Sekoia Blogs
Detecting Multi-Stage Infection Chains Madness
Learn about detecting multi-stage infection chains using Cloudflare tunnel infrastructures delivering RATs.
Interlock ransomware: Evolving under the radar with ClickFix
ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.
The evolution of the AI SOC: From Hype to Hyper
Explore the impact of Agentic AI in SOC operations and how it boosts efficiency and effectiveness for SOC teams.
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake's new variant abuses the Binance Smart Chain and fake CAPTCHAs to deliver malware. A technical analysis of its Web3 evasion and ClickFix infection chain.
Detection engineering at scale: one step closer (part three)
Following our first article explaining our detection approach and associated challenges, the second one detailing the regular and automated actions implemented through our CI/CD pipelines, we will now conclude this series by presenting the continuous improvement loop that allows us to achieve our long-term objectives, incorporating the principles of detection engineering.
PolarEdge: Unveiling an uncovered ORB network
This blog post analyzes the PolarEdge backdoor and its associated botnet, offering insights into the adversary’s infrastructure.
Cyber threats impacting the financial sector in 2024: Focus on the main actors
This report provides an overview of the main actors involved in malicious campaigns impacting the financial sector in 2024. It follows up on a previous Sekoia report focusing on the emerging trends in the financial cyber threat landscape.
Sekoia achieves ISO 27001 compliance
Sekoia receives ISO 27001, leading international standard in information security management, from the auditor A-LIGN.
RATatouille: Cooking Up Chaos in the I2P Kitchen
Discover the challenges of ClickFix12 and the newly identified I2PRAT. Uncover the advanced techniques employed by this multi-stage RAT.
Detection engineering at scale: one step closer (part two)
In this article, we will build upon the previous discussion of our detection approach and associated challenges by detailing the regular and automated actions implemented through our CI/CD pipelines.
Targeted supply chain attack against Chrome browser extensions
On 26 December 2024, the data security company Cyberhaven informed its users about a compromise of their Chrome browser extension. The attacker exploited the extension developer's permissions, which had been previously gained through a targeted phishing campaign.
Transition from IBM QRadar to Sekoia for a modern & rewarding experience
In this article, we’ll explore why making the switch from QRadar to Sekoia Defend is a rewarding experience and how Sekoia’s state-of-the-art platform offers unparalleled flexibility and power.
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service
In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.
Double-Tap Campaign: A Russia-Nexus APT Linked to APT28 Targets Kazakhstan's Diplomatic Relations
Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28
PlugX worm disinfection campaign feedbacks
Discover how we successfully disinfected thousands of computers infected with the PlugX worm using two remote disinfection methods.
Happy YARA Christmas: How Sekoia TDR Uses YARA Rules!
Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements.
Detection engineering at scale: one step closer (part one)
Security Operations Center (SOC) and Detection Engineering teams frequently encounter challenges in both creating and maintaining detection rules, along with their associated documentation, over time.
The story behind Sekoia custom integrations
Experience the creativity and teamwork behind Sekoia.io Custom Integrations. Go behind the scenes of our traditional hackathon.
Implementing blocklists in the Sekoia SOC platform
On a calm Friday afternoon, rumors of a new active threat starts hitting the various social network websites. Your CSIRT team starts checking the private channels they have with other CERTs.
Ransomware-driven data exfiltration: techniques and implications
Learn about the comprehensive analysis of data exfiltration techniques and tools used by ransomware and extortion groups in campaigns.
Threat Detection & Research team
Sekoia Threat Detection & Research team, commonly known as the TDR team, is the driving force behind the Sekoia SOC platform, delivering exclusive threat intelligence.
