TDR Team

This blog post analyzes the PolarEdge backdoor and its associated botnet, offering insights into the adversary’s infrastructure.

This report provides an overview of the main actors involved in malicious campaigns impacting the financial sector in 2024. It follows up on a previous Sekoia report focusing on the emerging trends in the financial cyber threat landscape.

In this article, we will build upon the previous discussion of our detection approach and associated challenges by detailing the regular and automated actions implemented through our CI/CD pipelines.

On 26 December 2024, the data security company Cyberhaven informed its users about a compromise of their Chrome browser extension. The attacker exploited the extension developer's permissions, which had been previously gained through a targeted phishing campaign.

In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.

Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28

Discover how we successfully disinfected thousands of computers infected with the PlugX worm using two remote disinfection methods.

Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements.

Security Operations Center (SOC) and Detection Engineering teams frequently encounter challenges in both creating and maintaining detection rules, along with their associated documentation, over time.

Learn about the comprehensive analysis of data exfiltration techniques and tools used by ransomware and extortion groups in campaigns.

This blogpost provide a comprehensive Analysis of Helldown: Tactics, Techniques, and Procedures (TTPs).

Sekoia TDR analysts conduct an assessment of threats regarding the major elections that will occur in 2024.