Product News

Sekoia’s new identity: Designed for clarity

Sekoia has partnered with branding agency Bruno to develop a new brand identity and digital experience that reflects who we really are.

June 24, 2026

Sekoia Team

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Latest blogs

Threat Research & Intelligence

TDR

January 29, 2026

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

Quentin BOURGUE

Amaury-Jacques GARCON

Threat Detection & Research Team

Detection Engineering

Threat Research & Intelligence

TDR

January 14, 2026

Leveraging Landlock telemetry for Linux detection engineering

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

Threat Detection & Research Team

Erwan CHEVALIER

Guillaume COUCHARD

Threat Research & Intelligence

TDR

December 22, 2025

Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant

Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.

Pierre LE BOURHIS

Jérémy SCION

Threat Detection & Research Team

SOC Insights & Other News

December 18, 2025

Sekoia.io Strengthens Collective Cyber Defense at NATO CCDCOE’s Crossed Swords 2025 Exercise

Sekoia.io delivered its technology and expertise to the NATO CCDCOE’s Crossed Swords 2025 (XS25) exercise to gather critical insights and validate our defensive capabilities in a military-grade environment. Hosted by the NATO Cooperative…

Arnaud DECHOUX

Erwan CHEVALIER

Guillaume COUCHARD

SOC Insights & Other News

December 11, 2025

Mandating Security by Design: Sekoia's Blueprint for the EU Cyber Resilience Act

Discover Sekoia's blueprint for the EU Cyber Resilience Act and how we can support your compliance to the CRA

Arnaud DECHOUX

Maxime ARANDEL

Threat Research & Intelligence

TDR

December 15, 2025

Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader

In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.

Jérémy SCION

Pierre LE BOURHIS

Threat Detection & Research Team

Threat Research & Intelligence

TDR

December 8, 2025

Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration

Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.

Jérémy SCION

Pierre LE BOURHIS

Threat Detection & Research Team

Threat Research & Intelligence

TDR

December 1, 2025

Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing

Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows

Jérémy SCION

Pierre LE BOURHIS

Threat Detection & Research Team

Threat Research & Intelligence

TDR

December 3, 2025

French NGO Reporters Without Borders targeted by Calisto in recent campaign

Calisto phishing campaign targeting Reporters Without Borders uses ProtonMail impersonation and AiTM techniques to steal credentials in 2025.

Threat Detection & Research Team

Threat Research & Intelligence

TDR

November 6, 2025

Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

Jérémy SCION

Quentin BOURGUE

Threat Detection & Research Team

Threat Research & Intelligence

TDR

October 23, 2025

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

Amaury-Jacques GARCON

Coline CHAVANE

Threat Detection & Research Team

Detection Engineering

Threat Research & Intelligence

October 21, 2025

Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping

This undocumented field of sign-in events is a number where each bit represents a different authentication method.

Grégoire CLERMONT

Threat Detection & Research Team

SOC Insights & Other News

October 16, 2025

Inside Sekoia.io Hackathon 2025 – Innovating together for customer satisfaction

Discover how Sekoia.io’s 2025 Hackathon turned bold ideas into customer-centric innovations, from AI assistants to faster SOC performance.

Julien CUNY

Threat Research & Intelligence

TDR

October 14, 2025

Defrosting PolarEdge’s Backdoor

Deep technical analysis of a TLS C2 implant on QNAP exploiting CVE-2023-20118—protocol, anti-analysis, fingerprinting, IoCs & YARA

Threat Detection & Research Team

Threat Research & Intelligence

TDR

September 16, 2025

APT28 Operation Phantom Net Voxel

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

Amaury-Jacques GARCON

Charles MESLAY

Threat Detection & Research Team

Threat Research & Intelligence

TDR

September 30, 2025

Silent Smishing : The Hidden Abuse of Cellular Router APIs

How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).

Jérémy SCION

Marc NEBOUT

Threat Detection & Research team

Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.

Meet TDR team

Read latest TDR articles