Raccoon Stealer v2 - Part 1: The return of the dead
On June 10, 2022, Sekoia analysts stumbled upon active servers hosting a web page named “Raccoon Stealer 2.0”. Discover their research.
CALISTO continues its credential harvesting campaign
March 30, 2022, Google TAG published several IOCs related to CALISTO, a Russia-nexus threat actor. Discover our analysis.
BumbleBee: A new trendy loader for Initial Access Brokers
BumbleBee is a new malicious loader that is being used by several IABs to gain an initial foothold within victims' networks.
MSDT abused to achieve RCE on Microsoft Office
Discover through our article, how attackers hijack the Microsoft Support Diagnostic Tool to remotely execute arbitrary code under Windows.
TURLA’s new phishing-based reconnaissance campaign in Eastern Europe
Sekoia's Threat & Detection Researchers expose a reconnaissance and espionage campaign from TURLA against eastern-EU institutions.
EternityTeam: a new prominent threat group on underground forums
During our monitoring of Dark Web cybercrime forums, we came across EternityTeam: here is what we found on this new active & organized threat
Mars, a red-hot information stealer
Mars Stealer is an information stealer sold on underground forums by MarsTeam since June 22, 2021, with the malware-as-a-service model.
Lapsus$: When kiddies play in the big league
The extortion group Lapsus$ that already succeeded in breaching several high profile companies is running riot and sowing confusion. In this blog, our Threat & Detection Research team answers your questions by drawing the profile of the group.
A war on multiple fronts – the turbulent cybercrime landscape
In this blog post, we will focus on developments in the world of cybercrime (which supposedly do not involve nation-state threat actors) in the current war context.
The story of a ransomware builder: from Thanos to Spook and beyond (Part 2)
Ransomware spook : In this second part of the series, you will discover how to handle such evil sightings and neutralize them before impact.
Invasion of Ukraine – what implications in cyberspace?
Our analysts and researchers use this very specific context to provide an overview of the current state of cybercrime.
NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
NOBELIUM is another name for the APT29 intrusion set, operated by a threat actor allegedly linked to the SVR.