François Deruty (@DerutyF) header
François Deruty (@DerutyF) profile picture

François Deruty

@DerutyF

threat intelligence at https://teapawt.net/t.co/w57MAeBZbo / former head of cert-fr @derutyf.bksy.social

 Ile-de-France, France
blog.sekoia.io
Joined May 2016
  • Tweets423
  • Following546
  • Followers377
2Media
Photo by François Deruty (@DerutyF)Photo by François Deruty (@DerutyF)
François Deruty retweeted
Félix Aimé (@felixaime) profile picture
Félix Aimé@felixaimeNov 3
For those still interested in the fridges, @sekoia_io captured an attack on four different honeypots this Sunday evening at 10 PM, potentially linked to the latest wave. It didn't use to "code of the day" but another unauthenticated vuln. 178.83.226[.]215 / 37.16.75[.]128
Image from Félix Aimé (@felixaime)
4
34
2
92
10,341
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_ioJul 1
Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits sekoia.com/blog/dont-eat-the… Discover our joint threat intelligence report with @YesWeHack.
Image from Sekoia (@sekoia_io)
2
6
1
12
15,108
🌐Recently, @sekoia_io joined MC for a session on #Cybersecurity trends & emerging threats. Represented by @DerutyF & Livia Tibirna, the team shared insights on today’s global #threat landscape and best practices. Proud to see their #impact worldwide - congrats!🙌
Image from Bright Pixel Capital (@brpxcapital)
1
1
105
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io14 Oct 2025
After our initial #PolarEdge #botnet write-up, we’re happy to announce the second part: “Defrosting PolarEdge’s Backdoor,” a full technical deep-dive into its TLS-based implant. blog.sekoia.io/polaredge-bac…
Image from Sekoia (@sekoia_io)
1
5
1
14
3,510
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io21 Oct 2025
Our latest technical deep-dive unravels the mystery behind the opaque numeric codes (16, 272, 33554432, etc.) you see in #Microsoft365 audit logs. buff.ly/w04flj1
Image from Sekoia (@sekoia_io)
1
7
14
1,757
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io23 Oct 2025
Discover how #TransparentTribe (#APT36) uses a disguised DESKTOP dropper to deploy #DeskRAT, a Golang RAT, on BOSS Linux endpoints in India. Our Sekoia #TDR report breaks down the full infection chain and stealthy WebSocket C2 communications Read more 👉 blog.sekoia.io/transparenttr…
Image from Sekoia (@sekoia_io)
10
1
35
2,827
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io6 Nov 2025
#TDR analysts dig into a modus operandi targeting the hospitality industry and the related cybercrime ecosystem that facilitates #phishing and #fraud campaigns. blog.sekoia.io/phishing-camp…
Image from Sekoia (@sekoia_io)
2
6
1
9
8,817
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io2 Sep 2025
[Threat investigation alert 🚨] Predators for Hire: A Global Overview of Commercial Surveillance Vendors ➡️ blog.sekoia.io/predators-for…
Image from Sekoia (@sekoia_io)
1
16
32
2,698
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io21 Jul 2025
🔥 Hot summer, sizzling crypto... and scammers turning up the heat 🔥 Back in March, Sekoia #TDR team published a deep-dive report on a #Lazarus cluster we dubbed #ClickFake Interview, leveraging the #ClickFix technique in their #ContagiousInterview campaign.
Image from Sekoia (@sekoia_io)
1
9
1
22
2,830
François Deruty retweeted
Europol (@Europol) profile picture
Europol
@Europol16 Jul 2025
🚨 Operation Eastwood targets pro-Russian cybercrime network NoName057(16) and shuts down over one hundred criminal servers in global operation. Read more in our press release ⤵️ europol.europa.eu/media-pres…
Image from Europol (@Europol)
21
118
30
260
88,317
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io8 Jul 2025
A few weeks ago, we published our global analysis of Adversary-in-the-Middle #phishing threats, providing actionable intelligence on multiple #AitM phishing kits. This report includes 11 sheets covering the most widespread #AitM phishing kits as of Q1 2025.
Image from Sekoia (@sekoia_io)
1
21
52
7,257
François Deruty retweeted
TechNadu (@TechNadu) profile picture
TechNadu@TechNadu23 Jun 2025
TechNadu interviewed François Deruty(@DerutyF), Chief Intelligence Officer of @sekoia_io, to get answers about innovations observed in cybercrime operations, challenges faced by CIOs, and adjustments to intelligence programs. Deruty spoke about organizations tailoring red-team scenarios to the precise threats they face. He emphasized how Generative AI–powered deepfakes and hyper-realistic phishing lures force CTI teams towards dynamic behavior modeling. This interview discusses the following and more: 🟣Cybersecurity isn’t just tech; it’s about understanding geopolitical risks 🟣Generative AI playing a pivotal role in Security Operation Centers 🟣Thwarting real-world threats beyond borders with a collaborative effort 🔗Read the interview: technadu.com/exploiting-vuln… 🔔 👉 Follow @TechNadu for more Expert Insights and share your views in the comments below. #Sekoia #TechNadu #Interviews #AI #Cybersecurity #GenerativeAI #SocialEngineering #CyberThreats #CyberResilience #CTI
Image from TechNadu (@TechNadu)
2
1
136
François Deruty retweeted
crep1x (@crep1x) profile picture
crep1x@crep1x11 Jun 2025
We are excited to share our latest blogpost on AitM phishing threats - covering common TTPs, the PhaaS ecosystem, the most widespread kits, and multiple detection opportunities! teapawt.net/sekoia_io/status/19327… w/ @gregclermont
Sekoia (@sekoia_io) profile pictureSekoia@sekoia_io11 Jun 2025
📝 Our latest #TDR report delivers an in-depth analysis of Adversary-in-the-Middle (#AitM) #phishing threats - targeting Microsoft 365 and Google accounts - and their ecosystem. This report shares actionable intelligence to help analysts detect and investigate AitM phishing.
Image from Sekoia (@sekoia_io)
1
10
47
6,167
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io11 Jun 2025
📝 Our latest #TDR report delivers an in-depth analysis of Adversary-in-the-Middle (#AitM) #phishing threats - targeting Microsoft 365 and Google accounts - and their ecosystem. This report shares actionable intelligence to help analysts detect and investigate AitM phishing.
Image from Sekoia (@sekoia_io)
1
27
2
63
15,255
François Deruty retweeted
Virus Bulletin (@virusbtn) profile picture
Virus Bulletin@virusbtn28 May 2025
Jeremy Scion, Pierre Le Bourhis & Sekoia TDR present an analysis of the compromise chain initiated by the exploitation of CVE-2025-32432. The exploitation occurred in a CMS honeypot and led to a loader, a crypto miner, and a residential proxyware. blog.sekoia.io/the-sharp-tas…
Computer code showing the POST request to enable and use webshell.

ALT Computer code showing the POST request to enable and use webshell.

7
1
17
1,875
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io27 May 2025
🧀 The Sharp Taste of #Mimo’lette: Analyzing Mimo’s Latest Campaign targeting #Craft CMS buff.ly/hv4EWLp
6
9
1,061
François Deruty retweeted
Félix Aimé (@felixaime) profile picture
Félix Aimé@felixaime22 May 2025
Excited to see this paper finally published! Meet #ViciousTrap, a threat actor compromising and turning edge devices into honeypots! blog.sekoia.io/vicioustrap-i…
ViciousTrap: Turning Edge Devices into Honeypots at Scale

ViciousTrap: Turning Edge Devices into Honeypots at Scale

Discover ViciousTrap, a newly identified threat actor that turns compromised edge devices into honeypots at scale to monitor and exploit other attackers.

sekoia.com
1
9
20
2,980
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io23 Apr 2025
Our new report describes one of the latest observed infection chains (delivering #AsyncRAT) relying on the #Cloudflare tunnel infrastructure and the attacker’s #TTPs with a principal focus on detection opportunities. blog.sekoia.io/detecting-mul…
Image from Sekoia (@sekoia_io)
1
14
40
2,908
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io16 Apr 2025
Since the apparition of the #Interlock ransomware, the Sekoia #TDR team observed its operators evolving, improving their toolset (#LummaStealer #BerserkStealer), and leveraging new techniques such as #ClickFix to deploy the ransomware payload. blog.sekoia.io/interlock-ran…
Image from Sekoia (@sekoia_io)
16
3
35
9,448
François Deruty retweeted
Sekoia (@sekoia_io) profile picture
Sekoia@sekoia_io9 Apr 2025
🎉 It's not about a CTI investigation or a Detection Engineering topic, but today we are happy to announce that Sekoia.io has raised €26m! sekoia.io/en/presse/sekoia-i…
Image from Sekoia (@sekoia_io)
6
1
13
822
Load more