Jérémy Scion is a Principal Threat Researcher on Sekoia’s Threat & Detection Research Team. He’s worked in cyber defense for nearly 15 years, including with the French Armed Forces, and now uses that experience to make sense of the network activity that can leave teams guessing.
.webp)
A honeypot's tale: Deconstructing an attack on GenAI infrastructure
Sekoia's TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.
Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant
Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.
Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader
In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.
Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration
Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.
Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing
Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows
Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers
Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.
Silent Smishing : The Hidden Abuse of Cellular Router APIs
How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).
The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS
Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.
ViciousTrap (Infiltrate, Control, Lure): Turning Edge Devices into Honeypots at Scale
This blog post analyzes the Vicious Trap, a honeypot network deployed on compromised edge devices.
PolarEdge: Unveiling an uncovered ORB network
This blog post analyzes the PolarEdge backdoor and its associated botnet, offering insights into the adversary’s infrastructure.
Helldown Ransomware: an overview of this emerging threat
This blogpost provide a comprehensive Analysis of Helldown: Tactics, Techniques, and Procedures (TTPs).