Skip to main content

TrendAI™ Ranks #1 on CyberGym with a 97% Exploit-Remediation Score

See why

TrendAI™
Security Blog

TrendAI Security Blog

Featured Blogs

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More
Malware

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

TrendAI™ Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. This analysis covers the full chain, from the pixel data that hides the first stage, through a flexible shared loader to deliver multiple payloads, revealing how adversaries are standardizing their delivery mechanisms.

August 27th, 2026 30 min read Ahmed Mohamed Ibrahim, Ashish Verma, Deep Patel
Read article
forseti-cover
AI
TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework.

August 26th, 2026 20 min
Deep Patel, Ashish Verma
Read article
AIExploits & Zero-Days
Ranked First on CyberGym: TrendAI™ Agentic Exploit-Remediation Engine Scores 97% on the Top Exploit Benchmark

The TrendAI™ agentic exploit-remediation engine, code name AESIR, ranks first on CyberGym at 97% — more than 12 points ahead of both GPT-5.6 Sol and Claude Mythos 5. AI system architecture beats raw model capability.

August 26th, 2026 3 min
Peter Girnus
Read article
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know
Cyber risk
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know

A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience.

August 24th, 2026 6 min
TrendAI™ Research
Read article

Search for research articles

Ransomware as a Service (RaaS)
Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

Anubis is an emerging ransomware-as-a-service (RaaS) group that adds a destructive edge to the typical double-extortion model with its file-wiping feature. We explore its origins and examine the tactics behind its dual-threat approach.

June 13th, 2025 8 min read Maristel Policarpio, Sarah Pearl Camiling, Sophia Nilette Robles
Read Article
TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead

Trend™ Research uncovered a campaign on TikTok that uses videos to lure victims into downloading information stealers, a tactic that can be automated using AI tools.

May 21st, 2025 8 min read Junestherry Dela Cruz
Read Article
Cyber threats
Fake CAPTCHA Attacks Deploy Infostealers and RATs in a Multistage Payload Chain

We have detected a new tactic involving fake CAPTCHA pages that trick users into executing harmful commands in Windows. This scheme uses disguised files sent via phishing and other malicious methods.

May 19th, 2025 15 min read Buddy Tancio, Khristoffer Jocson, Maylein Tom, Lisa Wu…
Read Article
Exploits & Zero-DaysAPTsCyber espionage
ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

Trend Zero Day Initiative™ (ZDI) uncovered both state-sponsored and cybercriminal groups extensively exploiting ZDI-CAN-25373 (aka ZDI-25-148), a Windows .lnk file vulnerability that enables hidden command execution.

March 18th, 2025 13 min read Peter Girnus, Aliakbar Zahravi
Read Article
Invisible Prompt Injection: A Threat to AI Security

This article explains the invisible prompt injection, including how it works, an attack scenario, and how users can protect themselves.

January 22nd, 2025 4 min read Ian Ch Liu
Read Article
Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Since 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations.

November 25th, 2024 17 min read Leon M Chang, Theo Chen, Lenart Bermejo, Ted Lee
Read Article
Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions

Trend Micro's Threat Hunting Team has observed EDRSilencer, a red team tool that threat actors are attempting to abuse for its ability to block EDR traffic and conceal malicious activity.

October 15th, 2024 8 min read Jacob Santos, Cj Arsley Mateo, Sarah Pearl Camiling
Read Article
Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework

We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are bundled with malicious Winos payloads.

June 19th, 2024 18 min read Peter Girnus, Aliakbar Zahravi, Ahmed Mohamed Ibrahim
Read Article
Deepfakes
A Deepfake Scammed a Bank out of $25M — Now What?

A finance worker in Hong Kong was tricked by a deepfake video conference. The future of defending against deepfakes is as much as human challenge as a technological one.

February 7th, 2024 4 min read Shannon Murphy
Read Article
Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things (IoT) devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023.

May 17th, 2023 10 min read Fyodor Yarochkin, Zhengyu Dong, Paul Pajares
Read Article