Exploits & Zero-Days
Brotli Flaw Behind 'Node2Shell': What to Patch and Where It Hides
2026年10月28日6 min read
TrendAI™ Research
2026年10月28日
6 min read
Read article
TrendAI™
保安網誌
精選網誌
Exploits & Zero-Days
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now
On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon.
2026年10月22日
Read article
Exploits & Zero-Days
Eight Compromised eMudhra CA Keys: What Happened and What Organizations Should Do Now
Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™.
2026年10月21日
Read article
Exploits & Zero-Days
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook.
2026年10月21日
Read article
搜尋研究文章
Site search
Filter by:
Ransomware & extortion
Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks
Crypto24 is a ransomware group that stealthily blends legitimate tools with custom malware, using advanced evasion techniques to bypass security and EDR technologies.
August 14th, 2025 13 min read
Read Article
Ransomware & extortion
New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises
We uncovered a campaign that makes use of Charon, a new ransomware family, and advanced APT-style techniques to target organizations with customized ransom demands.
August 12th, 2025 8 min read
Read Article
Exploits & Zero-Days
Lessons in Resilience from the Race to Patch SharePoint Vulnerabilities
In this article, Trend Micro discusses how the fast-moving attacks using CVE-2025-53770 and CVE-2025-53771 have underscored the essential role of virtual patching and reliable intelligence in protecting organizations against evolving threats.
August 7th, 2025 4 min read
Read Article
Revisiting UNC3886 Tactics to Defend Against Present Risk
We examine the past tactics used by UNC3886 to gain insight on how to best strengthen defenses against the ongoing and emerging threats of this APT group.
July 28th, 2025 9 min read
Read Article
Exploits & Zero-Days
Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
July 22nd, 2025 6 min read
Read Article
Malware
Back to Business: Lumma Stealer Returns with Stealthier Methods
Lumma Stealer has re-emerged shortly after its takedown. This time, the cybergroup behind this malware appears to be intent on employing more covert tactics while steadily expanding its reach. This article shares the latest methods used to propagate this threat.
July 22nd, 2025 9 min read
Read Article
Preventing Zero-Click AI Threats: Insights from EchoLeak
A zero-click exploit called EchoLeak reveals how AI assistants like Microsoft 365 Copilot can be manipulated to leak sensitive data without user interaction. This entry breaks down how the attack works, why it matters, and what defenses are available to proactively mitigate this emerging AI-native threat.
July 15th, 2025 7 min read
Read Article
Ransomware & extortion
BERT Ransomware Group Targets Asia and Europe on Multiple Platforms
BERT is a newly emerged ransomware group that pairs simple code with effective execution—carrying out attacks across Europe and Asia. In this entry, we examine the group’s tactics, how their variants have evolved, and the tools they use to get past defenses and speed up encryption across platforms.
July 7th, 2025 8 min read
Read Article
Exploits & Zero-Days
Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet
This blog uncovers an active campaign exploiting CVE-2025-3248 in Langflow versions before 1.3.0 that deploys the Flodrix botnet, enabling threat actors to achieve full system compromise, initiate DDoS attacks, and potentially exfiltrate sensitive data.
June 17th, 2025 13 min read
Read Article
Ransomware as a Service (RaaS)
Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper
Anubis is an emerging ransomware-as-a-service (RaaS) group that adds a destructive edge to the typical double-extortion model with its file-wiping feature. We explore its origins and examine the tactics behind its dual-threat approach.
June 13th, 2025 8 min read
Read Article