Pixel-art illustration of a retro computer lab filled with vintage computers, floppy disks, circuit boards, and electronic equipment, with two cats displayed on the central monitor.
September 21, 2026
Threat Research & Intelligence
TDR Team
Cybercrime
Exvicy: A copycat of the ErrTraffic malware distribution framework
This article details how TDR pivoted from a forum advertisement to identify confirmed operator infrastructure, analyzes the Exvicy infection chain, and provides code evidence establishing that this emerging MaaS is a direct copycat of the adopted ErrTraffic framework.
Quentin Bourgue
TDR Team
Read more
ALL
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Latest blogs

Threat Research & Intelligence
TDR Team
Cybercrime
AI
Phishing
April 7, 2026

EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud - Part 2

Explore how EvilTokens uses AI-driven features to automate and scale BEC workflows. Uncover the PhaaS operations on Telegram.

By
Quentin Bourgue
By
TDR Team
View more
Cybersecurity Health Check dashboard interface showing system vulnerability metrics.
Product News
March 31, 2026

Meet Sekoia Reveal: Turn fragmented asset data into unified SOC context

Security teams do not struggle with a lack of data. They struggle with a lack of context.

By
David Greenwood
View more
Pixel art illustration of a cheerful turtle in aviator goggles sitting on a cloud while fishing for a gold coin with an evil smiling face.
Threat Research & Intelligence
TDR Team
Cybercrime
AI
Phishing
March 30, 2026

New widespread EvilTokens kit: device code phishing as-a-service - Part 1

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud.

By
Quentin Bourgue
By
TDR Team
View more
Hooded wolf-masked hacker holding a tax-themed phishing document over a digital world map.
Threat Research & Intelligence
TDR Team
APT
Phishing
March 24, 2026

Silver Fox: The Only Tax Audit Where the Fine Print Installs Malware

Track the 2025-2026 shift of China-based Silver Fox from financial crime to APT espionage. Discover how they exploit tax-themed phishing and RMM tools to target South Asian entities.

By
Pierre LE BOURHIS
By
Coline C.
View more
SOC Insights & Other News
Cloud
March 13, 2026

UEBA in the Real World: Catching Intrusions That Don’t Look Like Intrusions

Traditional SOC rules miss attacks using valid accounts and MFA fatigue. Learn real-world cases where UEBA detects stealthy lateral movement, OAuth abuse, and cloud console misuse.

By
David Greenwood
View more
Cybersecurity asset inventory dashboard table listing identified network hosts.
SOC Insights & Other News
Cloud
March 6, 2026

Shadow IT: The Initial Access You Didn’t Log

Shadow IT isn’t just governance debt, it’s an attacker’s beachhead. This post explores real intrusions where forgotten assets, rogue tenants, exposed cloud storage, and abandoned domains enabled initial access, and why closing visibility gaps is now a core SOC capability.

By
David Greenwood
View more
SOC Insights & Other News
Compliance
March 2, 2026

Sekoia achieves SOC2 compliance

Sekoia achieves SOC 2 Type 1 compliance across its infrastructure, reinforcing its commitment to data security and trust.

By
Maxime ARANDEL
View more
Threat Research & Intelligence
TDR Team
Cybercrime
Ransomware
February 12, 2026

OysterLoader Unmasked: The Multi-Stage Evasion Loader

Unmasking OysterLoader's evasion: from API hammering to custom LZMA. Explore the 4-stage infection chain and its ties to Rhysida ransomware.

By
Pierre LE BOURHIS
View more
Threat Research & Intelligence
TDR Team
Cybercrime
January 29, 2026

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

By
Quentin Bourgue
By
Amaury-Jacques GARÇON
By
TDR Team
View more
Detection Engineering
Threat Research & Intelligence
TDR Team
January 14, 2026

Leveraging Landlock telemetry for Linux detection engineering

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

By
TDR Team
By
Erwan CHEVALIER
By
Guillaume COUCHARD
View more
Cartoon elf pointing at a computer screen displaying code in a workshop.
Threat Research & Intelligence
TDR Team
Cybercrime
December 22, 2025

Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant

Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.

By
Pierre LE BOURHIS
By
Jérémy SCION
By
TDR Team
View more
Two analysts wearing Sekoia hoodies working at computer screens.
SOC Insights & Other News
December 18, 2025

Sekoia Strengthens Collective Cyber Defense at NATO CCDCOE’s Crossed Swords 2025 Exercise

Sekoia.io delivered its technology and expertise to the NATO CCDCOE’s Crossed Swords 2025 (XS25) exercise to gather critical insights and validate our defensive capabilities in a military-grade environment.

By
Arnaud Dechoux
By
Erwan CHEVALIER
By
Guillaume COUCHARD
View more
Festive pixel art with Santa Claus, Christmas elements, and a virus inside a lightbulb.
Threat Research & Intelligence
TDR Team
Cybercrime
December 15, 2025

Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader

In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
View more
SOC Insights & Other News
Compliance
December 11, 2025

Mandating Security by Design: Sekoia's Blueprint for the EU Cyber Resilience Act

Discover Sekoia's blueprint for the EU Cyber Resilience Act and how we can support your compliance to the CRA.

By
Arnaud Dechoux
By
Maxime ARANDEL
View more
Threat Research & Intelligence
TDR Team
Cybercrime
December 8, 2025

Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration

Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
View more
Threat Research & Intelligence
TDR Team
APT
Phishing
December 3, 2025

French NGO Reporters Without Borders targeted by Calisto in recent campaign

Calisto phishing campaign targeting Reporters Without Borders uses ProtonMail impersonation and AiTM techniques to steal credentials in 2025.

By
TDR Team
View more
Threat Research & Intelligence
TDR Team
Cybercrime
December 1, 2025

Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing

Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows

By
Jérémy SCION
By
Pierre LE BOURHIS
By
TDR Team
View more
Threat Research & Intelligence
TDR Team
Cybercrime
Phishing
November 6, 2025

Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

By
Jérémy SCION
By
Quentin Bourgue
By
TDR Team
View more
Threat Research & Intelligence
TDR Team
APT
October 23, 2025

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

By
Amaury-Jacques GARÇON
By
Coline C.
By
TDR Team
View more
Purple blueprint diagram of a mechanical locking mechanism with technical annotations, labels, and reference numbers.
Detection Engineering
Threat Research & Intelligence
TDR Team
October 21, 2025

Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping

This undocumented field of sign-in events is a number where each bit represents a different authentication method.

By
Grégoire CLERMONT
By
TDR Team
View more
SOC Insights & Other News
AI
October 16, 2025

Inside Sekoia's Hackathon 2025: Innovating together for customer satisfaction

Discover how Sekoia’s 2025 Hackathon turned bold ideas into customer-centric innovations, from AI assistants to faster SOC performance.

By
Julien CUNY
View more

Threat Detection & Research team

Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.

Meet TDR team

Read latest TDR articles

Abstract circular icon with a central human figure surrounded by six connecting nodes.
All categories & topics
Ransomware
Phishing
Compliance
Integrations
AI
Cloud
Cybercrime
APT
TDR Team
Detection Engineering
Product News
SOC Insights & Other News
Threat Research & Intelligence