Attackers are probing CVE-2026-119977, a WordPress Core flaw that opens only during a core update. Here’s how the race works, why the severity ratings disagree, and how to protect your sites.
AI agents are now acting on your endpoints. TrendAI Vision One™ ingests Claude Code and Cowork session records so your team can review what users asked Cowork to do, all in the same console.
TrendAI™ Research supplied intelligence over several months that helped disrupt a botnet of more than 1.3 million pre-infected set-top boxes. We look at how the operation worked, its impact, and what the disruption means for defenders.
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
This article discusses the importance of properly identifying and protecting AI model files and their associated assets, such as labels, from malicious or even unintended tampering.
This blog entry aims to highlight the dangers of internet-facing routers and elaborate on Pawn Storm's exploitation of EdgeRouters, complementing the FBI's advisory from February 27, 2024.
Our new article provides key highlights and takeaways from Operation Cronos' disruption of LockBit's operations, as well as telemetry details on how LockBit actors operated post-disruption.
This blog entry discusses the Agenda ransomware group's use of its latest Rust variant to propagate to VMWare vCenter and ESXi servers.
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
In addition to our Water Hydra APT zero day analysis, the Zero Day Initiative (ZDI) observed a DarkGate campaign which we discovered in mid-January 2024 where DarkGate operators exploited CVE-2024-21412.
This blog entry gives a detailed analysis of these recent ScreenConnect vulnerabilities. We also discuss our discovery of threat actor groups, including Black Basta and Bl00dy Ransomware gangs, that are actively exploiting CVE-2024-1708 and CVE-2024-1709 based on our telemetry.
This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations.
In this blog entry, we focus on Earth Preta's campaign that employed a variant of the DOPLUGS malware to target Asian countries.
2026년 11월 4일
4 min read
