Category: Trend Micro Research, News and Perspectives

IoT Botnet Linked to Large-scale DDoS Attacks Since the End of 2024

2025-01-17 10:01

Since the end of 2024, we have been continuously monitoring large-scale DDoS attacks orchestrated by an IoT botnet exploiting vulnerable IoT devices such as wireless routers and IP cameras. This article has been indexed from Trend Micro Research, News and…

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 23:01

This blog discusses a web shell intrusion incident where attackers abused the IIS worker to exfiltrate stolen data. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Investigating A Web Shell Intrusion With…

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 23:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 22:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 22:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 21:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 21:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 20:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 20:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 19:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 19:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 18:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 18:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 17:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 17:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 16:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 16:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 15:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 15:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 14:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 14:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 13:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 13:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 12:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 12:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 11:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 11:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 10:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 09:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 09:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 08:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 08:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 07:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 07:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 06:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 06:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 05:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 05:01

Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR

2025-01-15 04:01

How Cracks and Installers Bring Malware to Your Device

2025-01-10 08:01

Our research shows how attackers use platforms like YouTube to spread fake installers via trusted hosting services, employing encryption to evade detection and steal sensitive browser data. This article has been indexed from Trend Micro Research, News and Perspectives Read…

Information Stealer Masquerades as LDAPNightmare (CVE-2024-49113) PoC Exploit

2025-01-09 08:01

Our blog entry discusses a fake PoC exploit for LDAPNightmare (CVE-2024-49113) that is being used to distribute information-stealing malware. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Information Stealer Masquerades as LDAPNightmare…

Trend Micro Contributes and Maps Container Security to MITRE ATT&CK: A Game-Changer for Cyber Defense

2025-01-07 17:01

Trend Micro leads the way by mapping its Container Security detection capabilities to the MITRE ATT&CK framework for Containers and contributing real-world attack data. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article:…

What We Know About CVE-2024-49112 and CVE-2024-49113

2025-01-04 09:01

This blog entry provides an overview of CVE-2024-49112 and CVE-2024-49113 and includes information that IT and SOC professionals need to know to stay protected against possible exploitation. This article has been indexed from Trend Micro Research, News and Perspectives Read…

AI Pulse: Top AI Trends from 2024 – A Look Back

2025-01-03 21:01

In this edition of AI Pulse, let’s look back at top AI trends from 2024 in the rear view so we can more clearly predicts AI trends for 2025 and beyond. This article has been indexed from Trend Micro Research,…

Python-Based NodeStealer Version Targets Facebook Ads Manager

2024-12-19 09:12

In this blog entry, Trend Micro’s Managed XDR team discuss their investigation into how the latest variant of NodeStealer is delivered through spear-phishing attacks, potentially leading to malware execution, data theft, and the exfiltration of sensitive information via Telegram. This…

Link Trap: GenAI Prompt Injection Attack

2024-12-17 02:12

Prompt injection exploits vulnerabilities in generative AI to manipulate its behavior, even without extensive permissions. This attack can expose sensitive data, making awareness and preventive measures essential. Learn how it works and how to stay protected. This article has been…

Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion

2024-12-13 09:12

In this blog entry, we discuss a social engineering attack that tricked the victim into installing a remote access tool, triggering DarkGate malware activities and an attempted C&C connection. This article has been indexed from Trend Micro Research, News and…

INTERPOL & Trend’s Fight Against Cybercrime

2024-12-12 02:12

Trend threat intelligence and training were crucial to the success of two major policing operations in 2024 This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: INTERPOL & Trend’s Fight Against Cybercrime

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

2024-12-05 09:12

Trend Micro’s monitoring of the MOONSHINE exploit kit revealed how it’s used by the threat actor Earth Minotaur to exploit Android messaging app vulnerabilities and install the DarkNimbus backdoor for surveillance. This article has been indexed from Trend Micro Research,…

The Road to Agentic AI: Exposed Foundations

2024-12-04 16:12

Our research into Retrieval Augmented Generation (RAG) systems uncovered at least 80 unprotected servers. We highlight this problem, which can lead to potential data loss and unauthorized access. This article has been indexed from Trend Micro Research, News and Perspectives…

Gafgyt Malware Targeting Docker Remote API Servers

2024-12-03 11:12

Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its behavior. This article has been indexed from Trend Micro Research, News and…

Guess Who’s Back – The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024

2024-11-26 09:11

Trend Micro has identified a spear-phishing campaign active in Japan since June 2024. Evidence about the malware used by this campaign suggests this was part of a new operation by Earth Kasha. This article has been indexed from Trend Micro…

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

2024-11-25 09:11

Since 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations. This article has been indexed from Trend Micro Research, News and Perspectives Read…

Spot the Difference: Earth Kasha’s New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

2024-11-19 10:11

LODEINFO is a malware used in attacks targeting mainly Japan since 2019. Trend Micro has been tracking the group as Earth Kasha. We have identified a new campaign connected to this group with significant updates to their strategy, tactics, and…

Inside Water Barghest’s Rapid Exploit-to-Market Strategy for IoT Devices

2024-11-18 10:11

In this blog entry, we discuss Water Barghest’s exploitation of IoT devices, transforming them into profitable assets through advanced automation and monetization techniques. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Inside…

5 AI Security Takeaways featuring Forrester

2024-11-14 00:11

Highlights from the recent discussion between Trend Micro’s David Roth, CRO Enterprise America, and guest speaker Jeff Pollard, VP, Principal Analyst, Forrester about AI hype versus reality and how to secure AI in the workplace. This article has been indexed…

Trend Micro and Japanese Partners Reveal Hidden Connections Among SEO Malware Operations

2024-11-11 10:11

Trend Micro researchers, in collaboration with Japanese authorities, analyzed links between SEO malware families used in SEO poisoning attacks that lead users to fake shopping sites. This article has been indexed from Trend Micro Research, News and Perspectives Read the…

Breaking Down Earth Estries’ Persistent TTPs in Prolonged Cyber Operations

2024-11-08 11:11

Discover how Earth Estries employs a diverse set of tactics, techniques, and tools, including malware such as Zingdoor and Snappybee, for its campaigns. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Breaking…

SOC Around the Clock: World Tour Survey Findings

2024-11-05 04:11

Trend surveyed 750 cybersecurity professionals in 49 countries to learn more about the state of cybersecurity, from job pressures to the need for more advanced tools. Explore what SOC teams had to say. This article has been indexed from Trend…

AI Pulse: Election Deepfakes, Disasters, Scams & more

2024-10-31 21:10

In the final weeks before November’s U.S. election, cybersecurity experts were calling October 2024 the “month of mischief”—a magnet for bad actors looking to disrupt the democratic process through AI-generated misinformation. This issue of AI Pulse looks at what can…

Attacker Abuses Victim Resources to Reap Rewards from Titan Network

2024-10-30 09:10

In this blog entry, we discuss how an attacker took advantage of the Atlassian Confluence vulnerability CVE-2023-22527 to connect servers to the Titan Network for cryptomining purposes. This article has been indexed from Trend Micro Research, News and Perspectives Read…

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

2024-10-24 10:10

While cyberattacks that employ web shells and VPN compromise are not particularly novel, they are still prevalent. The recent incidents that Trend Micro MXDR analyzed highlight the importance of behavioral analysis and anomaly detection in security measures. This article has…

Unmasking Prometei: A Deep Dive Into Our MXDR Findings

2024-10-23 17:10

How does Prometei insidiously operate in a compromised system? This Managed Extended Detection and Response investigation conducted with the help of Trend Vision One provides a comprehensive analysis of the inner workings of this botnet so users can stop the…

Unmasking Prometei: A Deep Dive Into Our MXDR Findings

2024-10-23 17:10

Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

2024-10-22 11:10

In this blog entry, we discuss how malicious actors are exploiting Docker remote API servers via gRPC/h2c to deploy the cryptominer SRBMiner to facilitate their mining of XRP on Docker hosts. This article has been indexed from Trend Micro Research,…

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

2024-10-21 16:10

We observed an unknown threat actor abusing exposed Docker remote API servers to deploy the perfctl malware. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Attackers Target Exposed Docker Remote API Servers…

Gartner 2024 CNAPP Market Guide Insights for Leaders

2024-10-18 18:10

As businesses increasingly pivot to cloud-native applications, the landscape of cybersecurity becomes ever more challenging. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Gartner 2024 CNAPP Market Guide Insights for Leaders

5 AI Security Takeaways featuring Forrester

2024-10-17 21:10

How to Mitigate the Impact of Rogue AI Risks

2024-10-17 21:10

This is the latest blog in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: How to…

Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data

2024-10-16 13:10

This article uncovers a Golang ransomware abusing AWS S3 for data theft, and masking as LockBit to further pressure victims. The discovery of hard-coded AWS credentials in these samples led to AWS account suspensions. This article has been indexed from…

Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions

2024-10-15 09:10

Trend Micro’s Threat Hunting Team discovered EDRSilencer, a red team tool that threat actors are attempting to abuse for its ability to block EDR traffic and conceal malicious activity. This article has been indexed from Trend Micro Research, News and…

Water Makara Uses Obfuscated JavaScript in Spear Phishing Campaign, Targets Brazil With Astaroth Malware

2024-10-14 10:10

Trend Micro researchers have uncovered a surge of malicious activities involving a threat actor group that we track as Water Makara. This group is targeting enterprises in Brazil, deploying banking malware using obfuscated JavaScript to slip past security defenses. This…

Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions

2024-10-11 09:10

Trend Micro’s investigation into the recent activity of Earth Simnavaz provides new insights into the APT group’s evolving tactics and the immediate threat it poses to critical sectors in the UAE. This article has been indexed from Trend Micro Research,…

Harnessing AI for Enhanced Security

2024-10-08 22:10

A deep-dive into how AI-driven solutions from Trend Micro leveraging the NVIDIA AI Enterprise software platform are elevating security across critical industries This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Harnessing AI…

Rogue AI: What the Security Community is Missing

2024-10-03 09:10

This is the fourth blog post in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Rogue…

MDR in Action: Preventing The More_eggs Backdoor From Hatching

2024-09-30 16:09

Trend Micro MDR (Managed Detection and Response) team promptly mitigated a more_eggs infection. Using Vision One, MDR illustrated how Custom Filters/Models and Security Playbook can be used to automate the response to more_eggs and similar threats. This article has been…

Delivering Proactive Protection Against Critical Threats to NVIDIA-powered AI Systems

2024-09-27 16:09

On Wednesday, NVIDA released updates to fix a critical vulnerability in its NVIDIA Container Toolkit, which, if exploited, could put a wide range of AI infrastructure and underlying data/secrets at risk. This article has been indexed from Trend Micro Research,…

Cybersecurity Compass: Bridging the Communication Gap

2024-09-27 03:09

Discover how to use the Cybersecurity Compass to foster effective conversations about cybersecurity strategy between non-technical and technical audiences, focusing on the phases of before, during, and after a breach. This article has been indexed from Trend Micro Research, News…

How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus Protections

2024-09-20 16:09

Trend Micro tracked this group as Water Bakunawa, behind the RansomHub ransomware, employs various anti-EDR techniques to play a high-stakes game of hide and seek with security solutions. This article has been indexed from Trend Micro Research, News and Perspectives…

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

2024-09-19 10:09

We observed Earth Baxia carrying out targeted attacks against APAC countries that involved advanced techniques like spear-phishing and customized malware, with data suggesting that the group operates from China. This article has been indexed from Trend Micro Research, News and…

Vulnerabilities in Cellular Packet Cores Part IV: Authentication

2024-09-18 12:09

Our research reveals two significant vulnerabilities in Microsoft Azure Private 5G Core (AP5GC). The first vulnerability (CVE-2024-20685) allows a crafted signaling message to crash the control plane, leading to potential service outages. The second (ZDI-CAN-23960) disconnects and replaces attached base…

Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities

2024-09-12 11:09

In this blog entry, we provide an analysis of the recent remote code execution attacks related to Progress Software’s WhatsUp Gold that possibly abused the vulnerabilities CVE-2024-6670 and CVE-2024-6671. This article has been indexed from Trend Micro Research, News and…

Earth Preta Evolves its Attacks with New Malware and Strategies

2024-09-09 10:09

In this blog entry, we discuss our analysis of Earth Preta’s enhancements in their attacks by introducing new tools, malware variants and strategies to their worm-based attacks and their time-sensitive spear-phishing campaign. This article has been indexed from Trend Micro…

TIDRONE Targets Military and Satellite Industries in Taiwan

2024-09-06 11:09

Our research reveals that an unidentified threat cluster we named TIDRONE have shown significant interest in military-related industry chains, particularly in the manufacturers of drones. This article has been indexed from Trend Micro Research, News and Perspectives Read the original…

Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility Command

2024-09-05 11:09

Notorious Mekotio and BBTok are having a resurgence targeting Latin American users. Mekotio’s latest variant suggests the gang behind it is broadening their target, while BBTok is seen abusing MSBuild.exe to evade detection. This article has been indexed from Trend…

Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

2024-09-04 09:09

While monitoring Earth Lusca, we discovered the threat group’s use of KTLVdoor, a highly obfuscated multiplatform backdoor, as part of a large-scale attack campaign. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article:…

How AI Goes Rogue

2024-09-04 00:09

This is the second blog in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: How AI…

Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence

2024-08-30 10:08

Trend Micro discovered that old Atlassian Confluence versions that were affected by CVE-2023-22527 are being exploited using a new in-memory fileless backdoor. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Silent Intrusions:…

Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool

2024-08-29 10:08

Threat actors are targeting users in the Middle East by distributing sophisticated malware disguised as the Palo Alto GlobalProtect tool. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Threat Actors Target the…

Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem

2024-08-28 06:08

A technical analysis on how CVE-2023-22527 can be exploited by malicious actors for cryptojacking attacks that can spread across the victim’s system. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Cryptojacking via…

Complete Guide to Protecting Seven Attack Vectors

2024-08-27 16:08

The quicker a cyberattack is identified, the less it costs. Jon Clay, VP of Threat Intelligence, reviews seven key initial attack vectors and provides proactive security tips to help you reduce cyber risk across the attack surface. This article has…

How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack

2024-08-21 23:08

Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: How Trend…

Rogue AI is the Future of Cyber Threats

2024-08-15 14:08

This is the first blog in a series on Rogue AI. Later articles will include technical guidance, case studies and more. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Rogue AI is…

A Dive into Earth Baku’s Latest Campaign

2024-08-09 05:08

Since late 2022, Earth Baku has broadened its scope from the Indo-Pacific region to Europe, the Middle East, and Africa. Their latest operations demonstrate sophisticated techniques, such as exploiting public-facing applications like IIS servers for initial access and deploying the…

Bringing Security Back into Balance

2024-08-04 07:08

This article by Trend Micro CEO Eva Chen brings focus back to striking the cybersecurity strategies balance between business C-suite and information technology (IT) departments. This article has been indexed from Trend Micro Research, News and Perspectives Read the original…

Cybersecurity Compass: An Integrated Cyber Defense Strategy

2024-08-02 20:08

Explore how the Cybersecurity Compass can guide various security professionals’ and stakeholders’ decision-making before, during, and after a breach. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: Cybersecurity Compass: An Integrated Cyber…

Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft

2024-08-01 10:08

We uncovered a malvertising campaign where the threat actor hijacks social media pages, renames them to mimic popular AI photo editors, then posts malicious links to fake websites. This article has been indexed from Trend Micro Research, News and Perspectives…

AI Pulse: Brazil Gets Bold with Meta, Interpol’s Red Flag & more

2024-07-30 20:07

The second edition of AI Pulse is all about AI regulation: what’s coming, why it matters, and what might happen without it. We look at Brazil’s hard não to Meta, how communities are pushing back against AI training data use,…

AI-Powered Deepfake Tools Becoming More Accessible Than Ever

2024-07-30 20:07

Trend Micro research uncovers new cybercrime tools posing increased threats to security, highlighting the rapid evolution of AI-powered hacking services and their potential for mass exploitation This article has been indexed from Trend Micro Research, News and Perspectives Read the…

How to Write a Generative AI Cybersecurity Policy

2024-07-29 11:07

It’s clear that generative AI is a permanent addition to the enterprise IT toolbox. For CISOs, the pressure is on to roll out AI security policies and technologies that can mitigate very real and present risks. This article has been…

Page 1 of 4

1 2 3 4 »