Matthieu Faou

Matthieu Faou

Senior Malware Researcher


Education: Ingénieur civil at Mines Nancy / M. Sc. in Computer Engineering at Polytechnique Montréal

Position and history at ESET: I joined ESET in august 2016 as a Malware Researcher.

Favorite activities: Running, cycling, skiing.

What is your golden rule for cyberspace? Use your critical mindset.


25 articles by Matthieu Faou

Gamaredon X Turla collab

Gamaredon X Turla collab

Gamaredon X Turla collab

Notorious APT group Turla collaborates with Gamaredon, both FSB-associated groups, to compromise high‑profile targets in Ukraine

Matthieu Faou and Zoltán Rusnák19 Sep 202513 min. read


Operation RoundPress

Operation RoundPress

Operation RoundPress

ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities

Matthieu Faou15 May 202518 min. read


Operation FishMedley

Operation FishMedley

Operation FishMedley

ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON

Matthieu Faou20 Mar 202510 min. read


Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

A mix of PSYOPs, espionage and … fake Canadian pharmacies!

Matthieu Faou21 Feb 202411 min. read


Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible

Matthieu Faou25 Oct 20234 min. read


MoustachedBouncer: Espionage against foreign diplomats in Belarus

MoustachedBouncer: Espionage against foreign diplomats in Belarus

MoustachedBouncer: Espionage against foreign diplomats in Belarus

Long-term espionage against diplomats, leveraging email-based C&C protocols, C++ modular backdoors, and adversary-in-the-middle (AitM) attacks… Sounds like the infamous Turla? Think again!

Matthieu Faou10 Aug 202322 min. read


Asylum Ambuscade: crimeware or cyberespionage?

Asylum Ambuscade: crimeware or cyberespionage?

Asylum Ambuscade: crimeware or cyberespionage?

A curious case of a threat actor at the border between crimeware and cyberespionage

Matthieu Faou08 Jun 20239 min. read


A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

ESET researchers reveal a detailed profile of TA410: we believe this cyberespionage umbrella group consists of three different teams using different toolsets, including a new version of the FlowCloud espionage backdoor discovered by ESET.

Alexandre Côté Cyr and Matthieu Faou27 Apr 202233 min. read


Strategic web compromises in the Middle East with a pinch of Candiru

Strategic web compromises in the Middle East with a pinch of Candiru

Strategic web compromises in the Middle East with a pinch of Candiru

ESET researchers have discovered strategic web compromise (aka watering hole) attacks against high-profile websites in the Middle East

Matthieu Faou16 Nov 202111 min. read