Threat Research & Intelligence

TDR

Sold to the Highest Bidder: The Escalation of ADINT from Geolocation Tracking to Intrusion Vector

Discover how private companies repurpose the advertising ecosystem into a global surveillance apparatus.

June 25, 2026

Threat Detection & Research Team

Maxime ARQUILLIERE

Coline CHAVANE

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Latest blogs

Threat Research & Intelligence

TDR

September 15, 2022

PrivateLoader: the loader of the prevalent ruzki PPI service

SEKOIA analysts tracked PrivateLoader’s network infrastructure for several months and recently conducted an in-depth analysis of the malware. In parallel, we also monitored activities related to the ruzki PPI malware service.

Pierre LE BOURHIS

Quentin BOURGUE

Threat Detection & Research Team

Threat Research & Intelligence

TDR

August 29, 2022

Traffers: a deep dive into the information stealer ecosystem

Traffers are responsible for redirecting user traffic to malicious content (malware, fraud, phishing, scam) exploited by other threat actors.

Quentin BOURGUE

Livia TIBIRNA

Threat Detection & Research Team

Threat Research & Intelligence

TDR

August 12, 2022

LuckyMouse uses a backdoored Electron app to target MacOS

LuckyMouse uses a backdoored Electron app to target MacOS. This is the first time that Sekoia observed LuckyMouse targeting MacOS.

Félix AIME

Charles MESLAY

Threat Detection & Research Team

Threat Research & Intelligence

TDR

July 28, 2022

Sekoia Mid-2022 Ransomware Threat Landscape

Sekoia presents its Ransomware threat landscape for the first semester of 2022, with the following key points:

Livia TIBIRNA

Erwan CHEVALIER

Pierre-Antoine DUCHANGE

Narimane LAVAY

Threat Detection & Research Team

Threat Research & Intelligence

TDR

July 18, 2022

Ongoing Roaming Mantis smishing campaign targeting France

MoqHao (aka Wroba) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that likely spreads via SMS.

Quentin BOURGUE

Marc NEBOUT

Threat Detection & Research Team

Threat Research & Intelligence

TDR

July 8, 2022

Vice Society: a discreet but steady double extortion ransomware group

Vice Society is a little-known double extortion group that exfiltrates its victims' data and threatens its victims to leak their information.

Erwan CHEVALIER

Narimane LAVAY

Threat Detection & Research Team

Threat Research & Intelligence

TDR

June 29, 2022

Raccoon Stealer v2 - Part 2: In-depth analysis

This blog post is a technical analysis of the new Raccoon Stealer 2.0 stand-alone version. Authors have announced that the malware is also available in a DLL format or could be embedded in other PE.

Pierre LE BOURHIS

Quentin BOURGUE

Threat Detection & Research Team

Threat Research & Intelligence

TDR

June 28, 2022

Raccoon Stealer v2 - Part 1: The return of the dead

On June 10, 2022, Sekoia analysts stumbled upon active servers hosting a web page named “Raccoon Stealer 2.0”. Discover their research.

Quentin BOURGUE

Pierre LE BOURHIS

Threat Detection & Research Team

Threat Research & Intelligence

TDR

June 22, 2022

CALISTO continues its credential harvesting campaign

March 30, 2022, Google TAG published several IOCs related to CALISTO - a Russia-nexus threat actor. Discover our analysis.

Félix AIME

Threat Detection & Research Team

Threat Research & Intelligence

TDR

June 13, 2022

BumbleBee: a new trendy loader for Initial Access Brokers

BumbleBee is a new malicious loader that is being used by several IABs to gain an initial foothold within victims' networks

Quentin BOURGUE

Pierre LE BOURHIS

Threat Detection & Research Team

Threat Research & Intelligence

June 2, 2022

Threat Intelligence is not (only) on a spectrum

Cyber Threat Intelligence can vary widely, between raw streaming of observables up to fully contextualised curation of bespoke threat models

Sekoia.io

Threat Research & Intelligence

TDR

June 1, 2022

MSDT abused to achieve RCE on Microsoft Office

Discover through our article, how attackers hijack the Microsoft Support Diagnostic Tool to remotely execute arbitrary code under Windows

Félix AIME

Threat Detection & Research Team

Detection Engineering

TDR

May 23, 2022

TURLA’s new phishing-based reconnaissance campaign in Eastern Europe

Sekoia's Threat & Detection Researchers expose a reconnaissance and espionage campaign from TURLA against eastern-EU institutions

Guillaume COUCHARD

Maxime ARQUILLIERE

Threat Detection & Research Team

Threat Research & Intelligence

TDR

May 17, 2022

EternityTeam: a new prominent threat group on underground forums

During our monitoring of Dark Web cybercrime forums, we came across EternityTeam: here is what we found on this new active & organized threat

Quentin BOURGUE

Threat Detection & Research Team

Product News

SOC Insights & Other News

April 29, 2022

Sekoia.io proudly flies the flag of “Cybersecurity Made In Europe”

The European cybersecurity market is complex. Sekoia obtained the “cybersecurity made in Europe” to help customers fulfill their needs in XDR

Sekoia.io

Product News

Threat Research & Intelligence

TDR

April 22, 2022

XDR vs Ransomware

les xdr sont les solutions de choix pour lutter contre les menaces ransomware et arrêter les attaques avant impact...

Nicolas CAPRONI

Sekoia.io

Threat Detection & Research team

Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.

Meet TDR team

Read latest TDR articles