TDR Team

Threat Detection & Research Team

Articles by
TDR Team

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
January 22, 2025

Targeted supply chain attack against Chrome browser extensions

On 26 December 2024, the data security company Cyberhaven informed its users about a compromise of their Chrome browser extension. The attacker exploited the extension developer's permissions, which had been previously gained through a targeted phishing campaign.

By
Quentin Bourgue
By
TDR Team
& more
View more
Colorful cartoon illustration of a forest scene featuring a wooden log with a sneaky, mischievous face, green eyes, and a smirk, surrounded by pine trees, mushrooms, and a small stream.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
January 16, 2025

Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service

In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.

By
Quentin Bourgue
By
Grégoire CLERMONT
By
TDR Team
& more
View more
Handgun and bullets on a document in an official Russian conference room.
Threat Research & Intelligence
TDR Team
APT
January 13, 2025

Double-Tap Campaign: A Russia-Nexus APT Linked to APT28 Targets Kazakhstan's Diplomatic Relations

Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28

By
Amaury-Jacques GARÇON
By
Maxime ARQUILLIERE
By
Erwan CHEVALIER
By
Félix AIME
By
TDR Team
& more
View more
Illustration of a globe shielded within a digital cityscape, threats radiating outward
Threat Research & Intelligence
TDR Team
December 26, 2024

PlugX worm disinfection campaign feedbacks

Discover how we successfully disinfected thousands of computers infected with the PlugX worm using two remote disinfection methods.

By
TDR Team
& more
View more
Threat Research & Intelligence
TDR Team
December 19, 2024

Happy YARA Christmas: How Sekoia TDR Uses YARA Rules!

Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements.

By
TDR Team
& more
View more
Illustration of a golden staircase rising toward a glowing shield above a digital plane
Detection Engineering
TDR Team
Threat Research & Intelligence
December 16, 2024

Detection engineering at scale: one step closer (part one)

Security Operations Center (SOC) and Detection Engineering teams frequently encounter challenges in both creating and maintaining detection rules, along with their associated documentation, over time.

By
Guillaume COUCHARD
By
Erwan CHEVALIER
By
TDR Team
& more
View more
Illustration of an open safe with documents escaping alongside a broken chain
Threat Research & Intelligence
TDR Team
Cybercrime
Ransomware
November 27, 2024

Ransomware-driven data exfiltration: techniques and implications

Learn about the comprehensive analysis of data exfiltration techniques and tools used by ransomware and extortion groups in campaigns.

By
Livia TIBIRNA
By
Caroline LEWIS
By
TDR Team
& more
View more
Illustration of hooded figures in a server room lit by ransomware dashboards
Threat Research & Intelligence
TDR Team
Cybercrime
Ransomware
November 19, 2024

Helldown Ransomware: an overview of this emerging threat

This blogpost provide a comprehensive Analysis of Helldown: Tactics, Techniques, and Procedures (TTPs).

By
Jérémy SCION
By
TDR Team
& more
View more
Illuminated traditional Chinese street storefronts at night.
Threat Research & Intelligence
TDR Team
November 13, 2024

A three beats waltz: The ecosystem behind Chinese state-sponsored cyber threats

Sekoia TDR analysts conduct an assessment of threats regarding the major elections that will occur in 2024.

By
TDR Team
By
Coline C.
& more
View more
Illustration of an armored figure holding a glowing blade in a control room facing threat screens
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
November 5, 2024

ClickFix tactic: Revenge of detection

This blog post provides an overview of the observed Clickfix clusters and suggests detection rules based on an analysis of the various infection methods employed.

By
Jérémy SCION
By
TDR Team
& more
View more
Concise (Best for web accessibility) Pixel art illustration of a user on a video call with a ghost-like figure, set against a sci-fi space background with Star Wars-inspired elements. Detailed (Best for context-rich descriptions) Pixelated sci-fi illustration showing a glowing figure sitting at a computer workstation, having a video conference call. The monitor displays a ghostly, screaming phantom figure inside the video call window. The background features outer space elements, including TIE fighters, a Star Destroyer, and the Death Star. Short/Decorative (Best for quick labeling) Pixel art video call with a ghost figure in a sci-fi space setting.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
October 17, 2024

ClickFix tactic: The Phantom Meet

This blog post provides a chronological overview of the observed ClickFix campaigns. We further share technical details about a ClickFix cluster that uses fake Google Meet video conference pages to distribute infostealers.

By
Quentin Bourgue
By
TDR Team
& more
View more
Striped snake surrounded by email envelopes on a digital grid landscape.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
October 7, 2024

Mamba 2FA: A new contender in the AiTM phishing ecosystem

Discover Mamba 2FA, a previously unknown adversary-in-the-middle (AiTM) phishing kit, sold as phishing-as-a-service (PhaaS).

By
Grégoire CLERMONT
By
TDR Team
& more
View more