Charles Meslay

Senior Threat Researcher

Charles Meslay is a cybersecurity engineer at Sekoia, specializing in malware reverse engineering, cryptography, and network security. He brings more than 15 years of experience analyzing software and researching cybersecurity threats.

Articles by
Charles Meslay

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Threat Research & Intelligence
TDR Team
APT
September 16, 2025

APT28 Operation Phantom Net Voxel: BeardShell & Covenant

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

By
Amaury-Jacques GARÇON
By
Charles Meslay
By
TDR Team
& more
View more
Illustration of a router emitting a network of light beams surrounded by monitoring screens
Threat Research & Intelligence
TDR Team
September 9, 2024

A glimpse into the Quad7 operators' next moves and associated botnets

Uncover the secrets of the Quad7 botnet and its ever-evolving toolset. Learn about the new backdoors and protocols used by these operators.

By
TDR Team
By
Félix AIME
By
Pierre-Antoine DUCHANGE
By
Charles Meslay
& more
View more
www.sekoia.com/blog/a-glimpse-into-the-quad7-operators-next-moves-and-associated-botnets
Threat Research & Intelligence
TDR Team
July 23, 2024

Solving the 7777 Botnet enigma: A cybersecurity quest

Discover 7777 botnet (aka Quad7) and its activity, targets, and use of TP-Link routers in Microsoft 365 attacks in our latest investigation.

By
TDR Team
By
Félix AIME
By
Pierre-Antoine DUCHANGE
By
Charles Meslay
By
Grégoire CLERMONT
& more
View more
Threat Research & Intelligence
TDR Team
April 25, 2024

Unplugging PlugX: Sinkholing the PlugX USB worm botnet

Learn about our process for collecting telemetry data from PlugX worm-infected workstations, as well as how to disinfect them.

By
TDR Team
By
Félix AIME
By
Charles Meslay
& more
View more
bear sitting in a news room
Threat Research & Intelligence
TDR Team
June 29, 2023

Following NoName057(16) DDoSia Project’s Targets

DDoSia is a Distributed Denial of Service (DDoS) attack toolkit, developed and used by the pro Russia hacktivist nationalist group NoName057(16) against countries critical of the Russian invasion of Ukraine.

By
Amaury-Jacques GARÇON
By
Charles Meslay
By
TDR Team
& more
View more
Cyber operators working at terminals beneath a large, tangled patch panel.
Threat Research & Intelligence
TDR Team
APT
Phishing
March 16, 2023

Peeking at Reaper’s surveillance operations

In this blogpost you will find the results of a survey conducted by our analysts on two Command and Control servers (C2s) of the North Korea-nexus intrusion set Reaper (aka APT37). This investigation led to the uncovering of several phishing webpages

By
Charles Meslay
By
Félix AIME
& more
View more
Dense screenshot of obfuscated JavaScript source code.
Threat Research & Intelligence
TDR Team
APT
August 12, 2022

LuckyMouse uses a backdoored Electron app to target MacOS

LuckyMouse uses a backdoored Electron app to target MacOS. This is the first time that Sekoia observed LuckyMouse targeting MacOS.

By
Félix AIME
By
Charles Meslay
By
TDR Team
& more
View more