ロシアとの関連が疑われる侵入グループ「Earth Sirrush」：4年間にわたり進化を続ける諜報ツール
Earth Sirrushはツールや配信手法を繰り返し変更してきました。一方、TrendAI™ Researchの調査では、共通するコード、再利用された痕跡、インフラのパターンから、各キャンペーンのつながりが引き続き明らかになっています。
2026年10月5日5 min read
Hiroyuki Kakara, Feike Hacquebord
2026年10月5日
5 min read
Read article
TrendAI™
セキュリティブログ
注目のブログ
AIと進化する脅威ランドスケープ：公共部門のCISOが今知るべきこと
公共部門のCISOは、2026年に最大3,600件に達するAI関連CVE、自律型ランサムウェア、重要インフラのリスクなど、AIがもたらす脅威に対処する必要があります。
2026年10月5日
Read article
可視性、可観測性、オーナーシップ、ガバナンスでAIセキュリティ成熟度を評価する
3つの問いから、組織のAIセキュリティ成熟度が見えてきます。短い動画で専門家の見解を聞きながら、ガバナンス確立への道筋を探ります。
2026年10月2日
Read article
ShinyHunters、1文字のWAF回避でPeopleSoftを再び攻撃
ShinyHuntersは、2026年6月に当社が分析し、すでに修正パッチが公開されているPeopleSoftの脆弱性を再び悪用しています。
2026年10月1日
Read article
ブログ記事を検索
Site search
Filter by:
エクスプロイトとゼロデイ
CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.
November 20th, 2023 5 min read
Read Article
APT
Earth Estries Targets Government, Tech for Cyberespionage
We break down a new cyberespionage campaign deployed by a cybercriminal group we named Earth Estries. Analyzing the tactics, techniques, and procedures (TTPs) employed, we observed overlaps with the advanced persistent threat (APT) group FamousSparrow as Earth Estries targets governments and organizations in the technology sector.
August 30th, 2023 12 min read
Read Article
Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices
An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things (IoT) devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023.
May 17th, 2023 10 min read
Read Article
Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.
March 1st, 2023 14 min read
Read Article
ランサムウェアと恐喝
New Mimic Ransomware Abuses Everything APIs for its Encryption Process
Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage.
January 26th, 2023 5 min read
Read Article
APT
Earth Preta Spear-Phishing Governments Worldwide
We break down the cyberespionage activities of advanced persistent threat (APT) group Earth Preta, observed in large-scale attack deployments that began in March. We also show the infection routines of the malware families they use to infect multiple sectors worldwide: TONEINS, TONESHELL, and PUBLOAD.
November 18th, 2022 17 min read
Read Article
サイバー脅威
Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware.
October 12th, 2022 8 min read
Read Article
New Golang Ransomware Agenda Customizes Attacks
A new piece of ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim.
August 25th, 2022 8 min read
Read Article
ランサムウェアと恐喝
Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus
We investigate mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware.
August 24th, 2022 9 min read
Read Article
Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus
Citizen Lab has released a report on a new iPhone threat dubbed ForcedEntry. This zero-click exploit seems to be able to circumvent Apple's BlastDoor security, and allow attackers access to a device without user interaction.
September 15th, 2021 5 min read
Read Article