You may not have missed all the noises recently caused by Lapsus$, a group that seems to specialize in extortion without necessarily leveraging ransomware. At...
Lapsus$: when kiddies play in the big league
read more
A war on multiple fronts – the turbulent cybercrime landscape
Russia's war in Ukraine is currently widely mirrored in cyberspace, engaging many different parties in an ever-increasing dispute. In this blog post, we will...
The story of a ransomware builder: from Thanos to Spook and beyond (Part 2)
In a blog post entitled “The story of a ransomware builder: from Thanos to Spook and beyond (Part 1)”, our colleagues from CERT-SEKOIA described the results...
Invasion of Ukraine – what implications in cyberspace?
A first version of this blogpost was released as a FLINT (Flash Intelligence Report) by SEKOIA.IO Threat & Detection Research Team on February 16, 2022....
The story of a ransomware builder: from Thanos to Spook and beyond (Part 1)
Introduction During an onsite incident response analysis, CERT-Sekoia was contacted in order to respond to a Spook ransomware attack. After gathering the...
NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
NOBELIUM is another name for the APT29 intrusion set¹, operated by a threat actor allegedly linked to the SVR (the Foreign Intelligence Service of the Russian...
Log4Shell: the defender’s worst nightmare ?
[Since this post concerns a recently-published vulnerability, intelligence regarding latest research will be updated periodically] On Thursday, December 9,...
Walking on APT31 infrastructure footprints
November 10th, 2021 - SEKOIA.IO's Cyber Threat Intelligence team had an in-depth look at the APT31 intrusion set at the beginning of 2021 when the BfV...
An insider insights into Conti operations – Part two
The first blog post was focusing on Conti’s evolution and the leak's context and analysis. In this second blog post, we will look into how to make simple...
An insider insights into Conti operations – Part one
This is the first of two blog posts, where we focus on the Conti ransomware group whose training material was recently leaked on a cybercrime forum. To...
Ideation process at SEKOIA.IO
At SEKOIA.IO, we constantly work to ensure our customers are informed and protected from the latest threats. We focus on automation through new features...
Hatching Triage to enhance SEKOIA.IO Cyber Threat Intelligence
In this blogpost, we present the integration of Indicators of Compromise (IoCs) in our Cyber Threat Intelligence (CTI) from the results of Hatching’s Triage...
Hunting and detecting Cobalt Strike
In this blogpost, we describe step by step how to ensure a proactive and defensive posture against Cobalt Strike, one of the most powerful pentesting tools hijacked by attackers in their numerous campaigns.
Nos produits de cybersécurité
SEKOIA.IO XDR
La plateforme eXtended Detection & Response de SEKOIA.IO combine l’anticipation, via la connaissance des attaquants, aux capacités d’automatisation pour la détection et la réaction face aux attaques.
SEKOIA.IO CTI
Grace à l’une des meilleures équipes privées de renseignement en Europe, la Cyber Threat Intelligence de SEKOIA.IO permet de maîtriser les menaces qui ciblent votre organisation.
