Jacob Santos
17 articles
-
BlogClaude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do
Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk.
April 7th, 2026 6 minJacob Santos, Sophia Nilette Robles
Read article -
BlogWeaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting an existing AI-themed campaign to spread Vidar and GhostSocks.
April 3rd, 2026 18 minJacob Santos, Sophia Nilette Robles, Jeffrey Francis Bonaobra
Read article -
BlogPacote NPM Axios Comprometido: Ataque à Cadeia de Suprimentos Atinge Cliente HTTP JavaScript com Mais de 100 Milhões de Downloads Semanais
Um ataque à cadeia de suprimentos atingiu a Axios quando invasores usaram credenciais npm roubadas para publicar versões maliciosas contendo uma dependência fantasma. Isso acionou um RAT multiplataforma durante a instalação e substituiu seus arquivos por iscas limpas, tornando a detecção desafiadora.
March 31st, 2026 10 minPeter Girnus, Jacob Santos
Read article -
BlogWeb Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.
March 16th, 2026 13 minMaristel Policarpio, Junestherry Dela Cruz, Sarah Pearl Camiling, Jacob Santos…
Read article -
BlogPureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading
Job seekers looking out for opportunities might instead find their personal devices compromised, as a PureRAT campaign propagated through email leverages Foxit PDF Reader for concealment and DLL side-loading for initial entry.
December 3rd, 2025 5 minSarah Pearl Camiling, Junestherry Dela Cruz, Jacob Santos, Sophia Nilette Robles…
Read article -
BlogAgenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques
Trend™ Research identified a sophisticated Agenda ransomware attack that deployed a Linux variant on Windows systems. This cross-platform execution can make detection challenging for enterprises.
October 23rd, 2025 13 minJacob Santos, Junestherry Dela Cruz, Sarah Pearl Camiling, Sophia Nilette Robles…
Read article -
BlogMalware Autopropagável se Espalha Via WhatsApp, Alvo: Usuários Brasileiros
A TrendAI™ Research identificou uma campanha ativa se espalhando via WhatsApp através de um anexo de arquivo ZIP. Quando executado, o malware estabelece persistência e sequestra a conta do WhatsApp comprometida para enviar cópias de si mesmo para os contatos da vítima.
October 3rd, 2025 15 minJeffrey Francis Bonaobra, Maristel Policarpio, Sophia Nilette Robles, Cj Arsley Mateo…
Read article -
BlogNovo LockBit 5.0 Alvo Windows, Linux, ESXi
A TrendAI™ Research analisou binários de origem da atividade mais recente do notório Ransomware LockBit com sua versão 5.0, que exibe técnicas avançadas de ofuscação, anti-análise e capacidades multiplataforma perfeitas para sistemas Windows, Linux e ESXi.
September 25th, 2025 7 minSarah Pearl Camiling, Jacob Santos
Read article -
BlogUnmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed
An analysis of the Gentlemen ransomware group, which employs advanced, adaptive tactics, techniques, and procedure to target critical industries worldwide.
September 9th, 2025 12 minJacob Santos, Maristel Policarpio, Don Ovid Ladores, Junestherry Dela Cruz
Read article -
BlogCrypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks
Crypto24 is a ransomware group that stealthily blends legitimate tools with custom malware, using advanced evasion techniques to bypass security and EDR technologies.
August 14th, 2025 13 minMaristel Policarpio, Sarah Pearl Camiling, Don Ovid Ladores, Jacob Santos…
Read article -
BlogNew Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises
We uncovered a campaign that makes use of Charon, a new ransomware family, and advanced APT-style techniques to target organizations with customized ransom demands.
August 12th, 2025 8 minJacob Santos, Ted Lee, Ahmed Kamal, Don Ovid Ladores
Read article -
BlogRevisiting UNC3886 Tactics to Defend Against Present Risk
We examine the past tactics used by UNC3886 to gain insight on how to best strengthen defenses against the ongoing and emerging threats of this APT group.
July 28th, 2025 9 minCj Arsley Mateo, Ieriz Nicolle Gonzalez, Jacob Santos, Paul John Bardon…
Read article -
BlogAgenda Ransomware Group Adds SmokeLoader and NETXLOADER to Their Arsenal
During our monitoring of Agenda ransomware activities, we uncovered campaigns that made use of the SmokeLoader malware and a new loader we've named NETXLOADER.
May 7th, 2025 13 minJacob Santos, Raymart Yambot, John Rainier Navato, Sarah Pearl Camiling…
Read article -
BlogCrazyHunter Campaign Targets Taiwanese Critical Sectors
This blog entry details research on emerging ransomware group CrazyHunter, which has launched a sophisticated campaign aimed at Taiwan's essential services.
April 16th, 2025 9 minMaristel Policarpio, Sarah Pearl Camiling, Jacob Santos, Cj Arsley Mateo…
Read article -
BlogAI-Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
In this blog entry, we uncovered a campaign that uses fake GitHub repositories to distribute SmartLoader, which is then used to deliver Lumma Stealer and other malicious payloads. The campaign leverages GitHub’s trusted reputation to evade detection, using AI-generated content to make fake repositories appear legitimate.
March 11th, 2025 10 minCj Arsley Mateo, Jacob Santos, Darrel Tristan Virtusio, Junestherry Dela Cruz…
Read article -
BlogSilent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions
Trend Micro's Threat Hunting Team has observed EDRSilencer, a red team tool that threat actors are attempting to abuse for its ability to block EDR traffic and conceal malicious activity.
October 15th, 2024 8 minJacob Santos, Cj Arsley Mateo, Sarah Pearl Camiling
Read article -
BlogPlay Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma
Trend Micro threat hunters discovered that the Play ransomware group has been deploying a new Linux variant that targets ESXi environments. Read our blog entry to know more.
July 19th, 2024 6 minCj Arsley Mateo, Darrel Tristan Virtusio, Sarah Pearl Camiling, Andrei Alimboyao…
Read article