Over Security

Explore the impact of Agentic AI in SOC operations and how it boosts efficiency and effectiveness for SOC teams.

ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.

Learn about detecting multi-stage infection chains using Cloudflare tunnel infrastructures delivering RATs.

This blog post analyzes the Vicious Trap, a honeypot network deployed on compromised edge devices.

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

Explore the key aspects of DORA and how Sekoia.io assists organisations in achieving compliance through cyber threat intelligence for crisis exercises and cyberattack simulations.

This report explores current trends in the AitM phishing landscape and the prevalence of leading kits.

Overview of the commercial surveillance vendor ecosystem from 2010 to 2025: spyware offerings, business models, clients, targets and infection chains.

How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

Deep technical analysis of a TLS C2 implant on QNAP exploiting CVE-2023-20118—protocol, anti-analysis, fingerprinting, IoCs & YARA

Discover how Sekoia’s 2025 Hackathon turned bold ideas into customer-centric innovations, from AI assistants to faster SOC performance.

This undocumented field of sign-in events is a number where each bit represents a different authentication method.

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

Calisto phishing campaign targeting Reporters Without Borders uses ProtonMail impersonation and AiTM techniques to steal credentials in 2025.

Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows

Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.

In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.

Discover Sekoia's blueprint for the EU Cyber Resilience Act and how we can support your compliance to the CRA.

Sekoia.io delivered its technology and expertise to the NATO CCDCOE’s Crossed Swords 2025 (XS25) exercise to gather critical insights and validate our defensive capabilities in a military-grade environment.

Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

Unmasking OysterLoader's evasion: from API hammering to custom LZMA. Explore the 4-stage infection chain and its ties to Rhysida ransomware.

Sekoia achieves SOC 2 Type 1 compliance across its infrastructure, reinforcing its commitment to data security and trust.

Shadow IT isn’t just governance debt, it’s an attacker’s beachhead. This post explores real intrusions where forgotten assets, rogue tenants, exposed cloud storage, and abandoned domains enabled initial access, and why closing visibility gaps is now a core SOC capability.

Track the 2025-2026 shift of China-based Silver Fox from financial crime to APT espionage. Discover how they exploit tax-themed phishing and RMM tools to target South Asian entities.

Traditional SOC rules miss attacks using valid accounts and MFA fatigue. Learn real-world cases where UEBA detects stealthy lateral movement, OAuth abuse, and cloud console misuse.

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud.