サイバープロパガンダGenerative AI
Matryoshkaが再び活動：AI生成の虚偽の主張で米国中間選挙の候補者を標的に
2026年11月2日2 min read
Asako Koizumi, Philippe Lin
2026年11月2日
2 min read
Read article
TrendAI™
セキュリティブログ
注目のブログ
BotnetsIoTとスマートデバイス
TrendAI™ Research、出荷前から感染していた130万台超のセットトップボックスによるボットネットの無力化に貢献
TrendAI™ Researchが数カ月にわたり提供してきたインテリジェンスが、出荷前から感染していた130万台超のセットトップボックスによるボットネットの無力化に貢献しました。本記事では、このボットネットの運営の仕組みと影響、そして無力化が防御側にとって持つ意味を解説します。
2026年11月2日 15 min
Read article
仮想パッチ：正式パッチの提供前に、より早く保護する
2026年11月1日
Read article
エクスプロイトとゼロデイ
「Node2Shell」の原因となったBrotliの脆弱性：修正対象と見落としやすい組み込み先
2026年10月28日 6 min
Read article
ブログ記事を検索
Site search
Filter by:
Cloud security
Leaky Labels: Bypassing Traefik Proxy Leveraging cAdvisor Metrics
While examining the exposed information in the metrics endpoint of cAdvisor, we noticed that it exposes container labels for all the running containers on the “/metrics” endpoint. Container labels are key value pairs that are stored as a string. They are used to store metadata such as licensing information, maintainer information, versioning about container objects such as container images, running containers, volumes, daemons, and networks.
July 11th, 2024 13 min read
Read Article
サイバー犯罪
An In-Depth Look at Crypto-Crime in 2023 Part 2
In 2023, the cryptocurrency industry faced a significant increase in illicit activities, including money laundering, fraud, and ransomware attacks. Ransomware attacks were especially prevalent and profitable for attackers. However, other forms of criminal activity also saw a rise.
July 11th, 2024 5 min read
Read Article
Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework
We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are bundled with malicious Winos payloads.
June 19th, 2024 18 min read
Read Article
Noodle RAT: Reviewing the Backdoor Used by Chinese-Speaking Groups
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
June 11th, 2024 13 min read
Read Article
AI
Guarding AI Models From Malicious Alterations in the AI PC Era
This article discusses the importance of properly identifying and protecting AI model files and their associated assets, such as labels, from malicious or even unintended tampering.
June 4th, 2024 5 min read
Read Article
APT
Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks
This blog entry aims to highlight the dangers of internet-facing routers and elaborate on Pawn Storm's exploitation of EdgeRouters, complementing the FBI's advisory from February 27, 2024.
May 1st, 2024 15 min read
Read Article
ランサムウェアと恐喝
Unveiling the Fallout: Operation Cronos' Impact on LockBit Following Landmark Disruption
Our new article provides key highlights and takeaways from Operation Cronos' disruption of LockBit's operations, as well as telemetry details on how LockBit actors operated post-disruption.
April 3rd, 2024 27 min read
Read Article
ランサムウェアと恐喝
Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script
This blog entry discusses the Agenda ransomware group's use of its latest Rust variant to propagate to VMWare vCenter and ESXi servers.
March 26th, 2024 6 min read
Read Article
APT
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
March 18th, 2024 14 min read
Read Article
エクスプロイトとゼロデイ
CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign
In addition to our Water Hydra APT zero day analysis, the Zero Day Initiative (ZDI) observed a DarkGate campaign which we discovered in mid-January 2024 where DarkGate operators exploited CVE-2024-21412.
March 13th, 2024 20 min read
Read Article