Malware and electronic fraud analysis
When something has already happened, the first thing you need is an accurate account of what it was. We analyse suspicious files, phishing campaigns and network traffic, and tell you what the attacker did, what they reached, and what to do about it.
What we analyse
The service is as useful for a single suspicious file as it is for a full incident — including cases of suspected fraud, account compromise, suspicious email, spoofed websites or data theft.
Suspicious files and malware detection
We examine the file’s behaviour, its indicators of compromise and its effect on the system, in order to establish the level of risk and the measures required.
- viruses
- trojans
- ransomware
- spyware
- backdoors
- malicious scripts
Security incident investigation
We establish the source of the incident, the attack method, the compromise vector, the impact on systems and data, and the measures needed to contain it and prevent recurrence — the work that matters most for organisations hit by suspicious activity, unauthorised access or account compromise.
Network traffic analysis
Traffic shows whether an attack is in progress or a compromise has already occurred.
- suspicious communications
- anomalous connections
- unauthorised data transfers
- signs of infection
- command and control activity
Phishing and business email compromise
We analyse messages, emails and suspicious sites to identify phishing, spear phishing and online fraud attempts.
- message structure
- links and domains
- attachments
- social engineering elements
- risk of data compromise
Electronic fraud analysis
Identifying and understanding the mechanisms used in banking fraud, fraud through compromised online accounts, email fraud, impersonation, identity takeover attempts, and fraudulent payment and investment schemes.
How it runs
If an incident is in progress, say so in the first line and we will prioritise it.
Intake
What was seen, when, which systems are affected and what evidence still exists.
Preservation
Collecting and preserving evidence before it is overwritten.
Analysis
Files, traffic, messages, logs — establishing the vector and the impact.
Report
Indicators of compromise, incident timeline, remediation sequence.
Prevention
The measures that stop the same scenario from repeating.
Opportunistic or targeted
One of the most useful outputs of the analysis is establishing whether the incident was part of an opportunistic, broad campaign or a targeted attack. The two require different responses.
An incident that is never properly analysed tends to repeat. Establishing the entry point, the persistence mechanism and the data actually touched is also what allows you to meet reporting obligations accurately — under NIS2, a notification based on guesswork is a problem of its own.
- Broad campaign
- Aimed at a large number of users with no particular victim selected: mass phishing, large-scale malware distribution, automated attacks on exposed services, repeated unauthorised access attempts. The goal is volume, not the target.
- Targeted attack
- Planned against a specific organisation after the attacker has studied the target, its behaviour and its technology: tailored spear phishing, selective account compromise, adapted tooling, advanced social engineering, quiet operations designed to avoid detection.
- Why it matters
- Targeted attacks are harder to detect and pursue specific objectives — theft of sensitive data, disruption of operations, or persistent access to the infrastructure. The right response depends on which of the two it was.
When to ask for this
- You received a suspicious file
- You suspect a malware infection
- You received a phishing email
- You see unusual activity on the network
- There are signs an account was compromised
- A possible electronic fraud has occurred
- You need the nature of an incident clarified
- You have to notify the authority and need facts, not assumptions
Resources and related services
What do I do now?
Emergency guide for victims of cybercrime: the essential steps to limit the damage and protect your data.
Handling an incident
What you do in the first minutes decides whether the evidence is recoverable or gone for good.
Frequently asked questions
01What do I do in the first minutes?
Do not delete, reinstall or “clean” the system. Isolate it from the network but leave it powered on if possible, and write down the time and what you observed. Most evidence is lost not to the attacker but to well-intentioned intervention in the first minutes.
02Can you analyse just one file or one email?
Yes. A single suspicious file or phishing message can be submitted on its own, without a broader engagement. The output is a risk assessment and, where relevant, the indicators of compromise you can then search for across the rest of your infrastructure.
03Does the analysis help with notifying the authority?
Yes. Findings are written in a form that supports notification to the competent authority: what happened, when, which systems and data were affected, and what was done about it. A notification built on assumptions creates a problem separate from the incident itself.
04What do I receive at the end?
A written analysis with the indicators of compromise identified, the incident timeline as far as the evidence supports it, and a remediation sequence — what to do first, what follows, and which measures prevent a repeat.
Describe what you are seeing. If an incident is in progress, say so in the first line.
Live incidents are prioritised. The initial conversation, to establish urgency and the immediate steps, costs nothing.
- Phone
- +40 763 204 739
- [email protected]
- Response time
- One working day at most