Trend Micro Research : Endpoints

Play Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma

Play Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma 2024-07-19 at 10:31 By Trend Micro threat hunters discovered that the Play ransomware group has been deploying a new Linux variant that targets ESXi environments. Read our blog entry to know more. This article is an excerpt from Trend Micro Research, News […]

Play Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma Read More »

Why You Need Network Detection & Response Now

Why You Need Network Detection & Response Now 2024-07-09 at 21:26 By Cybersecurity teams are well-equipped to handle threats to technology assets that they manage. But with unmanaged devices providing ideal spots for attackers to lurk unseen, network detection and response capabilities have become vitally important. This article is an excerpt from Trend Micro Research,

Why You Need Network Detection & Response Now Read More »

Turning Jenkins Into a Cryptomining Machine From an Attacker’s Perspective

Turning Jenkins Into a Cryptomining Machine From an Attacker’s Perspective 2024-07-05 at 12:02 By In this blog entry, we will discuss how the Jenkins Script Console can be weaponized by attackers for cryptomining activity if not configured properly. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Turning Jenkins Into a Cryptomining Machine From an Attacker’s Perspective Read More »

Mekotio Banking Trojan Threatens Financial Systems in Latin America

Mekotio Banking Trojan Threatens Financial Systems in Latin America 2024-07-04 at 12:16 By We’ve recently seen a surge in attacks involving the Mekotio banking trojan. In this blog entry, we’ll provide an overview of the trojan and what it does. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Mekotio Banking Trojan Threatens Financial Systems in Latin America Read More »

Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework

Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework 2024-06-19 at 10:17 By We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files

Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework Read More »

Noodle RAT: Reviewing the New Backdoor Used by Chinese-Speaking Groups

Noodle RAT: Reviewing the New Backdoor Used by Chinese-Speaking Groups 2024-06-11 at 11:46 By This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime. This article is an excerpt from Trend Micro Research, News and Perspectives View

Noodle RAT: Reviewing the New Backdoor Used by Chinese-Speaking Groups Read More »

It’s Time to Up-Level Your EDR Solution

It’s Time to Up-Level Your EDR Solution 2024-06-03 at 18:01 By You may have EDR, but did you know you can add threat detection and response to improve a SecOps team’s efficiency and outcomes – read more. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

It’s Time to Up-Level Your EDR Solution Read More »

Decoding Water Sigbin’s Latest Obfuscation Tricks

Decoding Water Sigbin’s Latest Obfuscation Tricks 2024-05-30 at 08:09 By Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against. This article is an excerpt

Decoding Water Sigbin’s Latest Obfuscation Tricks Read More »

Cybersecurity Decluttered: A Journey to Consolidation

Cybersecurity Decluttered: A Journey to Consolidation 2024-04-12 at 20:46 By Learn how far cybersecurity has come from scattered resources to consolidation the future. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Cybersecurity Decluttered: A Journey to Consolidation Read More »

Earth Freybug Uses UNAPIMON for Unhooking Critical APIs

Earth Freybug Uses UNAPIMON for Unhooking Critical APIs 2024-04-02 at 09:01 By This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library (DLL) hijacking and application programming interface (API) unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed UNAPIMON. This article is

Earth Freybug Uses UNAPIMON for Unhooking Critical APIs Read More »

Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script

Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script 2024-03-26 at 10:31 By This blog entry discusses the Agenda ransomware group’s use of its latest Rust variant to propagate to VMWare vCenter and ESXi servers. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script Read More »

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks 2024-03-18 at 12:02 By Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa. This article is an excerpt from Trend Micro Research, News and

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks Read More »

AI Auctions: Collectibles, Taylor Swift, Jordan Bots

AI Auctions: Collectibles, Taylor Swift, Jordan Bots 2024-03-06 at 06:48 By Discover the fascinating world of AI, ML, and RPA and their real-world applications including the creation of a custom RPA bot for collecting rare sports memorabilia. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

AI Auctions: Collectibles, Taylor Swift, Jordan Bots Read More »

Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO

Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO 2024-03-04 at 11:05 By The Trend Micro threat hunting team came across an RA World attack involving multistage components designed to ensure maximum impact. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO Read More »

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections 2024-02-26 at 08:42 By During our monitoring of Earth Lusca, we noticed a new campaign that used Chinese-Taiwanese relations as a social engineering lure to infect selected targets. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections Read More »

LockBit Attempts to Stay Afloat With a New Version

LockBit Attempts to Stay Afloat With a New Version 2024-02-22 at 10:02 By This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations. This article is an excerpt

LockBit Attempts to Stay Afloat With a New Version Read More »

Earth Preta Campaign Uses DOPLUGS to Target Asia

Earth Preta Campaign Uses DOPLUGS to Target Asia 2024-02-20 at 11:55 By In this blog entry, we focus on Earth Preta’s campaign that employed a variant of the DOPLUGS malware to target Asian countries. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Earth Preta Campaign Uses DOPLUGS to Target Asia Read More »

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day 2024-02-13 at 22:16 By The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day Read More »

What Generative AI Means for Cybersecurity in 2024

What Generative AI Means for Cybersecurity in 2024 2024-02-08 at 19:00 By After a full year of life with ChatGPT cybersecurity experts have a clearer sense of how criminals are using generative AI to enhance attacks – learn what generative AI means for cybersecurity in 2024. This article is an excerpt from Trend Micro Research,

What Generative AI Means for Cybersecurity in 2024 Read More »

Unifying Cloud Security Beyond Siloes

Unifying Cloud Security Beyond Siloes 2024-02-06 at 20:32 By Attacks don’t stay in siloes, and neither should your security solutions. Explore the benefits of a cybersecurity platform that consolidates security across multiple layers—including the cloud—for more proactive risk management. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Unifying Cloud Security Beyond Siloes Read More »

Scroll to Top