Efstratios Lontzetidis - Cyber Threat Research Publications by Efstratios Lontzetidis. https://efstratioslontzetidis.github.io/ Inside ICMacOS: From an Infostealer to a Persistent RAT Published by SOCRadar Mon, 12 Oct 2026 00:00:00 +0000 https://socradar.io/blog/icmacos-infostealer-rat/ https://socradar.io/blog/icmacos-infostealer-rat/ NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation Published by SOCRadar Wed, 07 Oct 2026 00:00:00 +0000 https://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/ https://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/ Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures Published by SOCRadar Tue, 22 Sep 2026 00:00:00 +0000 https://socradar.io/blog/operation-conflict-compass-konni-ukraine-lnk-lure/ https://socradar.io/blog/operation-conflict-compass-konni-ukraine-lnk-lure/ CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT Published by SOCRadar Tue, 08 Sep 2026 00:00:00 +0000 https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/ https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/ FTP Banners: The New Dead Drop Resolver Delivering Novel RATs Published by SOCRadar Fri, 21 Aug 2026 00:00:00 +0000 https://socradar.io/blog/ftp-banners-new-dead-drop-resolver-rats/ https://socradar.io/blog/ftp-banners-new-dead-drop-resolver-rats/ INC Ransom Targeted 24 Law Firms, but Only 10 are Listed Published by SOCRadar Tue, 11 Aug 2026 00:00:00 +0000 https://socradar.io/blog/inc-ransom-law-firm-extortion/ https://socradar.io/blog/inc-ransom-law-firm-extortion/ Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools Published by SOCRadar Fri, 07 Aug 2026 00:00:00 +0000 https://socradar.io/blog/kynx-stealer-wallets-games-ai-tools/ https://socradar.io/blog/kynx-stealer-wallets-games-ai-tools/ Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs Published by SOCRadar Mon, 03 Aug 2026 00:00:00 +0000 https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ Who Needs a Job? DPRK ClickFake Interview Campaign Drops PylangGhost and GolangGhost RATs Published by SOCRadar Mon, 20 Jul 2026 00:00:00 +0000 https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/ https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/ FortiBleed Unmasked: A Joint Operation by Lynx and INC Ransomware Groups Published by SOCRadar Mon, 06 Jul 2026 00:00:00 +0000 https://socradar.io/wp-content/uploads/2026/07/FortiBleed-Unmasked_-A-Joint-Operation-by-Lynx-and-INC-Ransomware-Groups-.pdf https://socradar.io/wp-content/uploads/2026/07/FortiBleed-Unmasked_-A-Joint-Operation-by-Lynx-and-INC-Ransomware-Groups-.pdf Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation Published by SOCRadar Mon, 22 Jun 2026 00:00:00 +0000 https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits Published by SOCRadar Fri, 12 Jun 2026 00:00:00 +0000 https://socradar.io/blog/pink-data-extortion-group-phishing-kits/ https://socradar.io/blog/pink-data-extortion-group-phishing-kits/ Presentation: Unlocking Insights: The Role of TI in Modern DFIR Operations Published by FIRST CTI 2026 Thu, 23 Apr 2026 00:00:00 +0000 https://www.youtube.com/watch?v=t-UNY-j8FbQ https://www.youtube.com/watch?v=t-UNY-j8FbQ 'Hello? I can’t hear you': Investigating UNC1069’s Fake Meeting Tactics Published by Validin Tue, 14 Apr 2026 00:00:00 +0000 https://www.validin.com/blog/i_cant_hear_you_unc1069/ https://www.validin.com/blog/i_cant_hear_you_unc1069/ The Detection & Response Chronicles: Exploring Telegram Abuse Published by NVISO Security Tue, 16 Dec 2025 00:00:00 +0000 https://blog.nviso.eu/2025/12/16/the-detection-response-chronicles-exploring-telegram-abuse/ https://blog.nviso.eu/2025/12/16/the-detection-response-chronicles-exploring-telegram-abuse/ Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery Published by NVISO Security Thu, 13 Nov 2025 00:00:00 +0000 https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/ https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/ Lunar Spider Expands their Web via FakeCaptcha Published by NVISO Security Wed, 01 Oct 2025 00:00:00 +0000 https://blog.nviso.eu/2025/10/01/lunar-spider-expands-their-web-via-fakecaptcha/ https://blog.nviso.eu/2025/10/01/lunar-spider-expands-their-web-via-fakecaptcha/ Shedding Light on PoisonSeed’s Phishing Kit Published by NVISO Security Tue, 12 Aug 2025 00:00:00 +0000 https://blog.nviso.eu/2025/08/12/shedding-light-on-poisonseeds-phishing-kit/ https://blog.nviso.eu/2025/08/12/shedding-light-on-poisonseeds-phishing-kit/ Presentation: Adversary Infrastructure Hunting - A practical case of hunting Lazarus APT Published by Security BSides Athens 2025 Sat, 28 Jun 2025 00:00:00 +0000 https://2025.bsidesath.gr/ https://2025.bsidesath.gr/ LummaStealer Campaign: Too Much Love for Software Pirates Published by Medium Fri, 21 Feb 2025 00:00:00 +0000 https://medium.com/@s.lontzetidis/lummastealer-campaign-too-much-love-for-software-pirates-66ebe4b2f3a6 https://medium.com/@s.lontzetidis/lummastealer-campaign-too-much-love-for-software-pirates-66ebe4b2f3a6 Lazarus APT: Techniques for Hunting Contagious Interview Published by Validin Thu, 16 Jan 2025 00:00:00 +0000 https://www.validin.com/blog/inoculating_contagious_interview_with_validin/ https://www.validin.com/blog/inoculating_contagious_interview_with_validin/ Lumma (2024): Dominating the Info-Stealer Market Published by Medium Sat, 28 Dec 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/lumma-2024-dominating-the-info-stealer-market-070e7d8fa3d6 https://medium.com/@s.lontzetidis/lumma-2024-dominating-the-info-stealer-market-070e7d8fa3d6 Greece’s 2024 Cyber Threat Landscape: Trends and Predictions Published by Medium Mon, 09 Dec 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/greeces-2024-cyber-threat-landscape-trends-and-predictions-4015a1f0fbbc https://medium.com/@s.lontzetidis/greeces-2024-cyber-threat-landscape-trends-and-predictions-4015a1f0fbbc Exploring Pythia: A Generic Query Format for Discovering Malicious Infrastructure Published by Medium Wed, 07 Aug 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/exploring-pythia-a-generic-query-format-for-discovering-malicious-infrastructure-8956876cc15a https://medium.com/@s.lontzetidis/exploring-pythia-a-generic-query-format-for-discovering-malicious-infrastructure-8956876cc15a Cyber Threat Intelligence Lifecycle: Answering the CTI Analyst Challenge Published by Medium Tue, 18 Jun 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/cyber-threat-intelligence-lifecycle-answering-the-cti-analyst-challenge-3ddf7e0be28c https://medium.com/@s.lontzetidis/cyber-threat-intelligence-lifecycle-answering-the-cti-analyst-challenge-3ddf7e0be28c Understanding the Ransomware Ecosystem Published by Medium Wed, 21 Feb 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/understanding-the-ransomware-ecosystem-1af87b3dc2e5 https://medium.com/@s.lontzetidis/understanding-the-ransomware-ecosystem-1af87b3dc2e5 Combining Cybersecurity Frameworks: An Alternative to Incident Reporting Published by Medium Fri, 09 Feb 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/combining-cybersecurity-frameworks-an-alternative-to-incident-reporting-9d642d9a5456 https://medium.com/@s.lontzetidis/combining-cybersecurity-frameworks-an-alternative-to-incident-reporting-9d642d9a5456 Integrating TweetFeed into MISP using Python Published by Medium Mon, 22 Jan 2024 00:00:00 +0000 https://medium.com/@s.lontzetidis/integrating-tweetfeed-into-misp-using-python-e0a94e01fec2 https://medium.com/@s.lontzetidis/integrating-tweetfeed-into-misp-using-python-e0a94e01fec2 EditBot: A New Infostealer on the Rise Published by Obrela Fri, 29 Dec 2023 00:00:00 +0000 https://www.obrela.com/advisory/editbot-a-new-infostealer-on-the-rise/ https://www.obrela.com/advisory/editbot-a-new-infostealer-on-the-rise/ Pikabot: A New Emerging Threat Published by Obrela Security Industries Thu, 14 Dec 2023 00:00:00 +0000 https://www.obrela.com/advisory/pikabot-a-new-emerging-threat/ https://www.obrela.com/advisory/pikabot-a-new-emerging-threat/ Cyber Threat Intelligence Sharing: Making the Investigation Outcomes Actionable Published by Medium Mon, 27 Nov 2023 00:00:00 +0000 https://medium.com/@s.lontzetidis/cyber-threat-intelligence-sharing-making-the-investigation-outcomes-actionable-82ca6e7cb7e3 https://medium.com/@s.lontzetidis/cyber-threat-intelligence-sharing-making-the-investigation-outcomes-actionable-82ca6e7cb7e3 Cyber Threat Intelligence Pivoting: From a Single Alert to Multiple IoCs Published by Medium Thu, 09 Nov 2023 00:00:00 +0000 https://medium.com/@s.lontzetidis/cyber-threat-intelligence-pivoting-from-a-single-alert-to-multiple-iocs-646662142608 https://medium.com/@s.lontzetidis/cyber-threat-intelligence-pivoting-from-a-single-alert-to-multiple-iocs-646662142608 Fronesis: Digital Forensics-based Early Detection of Ongoing Cyber-Attacks Published by IEEE Sat, 10 Dec 2022 00:00:00 +0000 https://ieeexplore.ieee.org/document/10004506 https://ieeexplore.ieee.org/document/10004506 Themis: Computer-Aided Cybercrime Case Classification using Cosine Similarity and Ontological Reasoning Published by University of East London Wed, 10 Aug 2022 00:00:00 +0000 https://www.researchgate.net/publication/362606078_Themis_Computer-Aided_Cybercrime_Case_Classification_using_Cosine_Similarity_and_Ontological_Reasoning https://www.researchgate.net/publication/362606078_Themis_Computer-Aided_Cybercrime_Case_Classification_using_Cosine_Similarity_and_Ontological_Reasoning Evaluation and Enhancement of the Actionability of Publicly Available Cyber Threat Information in Digital Forensics Published by IEEE Tue, 06 Jul 2021 00:00:00 +0000 https://ieeexplore.ieee.org/document/9527934/ https://ieeexplore.ieee.org/document/9527934/ Evaluation and Classification of Cyber Threat Intelligence Sources (Greek) Published by University of Macedonia Tue, 01 Jun 2021 00:00:00 +0000 https://www.researchgate.net/publication/351984537_Evaluation_and_Classification_of_Cyber_Threat_Intelligence_Sources_Greek https://www.researchgate.net/publication/351984537_Evaluation_and_Classification_of_Cyber_Threat_Intelligence_Sources_Greek