Trend Micro Research : Research

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

Trend Micro Research : APT & Targeted Attacks, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Latest News, Trend Micro Research : Research /

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities 2026-03-26 at 06:26 By This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities Read More »

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Malware, Trend Micro Research : Phishing, Trend Micro Research : Research /

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries 2026-03-20 at 10:22 By We look into a stealthy multi‑stage attack campaign that delivers PureLog Stealer entirely in memory using encrypted, fileless techniques. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries Read More »

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Crime, Trend Micro Research : Endpoints, Trend Micro Research : Expert Perspective, Trend Micro Research : Investigations, Trend Micro Research : Research /

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA 2026-03-18 at 12:35 By Not every cloud breach starts with malware or a zero-day. In this incident, attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, then used the OAuth2 Resource Owner Password Credentials (ROPC) flow to

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA Read More »

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Latest News, Trend Micro Research : Ransomware, Trend Micro Research : Research /

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack 2026-03-16 at 15:10 By Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver. This article is an excerpt from Trend Micro Research,

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack Read More »

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Malware, Trend Micro Research : Research /

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages 2026-03-05 at 17:11 By The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. This article is an excerpt from Trend Micro Research, News and

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages Read More »

Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Latest News, Trend Micro Research : Phishing, Trend Micro Research : Research /

Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations 2026-03-04 at 21:05 By Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) proxying. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations Read More »

Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Artificial Intelligence (AI), Trend Micro Research : Research /

Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer 2026-02-23 at 02:00 By Malicious OpenClaw skills trick AI agents and users into installing a new AMOS variant that steals extensive data at scale. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer Read More »

Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate Entities

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Research, Trend Micro Research : Spam /

Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate Entities 2026-02-17 at 02:00 By We uncover how a campaign used Atlassian Jira Cloud to launch automated and targeted spam campaigns, exploiting trusted SaaS workflows to bypass security controls. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate Entities Read More »

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

Trend Micro Research : APT & Targeted Attacks, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Research /

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups 2026-01-26 at 17:42 By PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities. This article is an excerpt from Trend Micro Research,

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups Read More »

Watering Hole Attack Targets EmEditor Users with Information-Stealing Malware

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Risk, Trend Micro Research : Cyber Threats, Trend Micro Research : Research /

Watering Hole Attack Targets EmEditor Users with Information-Stealing Malware 2026-01-22 at 16:31 By TrendAI™ Research provides a technical analysis of a compromised EmEditor installer used to deliver multistage malware that performs a range of malicious actions. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

Watering Hole Attack Targets EmEditor Users with Information-Stealing Malware Read More »

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Malware, Trend Micro Research : Research /

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers 2026-01-19 at 13:40 By This blog entry provides an in-depth analysis of the multistage delivery of the Evelyn information stealer, which was used in a campaign targeting software developers. This article is an excerpt from Trend Micro Research, News and

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers Read More »

Your 100 Billion Parameter Behemoth is a Liability

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Artificial Intelligence (AI), Trend Micro Research : Data center, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Research /

Your 100 Billion Parameter Behemoth is a Liability 2026-01-17 at 18:04 By The “bigger is better” era of AI is hitting a wall. We are in an LLM bubble, characterized by ruinous inference costs and diminishing returns. The future belongs to Agentic AI powered by specialized Small Language Models (SLMs). Think of it as a

Your 100 Billion Parameter Behemoth is a Liability Read More »

Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™

Trend Micro Research : APT & Targeted Attacks, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cyber Threats, Trend Micro Research : Research /

Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™ 2026-01-13 at 11:05 By This blog discusses notable modern TTPs observed from SHADOW-AETHER-015 and Earth Preta, from Trend Research™ monitoring and Trend Vision One™ intelligence. These findings support the performance of TrendAI™ in the 2025 MITRE ATT&CK Evaluations.

Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™ Read More »

Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Malware, Trend Micro Research : Phishing, Trend Micro Research : Research /

Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response 2026-01-12 at 13:43 By Threat actors exploited Cloudflare’s free-tier infrastructure and legitimate Python environments to deploy the AsyncRAT remote access trojan, demonstrating advanced evasion techniques that abuse trusted cloud services for malicious operations. This article is an excerpt from Trend Micro Research, News and Perspectives

Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response Read More »

SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Latest News, Trend Micro Research : Phishing, Trend Micro Research : Research /

SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics 2025-12-12 at 01:12 By In November, a targeted spear-phishing campaign was observed using Trend Micro-themed lures against various industries, but this was quickly detected and thwarted by the Trend Vision One™ platform. This article is an excerpt from Trend Micro Research, News and Perspectives View Original Source

SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics Read More »

CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Latest News, Trend Micro Research : Research /

CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation 2025-12-10 at 08:53 By CVE-2025-55182 is a CVSS 10.0 pre-authentication RCE affecting React Server Components. Amid the flood of fake Proof-of-concept exploits, scanners, exploits, and widespread misconceptions, this technical analysis intends to cut through the noise. This article is an excerpt from Trend Micro Research, News and

CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation Read More »

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Latest News, Trend Micro Research : Research /

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows 2025-12-08 at 13:58 By In this blog entry, Trend™ Research provides a comprehensive breakdown of GhostPenguin, a previously undocumented Linux backdoor with low detection rates that was discovered through AI-powered threat hunting and in-depth malware analysis. This article is an excerpt from Trend Micro Research, News

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows Read More »

Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Research /

Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know 2025-12-06 at 17:06 By CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution vulnerability affecting React Server Components used in React.js, Next.js, and related frameworks (see the context section for a more exhaustive list of affected frameworks). This article is an excerpt

Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know Read More »

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Latest News, Trend Micro Research : Malware, Trend Micro Research : Research /

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading 2025-12-03 at 23:11 By Job seekers looking out for opportunities might instead find their personal devices compromised, as a ValleyRAT campaign propagated through email leverages Foxit PDF Reader for concealment and DLL side-loading for initial entry. This article is an excerpt from Trend

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading Read More »

Unraveling Water Saci’s New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp

Trend Micro Research : Articles, News, Reports, Trend Micro Research : Artificial Intelligence (AI), Trend Micro Research : Research /

Unraveling Water Saci’s New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp 2025-12-03 at 01:09 By Through AI-driven code conversion and a layered infection chain involving different file formats and scripting languages, the threat actors behind Water Saci are quickly upgrading their malware delivery and propagation methods across WhatsApp in Brazil. This article is an excerpt from

Unraveling Water Saci’s New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp Read More »

Scroll to Top