Sovereign AI places responsibility for every layer of the security stack in the operator's hands, and this article examines the threats that accompany that shift alongside the practical controls that keep nationally owned AI systems trustworthy.
TrendAI™ Research's investigation of ICS protocols near U.S. data centers uncovered thousands of vulnerable devices controlling critical cooling, power, and environmental infrastructure. These systems—designed for operational efficiency, not security—were accessible from the public internet.
This final installment of our trilogy on Pwning Agentic AI covers defenses against the return-to-tool (RTT) attacks—read-only Postgres bypass, support-ticket ransomware, and KYC passport exfiltration—demonstrated in Part II. Here we take a look at what works and what doesn’t against this new class of attack.
The supply and demand for insider threat actors have evolved from isolated opportunism into a structured, thriving criminal market, complete with brokers, recruiters, referral bonuses, guarantor services, and revenue-sharing arrangements. This research examines that market across different industries.
A watering hole campaign we dubbed as Operation Earth Kitsune is spying on users’ systems through compromised websites. Using SLUB and two new malware variants, the attacks exploit vulnerabilities including those of Google Chrome and Internet Explorer.
Bulletproof hosting (BPH) services have long been crucial parts of the cybercriminal infrastructure. How do they protect malicious activities, and how do cybercriminals use them to stay in business?
The provision of services, as well as the way criminals operate in the underground, have gone through many changes over the years to cater to the market’s different infrastructure demands.
Hackers spread messages supposedly sent from Instagram Help Center claiming that the user's account is at risk of being deleted.
In our monitoring of Docker-related threats, we came across a threat actor who uploaded malicious images to Docker Hub for cryptocurrency mining.
Serverless computing is not immune to risks and threats. Our security research provides a comprehensive analysis of the possible attack scenarios that could compromise serverless services and deployments.
The legacy programming environments of widely used industrial machines could harbor virtually undetectable vulnerabilities and malware. Our security analysis of these environments reveals critical flaws and their repercussions for smart factories.
Underground platforms are part of a mature ecosystem for trading cybercrime goods and services. How does a capable hosting infrastructure allow illicit activities to thrive?
In this report, we discussed new ransomware family Avaddon, updates on techniques of other ransomware, and our latest figures.
As cybercriminals compete for dominance in their bid to create powerful botnets, users can make their own stand against warring sides by understanding how botnet malware works and securing their devices.
August 11th, 2026 
43 min