Water Makara Uses Obfuscated JavaScript in Spear Phishing Campaign, Targets Brazil With Astaroth Malware 2024-10-14 at 11:48 By Trend Micro researchers have uncovered a surge of malicious activities involving a threat actor group that we track as Water Makara. This group is targeting enterprises in Brazil, deploying banking malware using obfuscated JavaScript to slip past […]
Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions 2024-10-11 at 11:02 By Trend Micro’s investigation into the recent activity of Earth Simnavaz provides new insights into the APT group’s evolving tactics and the immediate threat it poses to critical sectors in the UAE. This article is an excerpt from Trend Micro Research, News
Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions Read More »
Rogue AI: What the Security Community is Missing 2024-10-03 at 11:46 By This is the fourth blog post in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Rogue AI: What the Security Community is Missing Read More »
MDR in Action: Preventing The More_eggs Backdoor From Hatching 2024-09-30 at 18:16 By Trend Micro MDR (Managed Detection and Response) team promptly mitigated a more_eggs infection. Using Vision One, MDR illustrated how Custom Filters/Models and Security Playbook can be used to automate the response to more_eggs and similar threats. This article is an excerpt from
MDR in Action: Preventing The More_eggs Backdoor From Hatching Read More »
Delivering Proactive Protection Against Critical Threats to NVIDIA-powered AI Systems 2024-09-27 at 18:16 By On Wednesday, NVIDA released updates to fix a critical vulnerability in its NVIDIA Container Toolkit, which, if exploited, could put a wide range of AI infrastructure and underlying data/secrets at risk. This article is an excerpt from Trend Micro Research, News
Delivering Proactive Protection Against Critical Threats to NVIDIA-powered AI Systems Read More »
Cybersecurity Compass: Bridging the Communication Gap 2024-09-27 at 05:16 By Discover how to use the Cybersecurity Compass to foster effective conversations about cybersecurity strategy between non-technical and technical audiences, focusing on the phases of before, during, and after a breach. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Cybersecurity Compass: Bridging the Communication Gap Read More »
How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus Protections 2024-09-20 at 18:31 By Trend Micro tracked this group as Water Bakunawa, behind the RansomHub ransomware, employs various anti-EDR techniques to play a high-stakes game of hide and seek with security solutions. This article is an excerpt from Trend Micro Research, News and Perspectives
How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus Protections Read More »
Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC 2024-09-19 at 11:47 By We observed Earth Baxia carrying out targeted attacks against APAC countries that involved advanced techniques like spear-phishing and customized malware, with data suggesting that the group operates from China. This article is an excerpt from Trend Micro Research, News and Perspectives
Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC Read More »
Vulnerabilities in Cellular Packet Cores Part IV: Authentication 2024-09-18 at 13:46 By Our research reveals two significant vulnerabilities in Microsoft Azure Private 5G Core (AP5GC). The first vulnerability (CVE-2024-20685) allows a crafted signaling message to crash the control plane, leading to potential service outages. The second (ZDI-CAN-23960) disconnects and replaces attached base stations, disrupting network
Vulnerabilities in Cellular Packet Cores Part IV: Authentication Read More »
Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities 2024-09-12 at 12:46 By In this blog entry, we provide an analysis of the recent remote code execution attacks related to Progress Software’s WhatsUp Gold that possibly abused the vulnerabilities CVE-2024-6670 and CVE-2024-6671. This article is an excerpt from Trend Micro Research, News and Perspectives View Original
Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities Read More »
Earth Preta Evolves its Attacks with New Malware and Strategies 2024-09-09 at 10:48 By In this blog entry, we discuss our analysis of Earth Preta’s enhancements in their attacks by introducing new tools, malware variants and strategies to their worm-based attacks and their time-sensitive spear-phishing campaign. This article is an excerpt from Trend Micro Research,
Earth Preta Evolves its Attacks with New Malware and Strategies Read More »
TIDRONE Targets Military and Satellite Industries in Taiwan 2024-09-06 at 12:49 By Our research reveals that an unidentified threat cluster we named TIDRONE have shown significant interest in military-related industry chains, particularly in the manufacturers of drones. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
TIDRONE Targets Military and Satellite Industries in Taiwan Read More »
Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility Command 2024-09-05 at 12:46 By Notorious Mekotio and BBTok are having a resurgence targeting Latin American users. Mekotio’s latest variant suggests the gang behind it is broadening their target, while BBTok is seen abusing MSBuild.exe to evade detection. This article is an excerpt from Trend
Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility Command Read More »
Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion 2024-09-04 at 11:02 By While monitoring Earth Lusca, we discovered the threat group’s use of KTLVdoor, a highly obfuscated multiplatform backdoor, as part of a large-scale attack campaign. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion Read More »
How AI Goes Rogue 2024-09-04 at 01:46 By This is the second blog in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence 2024-08-30 at 12:16 By Trend Micro discovered that old Atlassian Confluence versions that were affected by CVE-2023-22527 are being exploited using a new in-memory fileless backdoor. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence Read More »
Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool 2024-08-29 at 12:16 By Threat actors are targeting users in the Middle East by distributing sophisticated malware disguised as the Palo Alto GlobalProtect tool. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool Read More »
Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem 2024-08-28 at 08:02 By A technical analysis on how CVE-2023-22527 can be exploited by malicious actors for cryptojacking attacks that can spread across the victim’s system. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem Read More »
Complete Guide to Protecting Seven Attack Vectors 2024-08-27 at 18:31 By The quicker a cyberattack is identified, the less it costs. Jon Clay, VP of Threat Intelligence, reviews seven key initial attack vectors and provides proactive security tips to help you reduce cyber risk across the attack surface. This article is an excerpt from Trend
Complete Guide to Protecting Seven Attack Vectors Read More »
How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2024-08-21 at 11:01 By Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source
How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack Read More »