Exploits & Zero-Days
Brotli Flaw Behind 'Node2Shell': What to Patch and Where It Hides
2026年10月28日6 min read
TrendAI™ Research
2026年10月28日
6 min read
Read article
TrendAI™
保安網誌
精選網誌
Exploits & Zero-Days
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now
On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon.
2026年10月22日
Read article
Exploits & Zero-Days
Eight Compromised eMudhra CA Keys: What Happened and What Organizations Should Do Now
Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™.
2026年10月21日
Read article
Exploits & Zero-Days
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook.
2026年10月21日
Read article
搜尋研究文章
Site search
Filter by:
APTs
Earth Lamia Develops Custom Arsenal to Target Multiple Industries
Trend™ Research has been tracking an active APT threat actor named Earth Lamia, targeting multiple industries in Brazil, India and Southeast Asia countries at least since 2023. The threat actor primarily exploits vulnerabilities in web applications to gain access to targeted organizations.
May 27th, 2025 14 min read
Read Article
TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead
Trend™ Research uncovered a campaign on TikTok that uses videos to lure victims into downloading information stealers, a tactic that can be automated using AI tools.
May 21st, 2025 8 min read
Read Article
Cyber threats
Fake CAPTCHA Attacks Deploy Infostealers and RATs in a Multistage Payload Chain
We have detected a new tactic involving fake CAPTCHA pages that trick users into executing harmful commands in Windows. This scheme uses disguised files sent via phishing and other malicious methods.
May 19th, 2025 15 min read
Read Article
Earth Ammit Disrupts Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan
Trend™ Research discusses the evolving tradecraft of threat actor Earth Ammit, proven by the advanced toolset used in its TIDRONE and VENOM campaigns that targeted the drone supply chain.
May 13th, 2025 15 min read
Read Article
Exploits & Zero-Days
Trend Micro Puts a Spotlight on AI at Pwn2Own Berlin
Get a sneak peak into how Trend Micro's Pwn2Own Berlin 2025 is breaking new ground, focusing on AI infrastructure and finding the bugs to proactively safeguard the future of computing.
May 13th, 2025 2 min read
Read Article
Ransomware & extortion
Agenda Ransomware Group Adds SmokeLoader and NETXLOADER to Their Arsenal
During our monitoring of Agenda ransomware activities, we uncovered campaigns that made use of the SmokeLoader malware and a new loader we've named NETXLOADER.
May 7th, 2025 13 min read
Read Article
Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors
An APT group dubbed Earth Kurma is actively targeting government and telecommunications organizations in Southeast Asia using advanced malware, rootkits, and trusted cloud services to conduct cyberespionage.
April 25th, 2025 13 min read
Read Article
APTs
Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations
In this blog entry, we discuss how North Korea's significant role in cybercrime – including campaigns attributed to Void Dokkaebi – is facilitated by extensive use of anonymization networks and the use of Russian IP ranges.
April 23rd, 2025 17 min read
Read Article
Targeted attacks
CrazyHunter Campaign Targets Taiwanese Critical Sectors
This blog entry details research on emerging ransomware group CrazyHunter, which has launched a sophisticated campaign aimed at Taiwan's essential services.
April 16th, 2025 9 min read
Read Article
Malware
BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets
A controller linked to BPF backdoor can open a reverse shell, enabling deeper infiltration into compromised networks. Recent attacks have been observed targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt.
April 14th, 2025 11 min read
Read Article