infrastructure which controls compromised edge devices transformed into Operational Relay Boxes used to launch offensive cyber attack.

By
TDR Team
By
Amaury-Jacques GARÇON
By
Félix AIME
& more
View more
Illustration of Paris landmarks and athletes during a major international sporting event
Threat Research & Intelligence
TDR Team
September 11, 2024

Securing Gold : Hunting typosquatted domains during the Olympics

Discover how Sekoia.io proactively hunts for typosquatted domains related to the Paris 2024 Olympics to detect and prevent cyber threats.

By
Maxime ARQUILLIERE
By
Amaury-Jacques GARÇON
By
Coline C.
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
Cybercrime
May 21, 2024

Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign

Uncover the details of the DoppelGänger campaign, a Russian influence operation aimed at undermining support for Ukraine.

By
TDR Team
By
Coline C.
By
Amaury-Jacques GARÇON
By
Kilian SEZNEC
& more
View more