A beam of light showing a piece of machinery with interlocking wires.

August 24, 2026

SOC Insights & Other News

Product News

What you need to know before putting AI agents in your production SOC

A convincing demo doesn’t prove production readiness. Learn how to test an AI agent before it takes on live SOC investigations.

David Greenwood

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Latest blogs

Threat Research & Intelligence

TDR Team

APT

October 23, 2025

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

Amaury-Jacques GARÇON

Coline CHAVANE

TDR Team

Detection Engineering

Threat Research & Intelligence

TDR Team

October 21, 2025

Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping

This undocumented field of sign-in events is a number where each bit represents a different authentication method.

Grégoire CLERMONT

TDR Team

SOC Insights & Other News

October 16, 2025

Inside Sekoia's Hackathon 2025: Innovating together for customer satisfaction

Discover how Sekoia’s 2025 Hackathon turned bold ideas into customer-centric innovations, from AI assistants to faster SOC performance.

Julien CUNY

Threat Research & Intelligence

TDR Team

October 14, 2025

Defrosting PolarEdge's Backdoor: A QNAP TLS Implant via CVE-2023-20118

Deep technical analysis of a TLS C2 implant on QNAP exploiting CVE-2023-20118—protocol, anti-analysis, fingerprinting, IoCs & YARA

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

September 30, 2025

Silent Smishing : The Hidden Abuse of Cellular Router APIs

How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).

Jérémy SCION

Marc NEBOUT

Threat Research & Intelligence

TDR Team

APT

September 16, 2025

APT28 Operation Phantom Net Voxel: BeardShell & Covenant

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

Amaury-Jacques GARÇON

Charles Meslay

TDR Team

Black and white close-up of an owl's eye

Threat Research & Intelligence

TDR Team

September 2, 2025

Predators for Hire: A Global Overview of Commercial Surveillance Vendors

This report provides an overview of the commercial surveillance vendors ecosystem between 2010 and 2025, analysing their spyware offerings, business models, client base, target profiles, and infection chains.

TDR Team

Maxime ARQUILLIERE

Coline CHAVANE

Félix AIME

Threat Research & Intelligence

TDR Team

Cybercrime

June 11, 2025

Global analysis of Adversary-in-the-Middle phishing threats

This report explores current trends in the AitM phishing landscape and the prevalence of leading kits.

Quentin Bourgue

Grégoire CLERMONT

TDR Team

SOC Insights & Other News

June 3, 2025

Navigating DORA: How Sekoia can support your compliance journey

Explore the key aspects of DORA and how Sekoia.io assists organisations in achieving compliance through cyber threat intelligence for crisis exercises and cyberattack simulations.

Arnaud Dechoux

Threat Research & Intelligence

TDR Team

Cybercrime

May 27, 2025

The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

Jérémy SCION

Pierre LE BOURHIS

TDR Team

Threat Research & Intelligence

TDR Team

May 22, 2025

ViciousTrap (Infiltrate, Control, Lure): Turning Edge Devices into Honeypots at Scale

This blog post analyzes the Vicious Trap, a honeypot network deployed on compromised edge devices.

Félix AIME

Jérémy SCION

TDR Team

Threat Research & Intelligence

TDR Team

Cloud

April 22, 2025

Detecting Multi-Stage Infection Chains Madness

Learn about detecting multi-stage infection chains using Cloudflare tunnel infrastructures delivering RATs.

TDR Team

Erwan CHEVALIER

Threat Research & Intelligence

TDR Team

Cybercrime

April 16, 2025

Interlock ransomware: Evolving under the radar with ClickFix

ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.

TDR Team

SOC Insights & Other News

April 14, 2025

The evolution of the AI SOC: From Hype to Hyper

Explore the impact of Agentic AI in SOC operations and how it boosts efficiency and effectiveness for SOC teams.

David Greenwood

Threat Research & Intelligence

TDR Team

APT

March 31, 2025

From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic

Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.

Amaury-Jacques GARÇON

Coline CHAVANE

Félix AIME

TDR Team

Threat Research & Intelligence

TDR Team

March 18, 2025

ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery

ClearFake's new variant abuses the Binance Smart Chain and fake CAPTCHAs to deliver malware. A technical analysis of its Web3 evasion and ClickFix infection chain.

Pierre LE BOURHIS

Quentin Bourgue

TDR Team

Threat Detection & Research team

Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.

Meet TDR team

Read latest TDR articles

All categories

Detection Engineering

Product News

SOC Insights & Other News

Threat Research & Intelligence