Latest blogs

Sekoia Obtains ENS Alta Certification for the Spanish Market.

A Sekoia perspective on what the White House's latest move means for cyber defense.

ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it.

This article details how TDR pivoted from a forum advertisement to identify confirmed operator infrastructure, analyzes the Exvicy infection chain, and provides code evidence establishing that this emerging MaaS is a direct copycat of the adopted ErrTraffic framework.

Four questions MSSPs should ask about SOC platform costs, detection, context, and AI oversight before committing their margin and reputation.

An analysis of how Europe’s emerging AI and cybersecurity framework is shaping trust, control and technology sovereignty in the SOC.

One SOC can protect dozens of customers, but every customer works differently. See how multi-level agents give security teams one shared way to investigate alerts, while keeping the local context needed to make the right call.

Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers.

AI SOC agents need more than an alert to investigate threats. See how telemetry, asset data, identities and threat intelligence help explain each verdict.

Security teams are being asked to trust AI with work that used to belong to experienced analysts. So how can they decide if it’s earned its place there?

A convincing demo doesn’t prove production readiness. Learn how to test an AI agent before it takes on live SOC investigations.

A detection can raise the alarm and still leave the analyst with the hardest work. Runbooks put the investigation path beside the alert.

Explore six AI SOC integrations that bring identity, cloud, vulnerability, phishing, incident and network context into one investigation workflow.

Discover what self-hosted means for critical sector SOC teams, and how Sekoia can make it happen.

This article details a campaign targeting vulnerability researchers with "ChocoPoC" malware embedded inside trojanised Python dependencies. Exploiting the pressure to quickly test new vulnerabilities, threat actors distribute a persistent Remote Access Trojan (RAT) that exfiltrates data and harvests credentials from compromised developer environments.

Discover how private companies repurpose the advertising ecosystem into a global surveillance apparatus.

Sekoia has partnered with branding agency Bruno to develop a new brand identity and digital experience that reflects who we really are.

This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.

Sekoia TDR looks back at how APT28's arsenal has evolved over two decades, from its signature X-Agent implants to disposable modules, edge-device infrastructure and the first LLM-driven malware.

Discover part 3 of our FSB Matryoshka investigation. We deep dive into Gamaredon's Gammasteel info-stealer, its data exfiltration TTPs, and indicators.

In part 2 of our FSB Matryoshka series, we analyze Gamaredon's Gammaload malware variant, dissecting its technical updates and deployment mechanisms.