Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping
This undocumented field of sign-in events is a number where each bit represents a different authentication method.
Defrosting PolarEdge's Backdoor: A QNAP TLS Implant via CVE-2023-20118
Deep technical analysis of a TLS C2 implant on QNAP exploiting CVE-2023-20118—protocol, anti-analysis, fingerprinting, IoCs & YARA
APT28 Operation Phantom Net Voxel: BeardShell & Covenant
APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.
Predators for Hire: A Global Overview of Commercial Surveillance Vendors
This report provides an overview of the commercial surveillance vendors ecosystem between 2010 and 2025, analysing their spyware offerings, business models, client base, target profiles, and infection chains.
Global analysis of Adversary-in-the-Middle phishing threats
This report explores current trends in the AitM phishing landscape and the prevalence of leading kits.
The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS
Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.
ViciousTrap (Infiltrate, Control, Lure): Turning Edge Devices into Honeypots at Scale
This blog post analyzes the Vicious Trap, a honeypot network deployed on compromised edge devices.
Detecting Multi-Stage Infection Chains Madness
Learn about detecting multi-stage infection chains using Cloudflare tunnel infrastructures delivering RATs.
Interlock ransomware: Evolving under the radar with ClickFix
ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake's new variant abuses the Binance Smart Chain and fake CAPTCHAs to deliver malware. A technical analysis of its Web3 evasion and ClickFix infection chain.
Detection engineering at scale: one step closer (part three)
Following our first article explaining our detection approach and associated challenges, the second one detailing the regular and automated actions implemented through our CI/CD pipelines, we will now conclude this series by presenting the continuous improvement loop that allows us to achieve our long-term objectives, incorporating the principles of detection engineering.