Since mid 2023, Sekoia Threat Detection & Research team (TDR) investigated an infrastructure which controls compromised edge devices transformed into Operational Relay Boxes used to launch offensive cyber attack. La publication suivante Bulbature, beneath the waves of GobRAT est un…
Tag: Sekoia.io Blog
Why it’s time to replace your legacy SIEM with a SOC platform
In today’s cybersecurity landscape, upgrading from legacy SIEM solutions to modern SOC platforms is no longer a question of if, but when. As we enter 2024, security teams must adapt to the increasingly complex threats they face, and relying on…
Hadooken and K4Spreader: The 8220 Gang’s Latest Arsenal
On 17 September 2024, Sekoia’s Threat Detection & Research (TDR) team identified a notable infection chain targeting both Windows and Linux systems through our Oracle WebLogic honeypot. The attacker exploited CVE-2017-10271 and CVE-2020-14883 Weblogic vulnerabilities to deploy Python and Bash…
Navigating the NIS2 Directive: Key insights for cybersecurity compliance and how Sekoia.io can help
To read the French version the article, click here. The European Union (EU) adopted a fundamental directive at the end of 2022 aimed at protecting critical sectors of the European economy from cyber threats. Directive (EU) 2022/2555, better known as…
SilentSelfie: Uncovering a major watering hole campaign against Kurdish websites
Our investigation uncovered 25 kurdish websites compromised by four different variants of a malicious script, ranging from the simplest, which obtains the device’s location, to the most complex, which prompts selected users to install a malicious Android application. La publication…
WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution
This blogpost examines the use of WebDAV technology in hosting malicious files related to the Emmenhtal loader, then analyses the various final payloads delivered through this infrastructure, and concludes by exploring the possibility that the infrastructure is being offered as-a-service…
Securing Gold : Hunting typosquatted domains during the Olympics
Anticipating Paris 2024 Olympics cyber threats, Sekoia.io has conducted over July and August 2024 a proactive hunting of Olympics-typosquatted domains registered by malicious actors – cybercrime related and possibly APT campaigns – in order to detect any kind of operations…
Securing Gold : Hunting typosquatted domains during the Olympics
Anticipating Paris 2024 Olympics cyber threats, Sekoia.io has conducted over July and August 2024 a proactive hunting of Olympics-typosquatted domains registered by malicious actors – cybercrime related and possibly APT campaigns – in order to detect any kind of operations…
A glimpse into the Quad7 operators’ next moves and associated botnets
Key Takeaways The Sekoia TDR team has recently identified new staging servers, leading to the discovery of additional targets, implants, and botnet clusters tied to the Quad7 operators. The Quad7 botnet operators seem to be compromising several brands of SOHO…
Enabling new service models with SSDP
Platform enabled services In previous posts (see links below), I’ve outlined already the profound transformation of Security Operations Center (SOC) technologies. The journey from on-premise SOC solutions to Software-as-a-Service (SaaS) delivered platforms marks a significant milestone in this evolution. Gartner’s…
Enabling new service models with SSDP
Platform enabled services In previous posts (see links below), I’ve outlined already the profound transformation of Security Operations Center (SOC) technologies. The journey from on-premise SOC solutions to Software-as-a-Service (SaaS) delivered platforms marks a significant milestone in this evolution. Gartner’s…
Emulating and Detecting Scattered Spider-like Attacks
Written by Mitigant (Kennedy Torkura) and Sekoia.io Threat Detection and Research (TDR) team (Erwan Chevalier and Guillaume Couchard). Introduction Enterprises are increasingly using cloud infrastructure to take advantage of its underlying benefits. Unlike traditional data centres, cloud infrastructure affords business…
Emulating and Detecting Scattered Spider-like Attacks
Written by Mitigant (Kennedy Torkura) and Sekoia.io Threat Detection and Research (TDR) team (Erwan Chevalier and Guillaume Couchard). Introduction Enterprises are increasingly using cloud infrastructure to take advantage of its underlying benefits. Unlike traditional data centres, cloud infrastructure affords business…
Solving the 7777 Botnet enigma: A cybersecurity quest
Key Takeaways Sekoia.io investigated the mysterious 7777 botnet (aka. Quad7 botnet), published by the independent researcher Git7w0rm inside the “The curious case of the 7777 botnet” blogpost. This investigation allowed us to intercept network communications and malware deployed on…
Technological Evolution and the Rise of Advanced Security Solutions for SMEs
In today’s digital age, small and medium enterprises (SMEs) are facing unprecedented cybersecurity challenges. The threat landscape has evolved dramatically, with malicious actors constantly seeking out the weakest links, including those within supply chains. La publication suivante Technological Evolution and…
Technological Evolution and the Rise of Advanced Security Solutions for SMEs
In today’s digital age, small and medium enterprises (SMEs) are facing unprecedented cybersecurity challenges. The threat landscape has evolved dramatically, with malicious actors constantly seeking out the weakest links, including those within supply chains. La publication suivante Technological Evolution and…
MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
This report was originally published for our customers on 20 June 2024. Today, the Check Point Research (CPR) team published a report on the same implant, providing details of recent MuddyWater campaigns. Introduction On June 9 2024, ClearSky tweeted about a new…
MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
This report was originally published for our customers on 20 June 2024. Today, the Check Point Research (CPR) team published a report on the same implant, providing details of recent MuddyWater campaigns. Introduction On June 9 2024, ClearSky tweeted about a new…
How Sekoia.io Uses the MITRE ATT&CK Framework to Enhance SOC Capabilities
At Sekoia.io, the integration of the MITRE ATT&CK framework into our Security Operations Center (SOC) platform is a cornerstone of our approach to cybersecurity. The ATT&CK framework serves as a comprehensive knowledge base of cyber adversary behavior and a taxonomy…
Exposing FakeBat loader: distribution methods and adversary infrastructure
During the first semester of 2024, FakeBat (aka EugenLoader, PaykLoader) was one of the most widespread loaders using the drive-by download technique. La publication suivante Exposing FakeBat loader: distribution methods and adversary infrastructure est un article de Sekoia.io Blog. This…