Marc Nebout leads Sekoia’s Cybercrime Team, where he makes sense of the messy business of cybercrime and turns it into intelligence defenders can use. After working as a cyber threat analyst at ANSSI, he now focuses on tracking the threat actors and infrastructure behind cybercrime.
Silent Smishing : The Hidden Abuse of Cellular Router APIs
How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).
WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution
This blogpost examines the use of WebDAV technology in hosting malicious files related to the Emmenhtal loader, then analyses the various final payloads delivered through this infrastructure.
Adversary infrastructures tracked in 2023
Sekoia.io C2 Trackers identified more than 85,000 IP addresses used as C2 servers in 2023, an increase of more than 30% compared to 2022.
Game over: Gaming community at risk with information stealers
This report delves into the gaming industry targeted by infostealer malware, and details a specific campaign spreading via Discord messages.
Command & Control infrastructures tracked by Sekoia in 2022
Throughout 2022, Sekoia's Threat & Detection Research (TDR) team continued to proactively track and monitor the Command & Control (C2) infrastructures set up and used by cybercriminal or state sponsored intrusion sets to carry out malicious cyber
Ongoing Roaming Mantis smishing campaign targeting France
MoqHao (aka Wroba) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that likely spreads via SMS.