PossibleThreat Articles

Articles for the experts…

trend micro research : apt & targeted attacks

Security TrendMicro 

Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework

0 Comments , , , ,

Credit to Author: Peter Girnus| Date: Wed, 19 Jun 2024 00:00:00 +0000

We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are bundled with malicious Winos payloads.

Read more
Security TrendMicro 

Decoding Water Sigbin’s Latest Obfuscation Tricks

0 Comments , , , , , ,

Credit to Author: Sunil Bharti| Date: Thu, 30 May 2024 00:00:00 +0000

Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.

Read more
Security TrendMicro 

Tracking the Progression of Earth Hundun’s Cyberespionage Campaign in 2024

0 Comments , , , ,

Credit to Author: Pierre Lee| Date: Thu, 16 May 2024 00:00:00 +0000

This report describes how Waterbear and Deuterbear — two of the tools in Earth Hundun’s arsenal — operate, based on a campaign from 2024.

Read more
Security TrendMicro 

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

0 Comments , , , ,

Credit to Author: Feike Hacquebord| Date: Wed, 01 May 2024 00:00:00 +0000

This blog entry aims to highlight the dangers of internet-facing routers and elaborate on Pawn Storm’s exploitation of EdgeRouters, complementing the FBI’s advisory from February 27, 2024.

Read more
Security TrendMicro 

Cyberespionage Group Earth Hundun’s Continuous Refinement of Waterbear and Deuterbear

0 Comments , , , ,

Credit to Author: Cyris Tseng| Date: Thu, 11 Apr 2024 00:00:00 +0000

Our blog entry provides an in-depth analysis of Earth Hundun’s Waterbear and Deuterbear malware.

Read more
Security TrendMicro 

How Red Team Exercises Increases Your Cyber Health

0 Comments , , , , , , ,

Credit to Author: Johnny Krogsboll| Date: Thu, 11 Apr 2024 00:00:00 +0000

Delve into the world of red team exercises, their vital role in enhancing organizational security through simulated cyberattacks, including tactics like phishing and lateral movement within networks, and understand the need for regular testing and improvement to counter evolving threats effectively.

Read more
Security TrendMicro 

Earth Freybug Uses UNAPIMON for Unhooking Critical APIs

0 Comments , , ,

Credit to Author: Christopher So| Date: Tue, 02 Apr 2024 00:00:00 +0000

This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library (DLL) hijacking and application programming interface (API) unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed UNAPIMON.

Read more
Security TrendMicro 

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

0 Comments , , ,

Credit to Author: Joseph C Chen| Date: Mon, 18 Mar 2024 00:00:00 +0000

Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.

Read more
Security TrendMicro 

Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence

0 Comments , , ,

Credit to Author: Buddy Tancio| Date: Wed, 06 Mar 2024 00:00:00 +0000

This blog entry will examine Trend Micro MDR team’s investigation that successfully uncovered the intrusion sets employed by Earth Kapre in a recent incident, as well as how the team leveraged threat intelligence to attribute the extracted evidence to the cyberespionage threat group.

Read more
Security TrendMicro 

Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities

0 Comments , ,

Credit to Author: Ian Kenefick| Date: Tue, 27 Feb 2024 00:00:00 +0000

This blog entry gives a detailed analysis of these recent ScreenConnect vulnerabilities. We also discuss our discovery of threat actor groups, including Black Basta and Bl00dy Ransomware gangs, that are actively exploiting CVE-2024-1708 and CVE-2024-1709 based on our telemetry.

Read more