Anticipating Paris 2024 Olympics cyber threats, Sekoia.io has conducted over July and August 2024 a proactive hunting of Olympics-typosquatted domains registered by malicious actors – cybercrime related and possibly APT campaigns – in order to detect any kind of operations…
Tag: Sekoia.io Blog
Securing Gold : Hunting typosquatted domains during the Olympics
Anticipating Paris 2024 Olympics cyber threats, Sekoia.io has conducted over July and August 2024 a proactive hunting of Olympics-typosquatted domains registered by malicious actors – cybercrime related and possibly APT campaigns – in order to detect any kind of operations…
A glimpse into the Quad7 operators’ next moves and associated botnets
Key Takeaways The Sekoia TDR team has recently identified new staging servers, leading to the discovery of additional targets, implants, and botnet clusters tied to the Quad7 operators. The Quad7 botnet operators seem to be compromising several brands of SOHO…
Enabling new service models with SSDP
Platform enabled services In previous posts (see links below), I’ve outlined already the profound transformation of Security Operations Center (SOC) technologies. The journey from on-premise SOC solutions to Software-as-a-Service (SaaS) delivered platforms marks a significant milestone in this evolution. Gartner’s…
Enabling new service models with SSDP
Platform enabled services In previous posts (see links below), I’ve outlined already the profound transformation of Security Operations Center (SOC) technologies. The journey from on-premise SOC solutions to Software-as-a-Service (SaaS) delivered platforms marks a significant milestone in this evolution. Gartner’s…
Emulating and Detecting Scattered Spider-like Attacks
Written by Mitigant (Kennedy Torkura) and Sekoia.io Threat Detection and Research (TDR) team (Erwan Chevalier and Guillaume Couchard). Introduction Enterprises are increasingly using cloud infrastructure to take advantage of its underlying benefits. Unlike traditional data centres, cloud infrastructure affords business…
Emulating and Detecting Scattered Spider-like Attacks
Written by Mitigant (Kennedy Torkura) and Sekoia.io Threat Detection and Research (TDR) team (Erwan Chevalier and Guillaume Couchard). Introduction Enterprises are increasingly using cloud infrastructure to take advantage of its underlying benefits. Unlike traditional data centres, cloud infrastructure affords business…
Solving the 7777 Botnet enigma: A cybersecurity quest
Key Takeaways Sekoia.io investigated the mysterious 7777 botnet (aka. Quad7 botnet), published by the independent researcher Git7w0rm inside the “The curious case of the 7777 botnet” blogpost. This investigation allowed us to intercept network communications and malware deployed on…
Technological Evolution and the Rise of Advanced Security Solutions for SMEs
In today’s digital age, small and medium enterprises (SMEs) are facing unprecedented cybersecurity challenges. The threat landscape has evolved dramatically, with malicious actors constantly seeking out the weakest links, including those within supply chains. La publication suivante Technological Evolution and…
Technological Evolution and the Rise of Advanced Security Solutions for SMEs
In today’s digital age, small and medium enterprises (SMEs) are facing unprecedented cybersecurity challenges. The threat landscape has evolved dramatically, with malicious actors constantly seeking out the weakest links, including those within supply chains. La publication suivante Technological Evolution and…
MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
This report was originally published for our customers on 20 June 2024. Today, the Check Point Research (CPR) team published a report on the same implant, providing details of recent MuddyWater campaigns. Introduction On June 9 2024, ClearSky tweeted about a new…
MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
This report was originally published for our customers on 20 June 2024. Today, the Check Point Research (CPR) team published a report on the same implant, providing details of recent MuddyWater campaigns. Introduction On June 9 2024, ClearSky tweeted about a new…
How Sekoia.io Uses the MITRE ATT&CK Framework to Enhance SOC Capabilities
At Sekoia.io, the integration of the MITRE ATT&CK framework into our Security Operations Center (SOC) platform is a cornerstone of our approach to cybersecurity. The ATT&CK framework serves as a comprehensive knowledge base of cyber adversary behavior and a taxonomy…
Exposing FakeBat loader: distribution methods and adversary infrastructure
During the first semester of 2024, FakeBat (aka EugenLoader, PaykLoader) was one of the most widespread loaders using the drive-by download technique. La publication suivante Exposing FakeBat loader: distribution methods and adversary infrastructure est un article de Sekoia.io Blog. This…
Efficiency driven SOC operations
In my previous article, I gave an overview of the current transformation of the cybersecurity market, marked by major acquisitions and mergers among key players, and how new generation players profoundly affect SOC and MSSP models. We continue this series…
What’s up with the new kids?
The cybersecurity market is undergoing significant transformation marked by major acquisitions and mergers among key players. Traditional on-premise solutions are being replaced by comprehensive, SaaS-based platforms that offer faster deployment, lower costs, and superior capabilities. La publication suivante What’s up…
Combining Sekoia Intelligence and OpenCTI
The Filigran x Sekoia.io partnership announcement is an opportunity to put the spotlight back on the benefits of the integration between OpenCTI and Sekoia Threat Intelligence. La publication suivante Combining Sekoia Intelligence and OpenCTI est un article de Sekoia.io Blog. This article…
PikaBot: a Guide to its Deep Secrets and Operations
This blog post provides an in-depth analysis of PikaBot, focusing on its anti-analysis techniques implemented in the different malware stages. La publication suivante PikaBot: a Guide to its Deep Secrets and Operations est un article de Sekoia.io Blog. This article…
Introducing Sekoia TDR
This time, we’re not revealing a new cyber threat investigation or analysis, but I want to share some insights about the team behind all Sekoia Threat Intelligence and Detection Engineering reports. Let me introduce you to the Sekoia TDR team.…
Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign
This report was originally published for our customers on 14 May 2024. Executive summary Introduction On the eve of 2024, an election year in which more than 54% of the world’s population will be called to the polls, the pro-Russian…