Efstratios Lontzetidis - Threat Research Portfolio

Senior Threat Researcher @ SOCRadar

πŸ“– SOCRadar

Inside ICMacOS: From an Infostealer to a Persistent RAT

October 12, 2026
#ICMacOS #macOS #stealer #RAT
πŸ“– SOCRadar

NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation

October 07, 2026
#Citrix #CVE-2026-88771 #Vulnerability
πŸ“– SOCRadar

Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

September 22, 2026
#Konni #DPRK #VelvetCake #Ukraine #Phishing
πŸ“– SOCRadar

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

September 08, 2026
#CVE-2025-25249 #FortiGate #PivotC2 #Russian #Cybercrime
πŸ“– SOCRadar

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

August 21, 2026
#FTP Banners #Phishing #E4del RAT #PINHOLE RAT #Dead Drop Resolver
πŸ“– SOCRadar

INC Ransom Targeted 24 Law Firms, but Only 10 are Listed

August 11, 2026
#INCRansom #Law Firms #Ransom Payment
πŸ“– SOCRadar

Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools

August 07, 2026
#Kynx #Stealer #MaaS
πŸ“– SOCRadar

Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs

August 03, 2026
#DoublCup #ClickFix #CountLoader #DeviceManager RAT
πŸ“– SOCRadar

Who Needs a Job? DPRK ClickFake Interview Campaign Drops PylangGhost and GolangGhost RATs

July 20, 2026
#Famous Chollima #DPRK #PylangGhost #GolangGhost #ClickFake Interview
πŸ“– SOCRadar

FortiBleed Unmasked: A Joint Operation by Lynx and INC Ransomware Groups

July 06, 2026
#INC #Lynx #Ransomware #FortiBleed
πŸ“– SOCRadar

Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation

June 22, 2026
#Russia #FortiBleed #FortiGate #IAB
πŸ“– SOCRadar

New Data Extortion Group β€œPink” Goes Big Game Hunting With Evasive Phishing Kits

June 12, 2026
#Phishing #Pink #BlackFile #The Com #Okta #Entra ID
▢️ FIRST CTI 2026

Presentation: Unlocking Insights: The Role of TI in Modern DFIR Operations

April 23, 2026
#Presentation #TI #DFIR #APT #Android Malware #Winnti
πŸ“– Validin

'Hello? I can’t hear you': Investigating UNC1069’s Fake Meeting Tactics

April 14, 2026
#DPRK #APT #UNC1069 #Social Engineering #macOS
πŸ“– NVISO Security

The Detection & Response Chronicles: Exploring Telegram Abuse

December 16, 2025
#Detection Engineering #Telegram
πŸ“– NVISO Security

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

November 13, 2025
#DPRK #APT #Lazarus #Social Engineering #Contagious Interview
πŸ“– NVISO Security

Lunar Spider Expands their Web via FakeCaptcha

October 01, 2025
#Lunar Spider #FakeCaptcha #Latrodectus
πŸ“– NVISO Security

Shedding Light on PoisonSeed’s Phishing Kit

August 12, 2025
#Phishing #PoisonSeed #Precision-Validated Phishing #The Com
▢️ Security BSides Athens 2025

Presentation: Adversary Infrastructure Hunting - A practical case of hunting Lazarus APT

June 28, 2025
#Presentation #DPRK #Lazarus #Infrastructure Hunting #ClickFake Interview #Famous Chollima
πŸ“– Medium

LummaStealer Campaign: Too Much Love for Software Pirates

February 21, 2025
#LummaStealer #Infostealer #Cracked Software
πŸ“– Validin

Lazarus APT: Techniques for Hunting Contagious Interview

January 16, 2025
#Contagious Interview #Infrastructure #Validin #Lazarus #DPRK
πŸ“– Medium

Lumma (2024): Dominating the Info-Stealer Market

December 28, 2024
#LummaStealer #Infostealer #Market Trends
πŸ“– Medium

Greece’s 2024 Cyber Threat Landscape: Trends and Predictions

December 09, 2024
#Threat Landscape #Greece #CTI
πŸ“– Medium

Exploring Pythia: A Generic Query Format for Discovering Malicious Infrastructure

August 07, 2024
#Pythia #Infrastructure #Threat Hunting
πŸ“– Medium

Cyber Threat Intelligence Lifecycle: Answering the CTI Analyst Challenge

June 18, 2024
#CTI Lifecycle #Threat Intelligence #Methodology
πŸ“– Medium

Understanding the Ransomware Ecosystem

February 21, 2024
#Ransomware #RaaS #IAB
πŸ“– Medium

Combining Cybersecurity Frameworks: An Alternative to Incident Reporting

February 09, 2024
#Diamond Model #Cyber Kill Chain #MITRE ATT&CK #CTI
πŸ“– Medium

Integrating TweetFeed into MISP using Python

January 22, 2024
#MISP #Python #Automation #TweetFeed
πŸ“– Obrela

EditBot: A New Infostealer on the Rise

December 29, 2023
#EditBot #Infostealer #Telegram
πŸ“– Obrela Security Industries

Pikabot: A New Emerging Threat

December 14, 2023
#Pikabot #TA577 #C2
πŸ“– Medium

Cyber Threat Intelligence Sharing: Making the Investigation Outcomes Actionable

November 27, 2023
#CTI Sharing #Actionable Intelligence #IoCs #STIX
πŸ“– Medium

Cyber Threat Intelligence Pivoting: From a Single Alert to Multiple IoCs

November 09, 2023
#Pivoting #Threat Hunting #IoCs
πŸŽ“ Academic

Fronesis: Digital Forensics-based Early Detection of Ongoing Cyber-Attacks

December 10, 2022
#Academic Paper #Digital Forensics #Early Detection #Cyber Kill Chain #MITRE ATT&CK
πŸ“– University of East London

Themis: Computer-Aided Cybercrime Case Classification using Cosine Similarity and Ontological Reasoning

August 10, 2022
#MSc Dissertation #Cybercrime #Cosine Similarity #Ontological Reasoning
πŸŽ“ Academic

Evaluation and Enhancement of the Actionability of Publicly Available Cyber Threat Information in Digital Forensics

July 06, 2021
#Academic Paper #Digital Forensics #CTI #STIX
πŸ“– University of Macedonia

Evaluation and Classification of Cyber Threat Intelligence Sources (Greek)

June 01, 2021
#BSc Dissertation #CTI Sources #Classification #STIX