Fyodor Yarochkin
21 articles
-
ResearchRethinking the External Attack Surface: Managing the Growing Risk of Open Cyber-Physical Data
China-aligned operational relay box (ORB) infrastructure is harvesting open sensor data at scale, and most defenders can't see it. Our report dives into how these ORBs can use open telemetry for data collection and other purposes.
September 10th, 2026 6 minFyodor Yarochkin, Vladimir Kropotov, Robert McArdle
Read article
-
ResearchUnconventional Attack Surfaces: Identity Replication via Employee Digital Twins
In this second installment of a series exploring emerging AI-driven attack surfaces, TrendAI™ Research focuses on employee digital twins: AI replicas of employees that create new vectors for identity compromise, data exfiltration, and persistent access.
March 26th, 2026 34 minKirill Gelfand, Vladimir Kropotov, Fyodor Yarochkin, Robert McArdle
Read article -
ResearchAI Skills as an Emerging Attack Surface in Critical Sectors: Enhanced Capabilities, New Risks
AI skills bridge the gap between AI capabilities and real-world operations, but in doing so, they also introduce new risks and avenues for attack. We explore the challenges of AI skill adoption and provide a practical framework for secure deployment.
February 10th, 2026 13 minVladimir Kropotov, Fyodor Yarochkin, Kirill Gelfand
Read article -
ResearchHow Unmanaged AI Adoption Puts Your Enterprise at Risk
We challenge assumptions about AI models by revealing real-world biases and limitations, and the impact of poorly managed AI adoptions.
January 21st, 2026 4 minJosiah Hagen, Vladimir Kropotov, Robert McArdle, Fyodor Yarochkin
Read article -
ResearchComplexity and Visibility Gaps in Power Automate
Amid the rise of low-code automation, Microsoft Power Automate is becoming an attractive target for cybercriminals exploiting its complexity to evade detection and exfiltrate data – but demand for compromised enterprise assets is outstripping supply in the cybercriminal underground.
September 7th, 2025Stephen Hilt, Vladimir Kropotov, Fyodor Yarochkin, Benjamin Zigh
Read article -
ResearchDo Security Blogs Enable Vibe-Coded Cybercrime?
Security companies routinely publish detailed analyses of security incidents, making attacker tactics, techniques, and procedures (TTPs) widely known and visible. These reports often provide comprehensive insights into specific vulnerabilities that are or could be exploited, malware delivery mechanisms, and evasion techniques.
September 4th, 2025 5 minRyan Flores, Numaan Huq, Vladimir Kropotov, Robert McArdle…
Read article -
ResearchThe Rise of Residential Proxies as a Cybercrime Enabler
This research discusses how residential proxies help cybercriminals bypass antifraud and IT security systems, and how vulnerabilities in the IoT supply chain are exploited where Android-based devices are shipped pre-infected.
May 27th, 2025Feike Hacquebord, Philippe Lin, Fyodor Yarochkin, Vladimir Kropotov
Read article -
ResearchThe Ever-Evolving Threat of the Russian-Speaking Cybercriminal Underground
We dive into one of the most sophisticated and impactful ecosystems within the global cybercrime landscape. Our research looks at tools and techniques, specialized forums, popular services, plus a deeply ingrained culture of secrecy and collaboration.
April 8th, 2025 11 minFyodor Yarochkin, Vladimir Kropotov, Robert McArdle
Read article -
ResearchUNWIRED: Understanding the Unforeseen Risks in Evolving Communication Channels
This article outlines the strategic risks linked to the growth of natively connected internet of things (IoT) devices that operate outside traditional cybersecurity controls.
September 2nd, 2024Vladimir Kropotov, Robert McArdle, Fyodor Yarochkin
Read article -
ResearchCyber Considerations for Organizations During Times of Conflict
This article provides a comprehensive overview of the necessary adjustments and strategies CISOs need to implement to safeguard their organizations’ assets, maintain business continuity, and uphold public trust amid conflict situations.
August 14th, 2024 20 minFeike Hacquebord, Stephen Hilt, Vladimir Kropotov, Fyodor Yarochkin
Read article -
ResearchA Closer Exploration of Residential Proxies and CAPTCHA-Breaking Services
This article, the final part of a two-part series, focuses on the details of our technical findings and analyses of select residential proxies and CAPTCHA-solving services.
July 27th, 2023 28 minFyodor Yarochkin, Philippe Lin, Bakuei Matsukawa, Ryan Flores…
Read article -
ResearchHow Residential Proxies and CAPTCHA-Solving Services Become Agents of Abuse
This article, the first of a two-part series, provides insights on how abusers and cybercriminals use residential proxies and CAPTCHA-solving services to enable bots, scrapers, and stuffers, and proposes security countermeasures for organizations.
June 26th, 2023 17 minFyodor Yarochkin, Philippe Lin, Bakuei Matsukawa, Ryan Flores…
Read article -
BlogLemon Group’s Cybercriminal Businesses Built on Preinfected Devices
An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things (IoT) devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023.
May 17th, 2023 10 minFyodor Yarochkin, Zhengyu Dong, Paul Pajares
Read article -
ResearchRansomware as a Service: Enabler of Widespread Attacks
Ransomware as a service (RaaS) equips prospective attackers, even those who possess minimal technical skills and knowledge, with the ammunition they need to launch attacks. This in turn helps ransomware spread quickly to more targets. What exactly is RaaS, and which ransomware families and techniques are associated with it?
October 5th, 2021 16 minFyodor Yarochkin
Read article -
ResearchCybercriminal ‘Cloud of Logs’: The Emerging Underground Business of Selling Access to Stolen Data
We take a closer look at an emerging underground market that is driven by malicious actors who sell access to a gargantuan amount of stolen data, frequently advertised in the underground as “cloud of logs."
November 16th, 2020 22 minVladimir Kropotov, Fyodor Yarochkin
Read article -
ResearchInside the Bulletproof Hosting Business: Cybercriminal Methods and OpSec
Bulletproof hosting (BPH) services have long been crucial parts of the cybercriminal infrastructure. How do they protect malicious activities, and how do cybercriminals use them to stay in business?
October 6th, 2020 5 minVladimir Kropotov, Robert McArdle, Fyodor Yarochkin
Read article -
ResearchCommodified Cybercrime Infrastructure: Exploring the Underground Services Market for Cybercriminals
The provision of services, as well as the way criminals operate in the underground, have gone through many changes over the years to cater to the market’s different infrastructure demands.
September 1st, 2020 8 minVladimir Kropotov, Fyodor Yarochkin, Robert McArdle
Read article -
ResearchHacker Infrastructure and Underground Hosting 101:Where Are Cybercriminal Platforms Offered?
Underground platforms are part of a mature ecosystem for trading cybercrime goods and services. How does a capable hosting infrastructure allow illicit activities to thrive?
July 21st, 2020 5 minVladimir Kropotov, Robert McArdle, Fyodor Yarochkin
Read article -
ResearchExploring Common Threats to Cloud Security
As the adoption of cloud services grows, organizations need to be informed about how to secure their environment. Our research examines the common threats encountered in the cloud and provides insight on how organizations can better deal with them.
April 8th, 2020 7 minMorton Swimmer, Fyodor Yarochkin, Joey Costoya, Roel Reyes
Read article -
ResearchHunting Threats on Twitter: How Social Media can be Used to Gather Actionable Threat Intelligence
Social media is a content-rich platform many enterprises use, but how can InfoSec professionals and security teams use it to gather threat intelligence that they can use to protect their organizations?
July 30th, 2019 17 minVladimir Kropotov, Fyodor Yarochkin, Ryan Flores, Jon Oliver
Read article -
ResearchCrimeware for Sale: The Commoditization of ATM Malware in the Cybercriminal Underground
Criminal sellers are peddling ready-to-use ATM malware in underground markets for hacking into banks. In this report, we discuss how criminals advertise and even provide instructions on how to pull off a digital heist.
June 28th, 2019 6 minNumaan Huq, Vladimir Kropotov, Mayra Rosario, David Sancho…
Read article