Credit to Author: Trend Micro Research| Date: Thu, 04 Jul 2024 00:00:00 +0000
We’ve recently seen a surge in attacks involving the Mekotio banking trojan. In this blog entry, we’ll provide an overview of the trojan and what it does.
Read moreCredit to Author: AI Team| Date: Fri, 28 Jun 2024 00:00:00 +0000
AI Pulse is a new blog series from Trend Micro on the latest cybersecurity AI news. In this edition: Siri says hi to OpenAI, fraud hogs the AI cybercrime spotlight, and why the Paris Olympics could be a hotbed of deepfakery.
Read moreCredit to Author: Ahmed Mohamed Ibrahim | Date: Fri, 28 Jun 2024 00:00:00 +0000
We analyze the multi-stage loading technique used by Water Sigbin to deliver the PureCrypter loader and XMRIG crypto miner.
Read moreCredit to Author: Cedric Pernet| Date: Thu, 27 Jun 2024 00:00:00 +0000
In this blog we uncover threat actors using the 2024 Olympics to lure victims into investing in an initial coin offering (ICO). Similar schemes have been found to use AI-generated images for their fake ICO websites.
Read moreCredit to Author: Dustin Childs| Date: Tue, 25 Jun 2024 00:00:00 +0000
The latest Omdia Vulnerability Report shows Trend MicroTM Zero Day InitiativeTM (ZDI) spearheaded 60% of 2023 disclosures, underscoring its role in cybersecurity threat prevention.
Read moreCredit to Author: Peter Girnus| Date: Wed, 19 Jun 2024 00:00:00 +0000
We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are bundled with malicious Winos payloads.
Read moreCredit to Author: Hara Hiroaki| Date: Tue, 11 Jun 2024 00:00:00 +0000
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
Read moreCredit to Author: Hara Hiroaki| Date: Tue, 11 Jun 2024 00:00:00 +0000
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
Read moreCredit to Author: Sunil Bharti| Date: Thu, 06 Jun 2024 00:00:00 +0000
We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.
Read moreCredit to Author: Sunil Bharti| Date: Thu, 30 May 2024 00:00:00 +0000
Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.
Read more