Skip to main content

TrendAI™
Security Blog

TrendAI Security Blog

Ausgewählte Blogs

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More
Malware

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

TrendAI™ Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. This analysis covers the full chain, from the pixel data that hides the first stage, through a flexible shared loader to deliver multiple payloads, revealing how adversaries are standardizing their delivery mechanisms.

August 27th, 2026 30 min read Ahmed Mohamed Ibrahim, Ashish Verma, Deep Patel
Read article
forseti-cover
AI
TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework.

August 26th, 2026 20 min
Deep Patel, Ashish Verma
Read article
AIExploits & Zero-Days
Ranked First on CyberGym: TrendAI™ Agentic Exploit-Remediation Engine Scores 97% on the Top Exploit Benchmark

The TrendAI™ agentic exploit-remediation engine, code name AESIR, ranks first on CyberGym at 97% — more than 12 points ahead of both GPT-5.6 Sol and Claude Mythos 5. AI system architecture beats raw model capability.

August 26th, 2026 3 min
Peter Girnus
Read article
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know
Cyber risk
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know

A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience.

August 24th, 2026 6 min
TrendAI™ Research
Read article

Nach Fachartikeln suchen

New Golang Ransomware Agenda Customizes Attacks

A new piece of ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim.

August 25th, 2022 8 min read Mohamed Fahmy, Sherif Magdy, Nathaniel Gregory Ragasa, Earle Maui Earnshaw…
Read Article
Ransomware & extortion
Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus

We investigate mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware.

August 24th, 2022 9 min read Ryan Soliven, Hitomi Kimura
Read Article
Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus

Citizen Lab has released a report on a new iPhone threat dubbed ForcedEntry. This zero-click exploit seems to be able to circumvent Apple's BlastDoor security, and allow attackers access to a device without user interaction.

September 15th, 2021 5 min read Mickey Jin
Read Article
Phishing & BEC
APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs

We have continued tracking APT-C-36, also known as Blind Eagle, since our research on this threat actor in 2019. We share new findings of APT-C-36’s ongoing spam campaign targeting South American entities.

September 13th, 2021 6 min read Daniel Lunghi
Read Article
Cyber threats
#NoFilter: Exposing the Tactics of Instagram Account Hackers

What tactics do Instagram account hackers use? What do these cybercriminals do with stolen accounts? How can users protect their accounts? We look into Instagram account hacking incidents from a security researcher’s perspective and share recommendations for users of Instagram and other social media platforms.

July 12th, 2021 9 min read Jindrich Karasek
Read Article
SHAREit Flaw Could Lead to Remote Code Execution

We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.

February 15th, 2021 5 min read Echo Duan, Jesse Chang
Read Article
XCSSET Mac Malware: Infects Xcode Projects, Uses 0Days

Further investigation led us to a developer’s Xcode project that contained XCSSET source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits.

August 13th, 2020 3 min read Mac Threat Response, Mobile Research Team
Read Article
Malware
Bashlite Updated with Mining and Backdoor Commands

We uncovered an updated Bashlite malware designed to add infected internet-of-things devices to a distributed-denial-of-service (DDoS) botnet. Based on the Metasploit module it exploits, the malware targets devices with the WeMo UPnP API.

April 3rd, 2019 5 min read Mark Vicente, Byron Gelera, Augusto Remillano II, Chizuru Toyama…
Read Article
IoT & smart devicesMalware
Beauty Camera Apps Send Users Porn, Collects Pictures

We discovered several beauty camera apps (detected as AndroidOS_BadCamera.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes. Some of these have been downloaded millions of times.

January 30th, 2019 3 min read Lorin Wu
Read Article
Malware
Fake Banking App Found on Google Play Used in SMiShing

As users start to look for apps and other services from their banks, opportunities for scammers also increase. One recent example of this is the app Movil Secure, part of a SMiShing scheme targeting Spanish-speaking users.

November 7th, 2018 4 min read Echo Duan
Read Article