Sekoia Blogs
Ongoing Roaming Mantis smishing campaign targeting France
MoqHao (aka Wroba) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that likely spreads via SMS.
Vice Society: A discreet but steady double extortion ransomware group
Vice Society is a little-known double extortion group that exfiltrates its victims' data and threatens its victims to leak their information.
Raccoon Stealer v2 - Part 2: In-depth analysis
This blog post is a technical analysis of the new Raccoon Stealer 2.0 stand-alone version. Authors have announced that the malware is also available in a DLL format or could be embedded in other PE.
Raccoon Stealer v2 - Part 1: The return of the dead
On June 10, 2022, Sekoia analysts stumbled upon active servers hosting a web page named “Raccoon Stealer 2.0”. Discover their research.
CALISTO continues its credential harvesting campaign
March 30, 2022, Google TAG published several IOCs related to CALISTO, a Russia-nexus threat actor. Discover our analysis.
BumbleBee: A new trendy loader for Initial Access Brokers
BumbleBee is a new malicious loader that is being used by several IABs to gain an initial foothold within victims' networks.
Threat intelligence is not (only) on a spectrum
Cyber Threat Intelligence can vary widely, between raw streaming of observables up to fully contextualised curation of bespoke threat models
MSDT abused to achieve RCE on Microsoft Office
Discover through our article, how attackers hijack the Microsoft Support Diagnostic Tool to remotely execute arbitrary code under Windows.
TURLA’s new phishing-based reconnaissance campaign in Eastern Europe
Sekoia's Threat & Detection Researchers expose a reconnaissance and espionage campaign from TURLA against eastern-EU institutions.
EternityTeam: a new prominent threat group on underground forums
During our monitoring of Dark Web cybercrime forums, we came across EternityTeam: here is what we found on this new active & organized threat
Sekoia proudly flies the flag of “Cybersecurity Made In Europe”
The European cybersecurity market is complex. Sekoia obtained the “cybersecurity made in Europe” to help customers fulfill their needs in XDR.
XDR vs ransomware
XDR is a solution of choice to fight against ransomware threats and stop attacks before impact.
Mars, a red-hot information stealer
Mars Stealer is an information stealer sold on underground forums by MarsTeam since June 22, 2021, with the malware-as-a-service model.
Improving threat detection with Sigma correlations
Today, we are adding Sigma Correlations support to the SEKOIA.IO threat detection capabilities! In this post, we discuss what can be done with it, and why it was needed.
Lapsus$: When kiddies play in the big league
The extortion group Lapsus$ that already succeeded in breaching several high profile companies is running riot and sowing confusion. In this blog, our Threat & Detection Research team answers your questions by drawing the profile of the group.
A war on multiple fronts – the turbulent cybercrime landscape
In this blog post, we will focus on developments in the world of cybercrime (which supposedly do not involve nation-state threat actors) in the current war context.
The story of a ransomware builder: from Thanos to Spook and beyond (Part 2)
Ransomware spook : In this second part of the series, you will discover how to handle such evil sightings and neutralize them before impact.
Invasion of Ukraine – what implications in cyberspace?
Our analysts and researchers use this very specific context to provide an overview of the current state of cybercrime.
The story of a ransomware builder: from Thanos to Spook and beyond (Part 1)
In this article, we show how Sekoia came across Spook, and what they found when looking under the hood.
NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
NOBELIUM is another name for the APT29 intrusion set, operated by a threat actor allegedly linked to the SVR.
Log4Shell: The defender’s worst nightmare?
In this blog post, our Threat Detection & Research team answers your questions on Log4Shell.
Threat Detection & Research team
Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.
