TDR Team

Threat Detection & Research Team

Articles by
TDR Team

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Hooded developer with a panda logo working at a multi-monitor workstation against a glowing digital globe.
Threat Research & Intelligence
TDR Team
APT
October 2, 2024

Bulbature, beneath the waves of GobRAT

Since mid 2023, Sekoia Threat Detection & Research team (TDR) investigated an infrastructure which controls compromised edge devices transformed into Operational Relay Boxes used to launch offensive cyber attack.

By
TDR Team
By
Amaury-Jacques GARÇON
By
Félix AIME
& more
View more
Threat Research & Intelligence
TDR Team
September 25, 2024

SilentSelfie: Uncovering a major watering hole campaign against Kurdish websites

Our investigation uncovered 25 kurdish websites compromised by four different variants of a malicious script, ranging from the simplest, which obtains the device's location, to the most complex, which prompts selected users to install a malicious And

By
TDR Team
By
Félix AIME
By
Maxime ARQUILLIERE
& more
View more
Network of server towers connected to a cloud security node over a global map.
Threat Research & Intelligence
TDR Team
Cybercrime
September 19, 2024

WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution

This blogpost examines the use of WebDAV technology in hosting malicious files related to the Emmenhtal loader, then analyses the various final payloads delivered through this infrastructure.

By
Marc NEBOUT
By
TDR Team
& more
View more
Illustration of Paris landmarks and athletes during a major international sporting event
Threat Research & Intelligence
TDR Team
September 11, 2024

Securing Gold : Hunting typosquatted domains during the Olympics

Discover how Sekoia.io proactively hunts for typosquatted domains related to the Paris 2024 Olympics to detect and prevent cyber threats.

By
Maxime ARQUILLIERE
By
Amaury-Jacques GARÇON
By
Coline C.
By
TDR Team
& more
View more
Illustration of a router emitting a network of light beams surrounded by monitoring screens
Threat Research & Intelligence
TDR Team
September 9, 2024

A glimpse into the Quad7 operators' next moves and associated botnets

Uncover the secrets of the Quad7 botnet and its ever-evolving toolset. Learn about the new backdoors and protocols used by these operators.

By
TDR Team
By
Félix AIME
By
Pierre-Antoine DUCHANGE
By
Charles Meslay
& more
View more
Conceptual cybersecurity graphic illustrating cyber attacks versus defense with shields, padlocks, and threat icons.
Detection Engineering
TDR Team
Cybercrime
Cloud
Phishing
July 24, 2024

Emulating and Detecting Scattered Spider-like Attacks

Explore a use-case scenario demonstrating how to detect scattered spider attacks in AWS environments and enhance your cloud security.

By
TDR Team
By
Guillaume COUCHARD
By
Erwan CHEVALIER
& more
View more
www.sekoia.com/blog/a-glimpse-into-the-quad7-operators-next-moves-and-associated-botnets
Threat Research & Intelligence
TDR Team
July 23, 2024

Solving the 7777 Botnet enigma: A cybersecurity quest

Discover 7777 botnet (aka Quad7) and its activity, targets, and use of TP-Link routers in Microsoft 365 attacks in our latest investigation.

By
TDR Team
By
Félix AIME
By
Pierre-Antoine DUCHANGE
By
Charles Meslay
By
Grégoire CLERMONT
& more
View more
Iranian flag waving behind bare tree branches under a blue sky.
Threat Research & Intelligence
TDR Team
APT
July 15, 2024

MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign

Find out how MuddyWater have changed their infection chain and employed a new implant dubbed "MuddyRot" by Sekoia TDR analysts.

By
TDR Team
& more
View more
The FakeBat loader; a background.
Threat Research & Intelligence
TDR Team
Cybercrime
July 2, 2024

Exposing FakeBat loader: distribution methods and adversary infrastructure

During the first semester of 2024, FakeBat (aka EugenLoader, PaykLoader) was one of the most widespread loaders using the drive-by download technique.

By
Quentin Bourgue
By
TDR Team
& more
View more
Illustration of a yellow robotic creature, pikabot, plugging cables into a server rack
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
June 3, 2024

PikaBot: a Guide to its Deep Secrets and Operations

This blog post provides an in-depth analysis of PikaBot, focusing on its anti-analysis techniques implemented in the different malware stages.

By
Pierre LE BOURHIS
By
Quentin Bourgue
By
TDR Team
& more
View more
Cybersecurity operations center with operators working beneath a large illuminated Russian flag backdrop.
Threat Research & Intelligence
TDR Team
Cybercrime
May 21, 2024

Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign

Uncover the details of the DoppelGänger campaign, a Russian influence operation aimed at undermining support for Ukraine.

By
TDR Team
By
Coline C.
By
Amaury-Jacques GARÇON
By
Kilian SEZNEC
& more
View more
High-tech workstation displaying a transparent SOC security dashboard screen.
Threat Research & Intelligence
Detection Engineering
TDR Team
May 15, 2024

Elevating Cybersecurity: The Sekoia.io Methodology for Advanced Detection Engineering

Learn how Sekoia.io stay ahead of the curve with sophisticated detection engineering strategies and proactive threat anticipation.

By
Thomas MARTIN
By
TDR Team
& more
View more