Sekoia Blogs

Sekoia TDR investigates a large-scale APT29 watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply-chain attack. Discover how n-day exploits were used to steal cookies, Wi-Fi passwords, and device data.

A cloud-only SOC won’t fit every enterprise. Learn why deployment freedom and consistent capabilities will shape the next generation of security operations.

Attackers exploited PHP2Shell four days before the patch arrived, showing why security teams can no longer wait for disclosure to start investigating.

A self-hosted SOC can keep pace with modern threats when customers have control over deployment... and full confidence in what comes next.

In this conversation, Megan speaks with David Bizeul, Sekoia’s Chief Solution Officer, about ISOC, AI agents, analyst training, and beyond.

Zimperium Mobile Threat Defense now sends its mobile threat telemetry to the Sekoia SOC platform. Sekoia Elevate AI agents investigate each mobile alert alongside identity, cloud and network evidence, so analysts can see what it means for the whole organization.

Sekoia's TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent.

And why integrated security operations are the first step toward Autonomous Cyber Defense.

Stolen credentials can pass through several hands before an attacker uses them to access your organization, and each step leaves clues security teams can act on.

In this interview, Cyril Simonnet, Sekoia’s Chief Revenue Officer, explains how context, data, runbooks, and human judgment will shape AI-powered cybersecurity.

Sekoia Obtains ENS Alta Certification for the Spanish Market.

A Sekoia perspective on what the White House's latest move means for cyber defense.

ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it.

This article details how TDR pivoted from a forum advertisement to identify confirmed operator infrastructure, analyzes the Exvicy infection chain, and provides code evidence establishing that this emerging MaaS is a direct copycat of the adopted ErrTraffic framework.

Four questions MSSPs should ask about SOC platform costs, detection, context, and AI oversight before committing their margin and reputation.

An analysis of how Europe’s emerging AI and cybersecurity framework is shaping trust, control and technology sovereignty in the SOC.

One SOC can protect dozens of customers, but every customer works differently. See how multi-level agents give security teams one shared way to investigate alerts, while keeping the local context needed to make the right call.

Get the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers.

AI SOC agents need more than an alert to investigate threats. See how telemetry, asset data, identities and threat intelligence help explain each verdict.

Security teams are being asked to trust AI with work that used to belong to experienced analysts. So how can they decide if it’s earned its place there?

A convincing demo doesn’t prove production readiness. Learn how to test an AI agent before it takes on live SOC investigations.