Joseph C Chen
9 articles
-
ResearchNot Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan
In autumn 2026, companies and other organizations in Japan reported a succession of data leaks from their web systems. The Japanese government’s National Cybersecurity Office issued an alert to businesses on October 9, and the chair of the ruling party’s cybersecurity headquarters described cyberspace as being in a “state of emergency.”
October 27th, 2026 20 minBakuei Matsukawa, Joseph C Chen
Read article -
BlogPeckBirdy：親中駭客集團在 LOLBin 攻擊手法中使用的多功能腳本框架
PeckBirdy 是一個精密的 JScript 幕後操縱 (C&C) 框架，親中 APT 集團利用它在各種環境發動就地取材二進位檔案 (LOLBin) 的攻擊，散播進階後門程式到博弈產業和亞洲政府機關。
January 26th, 2026 12 minTed Lee, Joseph C Chen
Read article -
BlogEarth Lamia Develops Custom Arsenal to Target Multiple Industries
Trend™ Research has been tracking an active APT threat actor named Earth Lamia, targeting multiple industries in Brazil, India and Southeast Asia countries at least since 2023. The threat actor primarily exploits vulnerabilities in web applications to gain access to targeted organizations.
May 27th, 2025 14 minJoseph C Chen
Read article -
BlogEarth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
March 18th, 2024 14 minJoseph C Chen, Daniel Lunghi
Read article -
BlogImpulse Team’s Massive Years-Long Mostly-Undetected Cryptocurrency Scam
We have been able to uncover a massive cryptocurrency scam involving more than a thousand websites handled by different affiliates linked to a program called Impulse Project, run by a threat actor named Impulse Team.
June 6th, 2023 11 minCedric Pernet, Joseph C Chen
Read article -
BlogBIOPASS RAT: New Malware Sniffs Victims via Live Streaming
We discovered a new malware that targets online gambling companies in China via a watering hole attack, in which visitors are tricked into downloading a malware loader disguised as a legitimate installer for well-known apps such as Adobe Flash Player or Microsoft Silverlight.
July 9th, 2021 15 minJoseph C Chen, Kenney Lu, Jaromir Horejsi, Gloria Chen
Read article -
BlogFirst Binder Exploit Linked to SideWinder APT Group
We found malicious apps that work together to compromise devices and collect user data. One of the apps, called Camero, exploits CVE-2019-2215, a flaw that exists in Binder. This is the first instance in the wild that exploits said UAF vulnerability.
January 6th, 2020 5 minEcular Xu, Joseph C Chen
Read article -
BlogFacexWorm Abuses Facebook Messenger for Propagation
Our Cyber Safety Solutions team identified a malicious Chrome extension we named FacexWorm, which uses a miscellany of techniques to target cryptocurrency trading platforms accessed on an affected browser and propagates via Facebook Messenger.
April 30th, 2018 6 minJoseph C Chen
Read article -
BlogGoogle’s DoubleClick Abused to Deliver Miners
On January 24, 2018, we observed that the number of Coinhive web miner detections tripled due to a malvertising campaign. Attackers seem to have abused Google’s DoubleClick, which provides internet ad serving services, for traffic distribution.
January 26th, 2018 2 minChaoying Liu, Joseph C Chen
Read article