TDR Team

Threat Detection & Research Team

Articles by
TDR Team

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Threat Research & Intelligence
TDR Team
Cybercrime
January 29, 2026

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

By
Quentin Bourgue
By
Amaury-Jacques GARÇON
By
TDR Team
& more
View more
Detection Engineering
Threat Research & Intelligence
TDR Team
January 14, 2026

Leveraging Landlock telemetry for Linux detection engineering

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

By
TDR Team
By
Erwan CHEVALIER
By
Guillaume COUCHARD
& more
View more
Cartoon elf pointing at a computer screen displaying code in a workshop.
Threat Research & Intelligence
TDR Team
Cybercrime
December 22, 2025

Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant

Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.

By
Pierre LE BOURHIS
By
Jérémy SCION
By
TDR Team
& more
View more
Festive pixel art with Santa Claus, Christmas elements, and a virus inside a lightbulb.
Threat Research & Intelligence
TDR Team
Cybercrime
December 15, 2025

Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader

In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
Cybercrime
December 8, 2025

Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration

Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
Phishing
December 3, 2025

French NGO Reporters Without Borders targeted by Calisto in recent campaign

Calisto phishing campaign targeting Reporters Without Borders uses ProtonMail impersonation and AiTM techniques to steal credentials in 2025.

By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
Cybercrime
December 1, 2025

Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing

Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
November 6, 2025

Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

By
Jérémy SCION
By
Quentin Bourgue
By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
October 23, 2025

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

By
Amaury-Jacques GARÇON
By
Coline C.
By
TDR Team
& more
View more
Purple blueprint diagram of a mechanical locking mechanism with technical annotations, labels, and reference numbers.
Detection Engineering
Threat Research & Intelligence
TDR Team
October 21, 2025

Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping

This undocumented field of sign-in events is a number where each bit represents a different authentication method.

By
Grégoire CLERMONT
By
TDR Team
& more
View more
Polar bear examining a circuit board in front of an iceberg server.
Threat Research & Intelligence
TDR Team
APT
October 14, 2025

Defrosting PolarEdge's Backdoor: A QNAP TLS Implant via CVE-2023-20118

Deep technical analysis of a TLS C2 implant on QNAP exploiting CVE-2023-20118—protocol, anti-analysis, fingerprinting, IoCs & YARA

By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
APT
September 16, 2025

APT28 Operation Phantom Net Voxel: BeardShell & Covenant

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

By
Amaury-Jacques GARÇON
By
Charles Meslay
By
TDR Team
& more
View more