Sekoia Blogs

In this blogpost you will find the results of a survey conducted by our analysts on two Command and Control servers (C2s) of the North Korea-nexus intrusion set Reaper (aka APT37). This investigation led to the uncovering of several phishing webpages

The SEKOIA.IO Agent is out of Beta. To install it, simply follow the different configuration steps that we detail in this blog post.

This blog post is a technical analysis of Stealc infostealer, detailing different characteristics of the malware, including anti analysis, strings de-obfuscation and C2 communication techniques.

One year after the start of Russo-Ukrainian War, our analysts share through their analysis pertaining to the cyber picture.

This blogpost aims at presenting the activities of the Stealc’s alleged developer, a technical analysis of the malware and its C2 communications, and how to track it.

This blog post aims at analysing and highlighting trends within the ransomware ecosystem in the second half of 2022

Throughout 2022, Sekoia's Threat & Detection Research (TDR) team continued to proactively track and monitor the Command & Control (C2) infrastructures set up and used by cybercriminal or state sponsored intrusion sets to carry out malicious cyber

As many botnets and worms, Sekoia analysts demonstrate through this article that Raspberry Robin can be repurposed by other threat actors to deploy their own implants.

This blogpost aims at presenting the current infection chain, payloads and the whole infrastructure used to distribute infostealers

This article aims at presenting Sekoia's RisePro information stealer analysis.

Discover malicious activities associated to the DPRK-nexus Intrusion Sets (Kimsuky and Lazarus group) reported in open sources in 2022.

Sekoia.io indicators can be integrated into Microsoft Sentinel One. In this blogpost, discover how to take advantage of this integration.

Calisto (aka Callisto, COLDRIVER) is suspected to be a Russian-nexus intrusion set active since at least April 2017. Although it was not publicly attributed to any Russian intelligence service, past Calisto operations showed objectives and victimology that were closely aligned with Russian strategic interests.

This blogpost discusses how the Tactics, Techniques and Procedures (TTPs) used by the APT27 (Lucky Mouse) intrusion set in the last incident reported by Intrinsec, a Sekoia Managed Security Service Provider (MSSP) partner, are detected using SEKOI

Sekoia analysed Aurora in depth and share the results of our investigation in this article.

In September 2022 during routine Dark Web monitoring we identified BlueFox Stealer v2, a newly-advertized information stealer sold as MaaS.

In this blog post we present Sekoia’s process to create detection rules, which first requires explaining our detection workflow as well as understanding Sekoia XDR history and specificities.

Sekoia analysts tracked PrivateLoader’s network infrastructure for several months and recently conducted an in-depth analysis of the malware. In parallel, we also monitored activities related to the ruzki PPI malware service.

Traffers are responsible for redirecting user traffic to malicious content (malware, fraud, phishing, scam) exploited by other threat actors.

LuckyMouse uses a backdoored Electron app to target MacOS. This is the first time that Sekoia observed LuckyMouse targeting MacOS.

Sekoia presents its Ransomware threat landscape for the first semester of 2022, with the following key points...