Alexis Dorais-Joncas

Alexis Dorais-Joncas

Security Intelligence Team Lead


Education: M. Sc., Electrical Engineering

Highlights of your career? VP engineering @ tech startup Kryptiva Malware Researcher @ ESET Security Intelligence Team Lead @ ESET

Position and history at ESET? Joined ESET as a Malware Researcher in 2010 Co-started ESET Canada office in Montreal in 2011 Currently holding a Security Intelligence Team Lead position in Montreal.

What malware do you hate the most? Festi

Favorite activities? Camping and home improvement projects.

What is your golden rule for cyberspace? Use multiple layers of protection: A-V, hardened browsers & OS, etc.

When did you get your first computer and what kind was it? In 1996, my parents got the family a Pentium 1 @133 Mhz and 16 Mb RAM. 6 months later we even installed a 9600 modem to connect to the Internet.

Favorite computer game/activity? Freecell is awesome.


10 articles by Alexis Dorais-Joncas

Jumping the air gap: 15 years of nation-state effort

Jumping the air gap: 15 years of nation-state effort

Jumping the air gap: 15 years of nation-state effort

ESET researchers studied all the malicious frameworks ever reported publicly that have been used to attack air-gapped networks and are releasing a side-by-side comparison of their most important TTPs

Alexis Dorais-Joncas and Facundo Muñoz • 01 Dec 2021 • 11 min. read


Trends 2018: Doing time for cybercrime

Trends 2018: Doing time for cybercrime

Trends 2018: Doing time for cybercrime

Law enforcement and malware research join forces to take down cybercriminals

Alexis Dorais-Joncas • 12 Jul 2018 • 6 min. read


Syndicasec in the sin bin: targeted espionage malware in action

Syndicasec in the sin bin: targeted espionage malware in action

Syndicasec in the sin bin: targeted espionage malware in action

Technical analysis of Win32/Syndicasec.A, malware active in Nepal and China as far back as 2010, with a JavaScript payload registered in the Windows WMI subsystem and a system of fake blogs to discover its C&C servers, hosted on Tibet-related domains.

Alexis Dorais-Joncas • 23 May 2013 • 12 min. read


Win32/Kelihos botnet keeps on phishing, now exploiting Boston bombing

Win32/Kelihos botnet keeps on phishing, now exploiting Boston bombing

Win32/Kelihos botnet keeps on phishing, now exploiting Boston bombing

The botnet known as Win32/Kelihos keeps on infecting, now touting a YouTube video of the Boston Marathon bombing that comes with a malicious iframe pointing to a Redkit exploit page that infects viewers.

Alexis Dorais-Joncas • 17 Apr 2013 • 2 min. read


Malware evolving to defeat anti-DDoS services like CloudFlare?

Malware evolving to defeat anti-DDoS services like CloudFlare?

Malware evolving to defeat anti-DDoS services like CloudFlare?

Alexis Dorais-Joncas • 13 Feb 2013 • 4 min. read


Walking through Win32/Jabberbot.A instant messaging C&C

Walking through Win32/Jabberbot.A instant messaging C&C

Walking through Win32/Jabberbot.A instant messaging C&C

Malware authors have a solid track record in regards to creative Command and Control protocols. We've seen peer-to-peer protocols, some custom (Sality), some standard (Win32/Storm uses the eDonkey P2P protocol).

Alexis Dorais-Joncas • 30 Jan 2013 • 5 min. read


Walking through Win32/Jabberbot.A

Walking through Win32/Jabberbot.A

Walking through Win32/Jabberbot.A

Alexis Dorais-Joncas • 23 Jan 2013 • 5 min. read


OS X Lamadai: Flashback isn't the only Mac malware threat

OS X Lamadai: Flashback isn't the only Mac malware threat

OS X Lamadai: Flashback isn't the only Mac malware threat

Alexis Dorais-Joncas • 25 Apr 2012 • 4 min. read


OSX/Lamadai.A: The Mac Payload

OSX/Lamadai.A: The Mac Payload

OSX/Lamadai.A: The Mac Payload

Alexis Dorais-Joncas • 28 Mar 2012 • 4 min. read