Stephen Hilt
18 articles
-
ResearchMapping the Criminal Economy Targeting Critical Infrastructure
TrendAI™ Research went inside the forums, marketplaces, and Telegram channels where access to factories, utilities, and energy firms is bought, sold, and weaponized. Combing through two years’ worth of data revealed an underground where financially motivated brokers and ransomware crews now operate alongside state-aligned hacktivists, sharing the same entry vectors, the same pirated training, and in some cases, the same personnel.
September 2nd, 2026 7 minMayra Rosario Fuentes, Stephen Hilt, Numaan Huq
Read article -
ResearchAn Invisible Attack Surface: Thousands of Industrial Control Systems Exposed Near Data Centers
TrendAI™ Research's investigation of ICS protocols near U.S. data centers uncovered thousands of vulnerable devices controlling critical cooling, power, and environmental infrastructure. These systems—designed for operational efficiency, not security—were accessible from the public internet.
August 8th, 2026 43 minStephen Hilt, Numaan Huq
Read article -
ResearchWhat Cybercriminals Look For in Corporate Insiders
The supply and demand for insider threat actors have evolved from isolated opportunism into a structured, thriving criminal market, complete with brokers, recruiters, referral bonuses, guarantor services, and revenue-sharing arrangements. This research examines that market across different industries.
August 4th, 2026Mayra Rosario Fuentes, Stephen Hilt, David Sancho
Read article -
BlogTrendAI™ Intelligence Aids Law Enforcement Arrest of Tycoon 2FA Operators
The Singapore Police Force (SPF), working closely with Pakistan's National Cyber Crime Investigation Agency (NCCIA) and INTERPOL has arrested two individuals linked to Tycoon2FA, a phishing operation that served criminal customers across four continents.
August 4th, 2026Christopher Boyton, Stephen Hilt
Read article -
ResearchThe Cybercriminal Underground: Mapping the Healthcare Data Economy
A look inside an industrialized economy where stolen healthcare data is bought, sold, and weaponized, from ransomware breaches to broker access and fake medical documents fueling an expanding criminal supply chain.
June 4th, 2026Stephen Hilt, Numaan Huq, Mayra Rosario Fuentes
Read article -
BlogEuropol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations
Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) proxying.
March 4th, 2026 7 minChristopher Boyton, Mayra Rosario Fuentes, Stephen Hilt
Read article -
ResearchThreat Attribution Framework: How TrendAI™ Applies Structure Over Speculation
TrendAI™ brings structure and discipline to threat attribution, helping security leaders and teams make informed decisions about cyber risk, incident response, and overall defensive posture.
February 12th, 2026 15 minStephen Hilt
Read article -
ResearchThe Next Phase of Cybercrime: Agentic AI and the Shift to Autonomous Criminal Operations
We dive into the transformation from “Cybercrime-as-a-Service“ to “Cybercrime-as-a-Sidekick“, which fundamentally alters the operational dynamics of criminal enterprises.
December 9th, 2025 6 minStephen Hilt, Robert McArdle
Read article
-
ResearchComplexity and Visibility Gaps in Power Automate
Amid the rise of low-code automation, Microsoft Power Automate is becoming an attractive target for cybercriminals exploiting its complexity to evade detection and exfiltrate data – but demand for compromised enterprise assets is outstripping supply in the cybercriminal underground.
September 7th, 2025Stephen Hilt, Vladimir Kropotov, Fyodor Yarochkin, Benjamin Zigh
Read article -
ResearchCES 2025: A Comprehensive Look at AI Digital Assistants and Their Security Risks
In this entry, we mapped the capabilities of various AI digital assistants that were showcased at CES 2025 based on an assessment matrix we developed to determine how this emerging technology holds up against potential security threats.
February 10th, 2025 12 minVincenzo Ciancaglini, Salvatore Gariuolo, Stephen Hilt, Rainer Vosseler
Read article -
ResearchBridging Divides, Transcending Borders: The Current State of the English Underground
The English-speaking cybercriminal underground market has undergone significant transformations. We examine how it has adapted to new technology, increased law enforcement scrutiny, and linguistic diversification.
January 7th, 2025 2 minStephen Hilt, Mayra Rosario Fuentes
Read article -
ResearchAI Assistants in the Future: Security Concerns and Risk Management
The article explores the evolving landscape of AI digital assistants, highlighting their transformative potential, associated security risks, and the importance of robust design and collaboration to ensure a secure and user-centric future.
December 6th, 2024 15 minVincenzo Ciancaglini, Salvatore Gariuolo, Stephen Hilt, Robert McArdle…
Read article -
ResearchFrom Defense to Offense: The Misuse of Red Teaming Tools by Cybercriminals
Red teaming tools, which organizations use in cyberattack simulations and security assessments, have become an important cybersecurity component for those looking to strengthen organizational defenses.
October 15th, 2024 6 minStephen Hilt, Aliakbar Zahravi
Read article -
ResearchCyber Considerations for Organizations During Times of Conflict
This article provides a comprehensive overview of the necessary adjustments and strategies CISOs need to implement to safeguard their organizations’ assets, maintain business continuity, and uphold public trust amid conflict situations.
August 14th, 2024 20 minFeike Hacquebord, Stephen Hilt, Vladimir Kropotov, Fyodor Yarochkin
Read article -
ResearchThe Future of Ransomware
Our research looks at the potential evolutions and revolutions in the current ransomware landscape based on significant triggers and catalysts. We highlight the specific developments (triggers) that could cause gradual changes (evolutions) before sparking more drastic transformations (revolutions).
December 15th, 2022 9 minFeike Hacquebord, Stephen Hilt, David Sancho
Read article -
ResearchHow Cybercriminals Abuse Cloud Tunneling Services
Our research examines how cloud tunneling services work and how organizations can thwart threats that abuse them.
April 26th, 2022 24 minRyan Flores, Stephen Hilt, Lord Remorin
Read article -
ResearchReinforcing NAS Security Against Pivoting Threats
We analyze some existing and developing threats that target NAS devices of users and businesses.
January 20th, 2022 3 minStephen Hilt, Fernando Mercês
Read article -
ResearchUncovering IoT Threats in the Cybercrime Underground
Understanding current and future threats to the internet of things (IoT) can help shape how we secure this technology that is increasingly becoming integral to today's world. What insights can be reaped from the cybercrime underground?
September 10th, 2019 3 minStephen Hilt, Vladimir Kropotov, Fernando Mercês, Mayra Rosario…
Read article