Skip to main content

TrendAI™
Blog de Seguridad

Blog de Seguridad de TrendAI

Blogs destacados

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More
Malware

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

TrendAI™ Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. This analysis covers the full chain, from the pixel data that hides the first stage, through a flexible shared loader to deliver multiple payloads, revealing how adversaries are standardizing their delivery mechanisms.

August 27th, 2026 30 min read Ahmed Mohamed Ibrahim, Ashish Verma, Deep Patel
Read article
forseti-cover
AI
TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework.

August 26th, 2026 20 min
Deep Patel, Ashish Verma
Read article
AIExploits & Zero-Days
Ranked First on CyberGym: TrendAI™ Agentic Exploit-Remediation Engine Scores 97% on the Top Exploit Benchmark

The TrendAI™ agentic exploit-remediation engine, code name AESIR, ranks first on CyberGym at 97% — more than 12 points ahead of both GPT-5.6 Sol and Claude Mythos 5. AI system architecture beats raw model capability.

August 26th, 2026 3 min
Peter Girnus
Read article
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know
Cyber risk
UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know

A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience.

August 24th, 2026 6 min
TrendAI™ Research
Read article

Buscar artículos de investigación

New Golang Ransomware Agenda Customizes Attacks

A new piece of ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim.

August 25th, 2022 8 min read Mohamed Fahmy, Sherif Magdy, Nathaniel Gregory Ragasa, Earle Maui Earnshaw…
Read Article
Ransomware & extortion
Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus

We investigate mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware.

August 24th, 2022 9 min read Ryan Soliven, Hitomi Kimura
Read Article
Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus

Citizen Lab has released a report on a new iPhone threat dubbed ForcedEntry. This zero-click exploit seems to be able to circumvent Apple's BlastDoor security, and allow attackers access to a device without user interaction.

September 15th, 2021 5 min read Mickey Jin
Read Article
Phishing & BEC
APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs

We have continued tracking APT-C-36, also known as Blind Eagle, since our research on this threat actor in 2019. We share new findings of APT-C-36’s ongoing spam campaign targeting South American entities.

September 13th, 2021 6 min read Daniel Lunghi
Read Article
Cyber threats
#SinFiltro: Exponiendo las Tácticas de los Hackers de Cuentas de Instagram

¿Qué tácticas utilizan los hackers de cuentas de Instagram? ¿Qué hacen estos ciberdelincuentes con las cuentas robadas? ¿Cómo pueden los usuarios proteger sus cuentas? Analizamos los incidentes de hackeo de cuentas de Instagram desde la perspectiva de un investigador de seguridad y compartimos recomendaciones para los usuarios de Instagram y otras plataformas de redes sociales.

July 12th, 2021 9 min read Jindrich Karasek
Read Article
SHAREit Flaw Could Lead to Remote Code Execution

We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.

February 15th, 2021 5 min read Echo Duan, Jesse Chang
Read Article
XCSSET Mac Malware: Infects Xcode Projects, Uses 0Days

Further investigation led us to a developer’s Xcode project that contained XCSSET source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits.

August 13th, 2020 3 min read Mac Threat Response, Mobile Research Team
Read Article
Malware
Bashlite actualizado con comandos de minería y puerta trasera

Descubrimos un malware Bashlite actualizado diseñado para agregar dispositivos de internet de las cosas infectados a una botnet de denegación de servicio distribuido (DDoS). Basado en el módulo Metasploit que explota, el malware apunta a dispositivos con la API UPnP de WeMo.

April 3rd, 2019 5 min read Mark Vicente, Byron Gelera, Augusto Remillano II, Chizuru Toyama…
Read Article
IoT & smart devicesMalware
Beauty Camera Apps Send Users Porn, Collects Pictures

We discovered several beauty camera apps (detected as AndroidOS_BadCamera.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes. Some of these have been downloaded millions of times.

January 30th, 2019 3 min read Lorin Wu
Read Article
Malware
Aplicación bancaria falsa encontrada en Google Play utilizada en SMiShing

A medida que los usuarios comienzan a buscar aplicaciones y otros servicios de sus bancos, también aumentan las oportunidades para los estafadores. Un ejemplo reciente de esto es la aplicación Movil Secure, parte de un esquema de SMiShing dirigido a usuarios de habla hispana.

November 7th, 2018 4 min read Echo Duan
Read Article