TDR Team

Threat Detection & Research Team

Articles by
TDR Team

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Central microchip with a glowing green padlock icon on a dark circuit board.
Threat Research & Intelligence
TDR Team
Cybercrime
Ransomware
May 13, 2024

Mallox affiliate leverages PureCrypter in MS-SQL exploitation campaigns

Learn about the techniques used by the Mallox ransomware affiliate to compromise an MS-SQL server. Dive into our detailed technical analysis.

By
TDR Team
By
Jérémy SCION
By
Livia TIBIRNA
By
Pierre LE BOURHIS
& more
View more
Abstract illustration of voters at electronic voting kiosks with international flags and circuit patterns.
Threat Research & Intelligence
TDR Team
April 30, 2024

Guarding Democracy: Assessing Cyber Threats to 2024 Worldwide Elections

Sekoia TDR analysts conduct an assessment of threats regarding the major elections that will occur in 2024.

By
TDR Team
By
Coline C.
By
Maxime ARQUILLIERE
By
Livia TIBIRNA
& more
View more
Threat Research & Intelligence
TDR Team
April 25, 2024

Unplugging PlugX: Sinkholing the PlugX USB worm botnet

Learn about our process for collecting telemetry data from PlugX worm-infected workstations, as well as how to disinfect them.

By
TDR Team
By
Félix AIME
By
Charles Meslay
& more
View more
Cloud security operations dashboard displaying data graphs and threat monitoring panels.
Threat Research & Intelligence
Detection Engineering
TDR Team
Integrations
April 18, 2024

AWS Detection Engineering: A Guide for Defenders

A broad introduction to AWS logs sources and relevant events for detection engineering.

By
TDR Team
By
Guillaume COUCHARD
By
Erwan CHEVALIER
& more
View more
Pixel art illustration of a cyber attacker drafting a phishing email in a high-rise office.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
March 25, 2024

Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit

Tycoon 2FA has become one of the most widespread AiTM phishing kits over the last few months.

By
TDR Team
By
Quentin Bourgue
& more
View more
Threat Research & Intelligence
TDR Team
March 14, 2024

Unveiling the depths of Residential Proxies providers

Discover the growing threat of residential proxies, their role in hiding among legitimate traffic and the challenges they pose in cyberspace.

By
TDR Team
By
Amaury-Jacques GARÇON
By
Livia TIBIRNA
By
Grégoire CLERMONT
& more
View more
Illustration of a key over a fortified wall against a circuit board background
Threat Research & Intelligence
TDR Team
March 7, 2024

The Architects of Evasion: a Crypters Threat Landscape

In this report, we introduce key concepts and analyse the different crypter-related activities and the lucrative ecosystem of threat groups leveraging them in malicious campaigns.

By
TDR Team
By
Livia TIBIRNA
& more
View more
Threat Research & Intelligence
TDR Team
March 1, 2024

NoName057(16)'s DDoSia project: 2024 updates and behavioural shifts

Learn about NoName057(16), a pro-Russian hacktivist group behind Project DDoSia targeting entities supporting Ukraine. Discover an overview of the changes made by the group, both from the perspective of the software shared by the group to generate DD

By
TDR Team
By
Amaury-Jacques GARÇON
By
Maxime ARQUILLIERE
& more
View more
A dark digital illustration depicting a menacing reptilian monster with glowing eyes lurking in the shadows, crouching over an illuminated smartphone lying on a ruined floor.
Threat Research & Intelligence
TDR Team
February 28, 2024

The Predator spyware ecosystem is not dead: Intellexa's active C2 infrastructure and targeted countries

Discover our TDR team's revelations about Predator spyware: its C2 infrastructure and list of countries still using its cyber espionage tool.

By
TDR Team
By
Félix AIME
By
Maxime ARQUILLIERE
& more
View more
Metallic gold padlock and blue security shield with digital circuit nodes.
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
February 22, 2024

Scattered Spider (aka UNC3944, Octo Tempest, Muddled Libra) Laying New Eggs

This report provides an overview of the Scattered Spider evolution, its modus operandi and the toolset leveraged over the past years. Additionally, it delves into the Scattered Spider TTPs, as well as the latest ongoing campaigns.

By
Pierre-Antoine DUCHANGE
By
Quentin Bourgue
By
Livia TIBIRNA
By
TDR Team
& more
View more
origami detective figure with magnifying glass
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
February 6, 2024

Adversary infrastructures tracked in 2023

Sekoia.io C2 Trackers identified more than 85,000 IP addresses used as C2 servers in 2023, an increase of more than 30% compared to 2022.

By
TDR Team
By
Marc NEBOUT
By
Quentin Bourgue
By
Amaury-Jacques GARÇON
By
Grégoire CLERMONT
& more
View more
Concise (Best for web accessibility) 3D digital illustration of a dense field of multi-colored dice scattered across a dark surface, symbolizing probability, risk, or randomness. Detailed (Best for context-rich descriptions) Graphic artwork depicting a large, chaotic pile of rounded six-sided dice scattered across a dark background. The dice appear in various shades of cream, teal, terracotta orange, and dark blue, with some floating mid-air in the distance, representing themes of chance, encryption randomness, or risk assessment. Short/Decorative (Best for quick labeling) A dense collection of multi-colored dice scattered across a dark background.
Threat Research & Intelligence
TDR Team
Cybercrime
February 1, 2024

Unveiling the intricacies of DiceLoader

This report aims to detail the functioning of a malware used by FIN7 since 2021, named DiceLoader (also known Icebot), and to provide a comprehensive approach of the threat by detailing the related Techniques and Procedures.

By
TDR Team
By
Pierre LE BOURHIS
& more
View more