Matthieu Faou

Matthieu Faou

Senior Malware Researcher


Education: Ingénieur civil at Mines Nancy / M. Sc. in Computer Engineering at Polytechnique Montréal

Position and history at ESET: I joined ESET in august 2016 as a Malware Researcher.

Favorite activities: Running, cycling, skiing.

What is your golden rule for cyberspace? Use your critical mindset.


25 articles by Matthieu Faou

Gamaredon X Turla collab

Gamaredon X Turla collab

Gamaredon X Turla collab

Notorious APT group Turla collaborates with Gamaredon, both FSB-associated groups, to compromise high‑profile targets in Ukraine

Matthieu Faou and Zoltán Rusnák • 19 Sep 2025 • 13 min. read


Operation RoundPress

Operation RoundPress

Operation RoundPress

ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities

Matthieu Faou • 15 May 2025 • 18 min. read


Operation FishMedley

Operation FishMedley

Operation FishMedley

ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON

Matthieu Faou • 20 Mar 2025 • 10 min. read


Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

A mix of PSYOPs, espionage and … fake Canadian pharmacies!

Matthieu Faou • 21 Feb 2024 • 11 min. read


Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible

Matthieu Faou • 25 Oct 2023 • 4 min. read


MoustachedBouncer: Espionage against foreign diplomats in Belarus

MoustachedBouncer: Espionage against foreign diplomats in Belarus

MoustachedBouncer: Espionage against foreign diplomats in Belarus

Long-term espionage against diplomats, leveraging email-based C&C protocols, C++ modular backdoors, and adversary-in-the-middle (AitM) attacks… Sounds like the infamous Turla? Think again!

Matthieu Faou • 10 Aug 2023 • 22 min. read


Asylum Ambuscade: crimeware or cyberespionage?

Asylum Ambuscade: crimeware or cyberespionage?

Asylum Ambuscade: crimeware or cyberespionage?

A curious case of a threat actor at the border between crimeware and cyberespionage

Matthieu Faou • 08 Jun 2023 • 9 min. read


A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

ESET researchers reveal a detailed profile of TA410: we believe this cyberespionage umbrella group consists of three different teams using different toolsets, including a new version of the FlowCloud espionage backdoor discovered by ESET.

Alexandre Côté Cyr and Matthieu Faou • 27 Apr 2022 • 33 min. read


Strategic web compromises in the Middle East with a pinch of Candiru

Strategic web compromises in the Middle East with a pinch of Candiru

Strategic web compromises in the Middle East with a pinch of Candiru

ESET researchers have discovered strategic web compromise (aka watering hole) attacks against high-profile websites in the Middle East

Matthieu Faou • 16 Nov 2021 • 11 min. read