trendmicro

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

research.checkpoint.comSep 2, 2026extracted

Detection blind spots: non-standard file formats in malicious email campaigns | Kaspersky official blog

Threat actors are constantly developing new attack schemes — from OAuth token theft to attacks on AI agents — but the classics never quite leave their playbook. On any given day, an employee may receive malware attached directly to an email, or lying in wait behind a link embedded in an email. Making these attacks succeed still requires a degree of creativity, and in recent years attackers have increasingly adopted exotic file formats. Users don’t perceive these formats as dangerous; more importantly, many EDR and email security solutions skip scanning them entirely. Yet they’ve proven highly effective for deploying malware or harvesting credentials. Below are the file types that may be blind spots in your organization’s detection strategy — despite being observed as used in real-world attacks. Disk images This is the broadest and most dangerous attachment category. A disk image can contain a fully prepared, correctly structured set of files tailored to a wide range of attack scenarios. It mounts as a separate volume (standalone virtual disk), and when doing so often uses tools built into the operating system. The victim doesn’t need to extract anything or create suspicious folders on disk. The most versatile format is ISO, which dates back to the heyday of multimedia CDs. ISO images mount natively on every major OS without additional utilities, whether through simple tools like File Explorer or via the command line interface. This is precisely why threat actors have no hesitation in sending ISO files as email attachments . Somewhat less common are IMG containers, which also mount without additional tooling on macOS or Linux, but require installing a small, free utility such as OSFMount on Windows, or using WSL2 (Windows Subsystem for Linux), which is built into recent Windows versions. A file with identical content may also carry a DD extension. Threat actors also make use of VHD , a virtual disk format native to Windows, which generally works on Linux machines as well (via qemu-nbd or guestmount). On macOS, an additional utility — again, qemu-nbd is a common choice — is required to mount it. Note that on unpatched Windows systems, the victim doesn’t need to take any further action after the disk mounts: CVE-2025-24993 — a vulnerability actively exploited in real-world attacks — triggers attacker code execution immediately upon mounting the image. For completeness’ sake, VMDK, the disk image format used by VMware, is also worth detecting, though it’s largely ineffective in attacks on regular users since every popular OS requires additional software to mount it. All of these image formats can be viewed and unpacked not only with specialized tools, but with standard archive utilities like 7-Zip or RAR. As a result, the odds that the user will fall for the bait are higher than one might hope. In addition to not being a well-known potentially dangerous format, image files give attackers one further advantage: files extracted from disk images on Windows frequently lack the Mark of the Web flag, and therefore can be launched without triggering additional system warnings. There’s one more reason why EPP/EDR solutions must scan virtual machines and disk images: these formats are also used during later stages of an attack. To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim’s computer. The RagnarLocker ransomware strain has used VirtualBox for this purpose, while the CRON#TRAP campaign relied on a QEMU environment. MS Office files No, this isn’t about macro-laced DOC files. Microsoft has grown weary enough of this classic attack vector that macros in downloaded documents are now blocked outright , and enabling them requires considerable effort from the user. But Office relies on dozens of file formats, and some of the less common ones still occasionally give attackers an edge. Less familiar to both users and security solutions are OneNote files (.one). These are essentially simple notes, but they can carry embedded attachments, including not just images and links, but VBS/WSF/BAT scripts as well. Within the note, an attachment normally displays as an icon, but attackers overlay it with a picture showing a message with a “View” button. Another Office format popular with attackers is the Excel add-in. These files use the .xll extension but are, in effect, full-fledged Windows dynamic-link libraries (DLLs), and therefore may have extensive functionality. Victims receive a malicious email with what looks like an invoice; the icon suggests that the file will open in Excel. Ignoring the security warning may result in an infostealer infection . SVG “graphics” The description of the SVG (Scalable Vector Graphics) format sounds entirely innocuous. Indeed, 99% of SVG files are logos and interface icons. But unlike PNG or JPG, SVG files are fundamentally XML documents, and beyond points, lines and fills they can contain JavaScript. In terms of malicious potential, SVG is not far behind a full web page. In real-world attacks , SVG files can redirect a user to a phishing page immediately upon opening, or render the phishing page directly by unpacking a Base64-encoded block into full HTML. SVG files pose a distinct risk to corporate portals that accept user file uploads. If a portal’s Content Security Policy (CSP) isn’t sufficiently restrictive, and lets someone upload a malicious SVG file, the embedded JavaScript can steal cookies from the page, inject unauthorized content, and carry out similar attacks. Polyglot files Polyglot file formats are less exotic in and of themselves, but the files carry more than meets the eye. They’re called polyglots because attackers construct a file that can be validly interpreted in multiple ways: for example, it can be a valid ZIP archive and a valid executable at the same time. The purpose is purely to evade detection by security solutions and deceive the user. We’ve covered polyglots in detail in a separate blog post . The clear standout in our roundup is a malicious campaign distributing the IcedID infostealer . Victims receive emails with a ZIP attachment, which unpacks into an ISO disk image. That further unpacks into a CHM file (the Windows Help format) that’s also correctly processed as an mshta (Microsoft HTML Application host) application, which then downloads the primary malware payload. Defending against exotic files These attacks rely on the assumption that security solutions either don’t scan unusual file formats, or scan them only superficially. Preventing the threat starts with not operating on that assumption with regard to your own infrastructure: Configure EDR , web, and email filters to scan all of the file formats described above. Process archives and disk images with the same rigor as you would apply to executables. Detonate potentially dangerous file types in a sandbox, and configure recursive unpacking of nested formats through to the end of the chain: ZIP → ISO → CHM. Where feasible, quarantine all file formats anomalous for email — disk images in particular. Build detection rules for anomalous usage patterns that involve exotic files. For example, unusually small disk images are rare and are therefore worth investigating. Review the technical documentation of your security solutions to confirm that complex formats are detected through deep structural parsing rather than magic-byte checks alone. Deploy behavioral detection capable of flagging anomalous execution patterns and legitimate utilities launched from unexpected contexts. The usual suspects here include mshta, git, wscript, hh, and rundll32. SVG files warrant a dedicated policy. Treat SVGs as active content at the email and web perimeter. On corporate portals, enforce a strict CSP, and serve user-uploaded files from a separate subdomain so that a malicious script embedded in an SVG can’t access the session on the main portal.

kaspersky.comAug 28, 2026extracted

Tracking TamperedChef Clusters via Certificate and Code Reuse

unit42.paloaltonetworks.comMay 20, 2026extracted

[Guest Diary] New Malware Libraries means New Signatures, (Fri, May 15th)

Introduction The SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 is one of the most-observed Outlaw / Shellbot artifacts on the public internet. VirusTotal first ingested it on 5 July 2018 [2]. It is the SHA-256 of the authorized_keys file written by the campaign whose persistence comment string is mdrfckr, a campaign documented in handler diaries, vendor reports, and independent honeypot research for nearly seven years. This diary does not announce a new campaign. The file hash, the public key, the mdrfckr comment string, the chattr -ia .ssh defensive disarm, the chpasswd account hijack, and the /tmp/secure.sh competitor cleanup are all well-described in prior reporting [3][4][5][6][7]. What this diary does add is one new data point in an existing lineage: between 14 and 21 April 2026, my DShield sensor [8] observed the mdrfckr campaign using a third libssh client version that has not, to my knowledge, been published as part of this campaign’s hassh chronology. The botnet’s authorized_keys file is unchanged across four years. Its SSH client library is on its third documented major version. Detection rules pinned to the older hasshes will miss the current generation. The point of this diary is to put the prior reports side by side with my April 2026 observation, document the new hassh, and offer detection-engineering guidance for handlers maintaining mdrfckr-aware rules. What is already known I want to be careful to credit the prior work this diary builds on, because the new contribution is small relative to it. The mdrfckr persistence key was first associated with the Outlaw / Dota family by Trend Micro in 2018 [3], with subsequent updates in 2019 and follow-up reporting from Anomali, Yoroi [9], Juniper [10], CounterCraft [11], Cybereason, and Kaspersky. The recon command sequence and the competitor-cleanup playbook are described across that body of work. None of the file or behaviour signatures discussed in this diary are novel. In late 2022 and early 2023, the port22.dk blog [4][7] published a two-part deep dive on the campaign. Part one (data from October–November 2022) observed 12,913 unique IPs writing the mdrfckr key from a network of 10 honeypots. Crucially, the post introduced hassh-based clustering as a defender’s tool: 99.1% of the observed mdrfckr-key writes shared the hassh 51cba57125523ce4b9db67714a90bf6e, which corresponds to the SSH client banner SSH-2.0-libssh-0.6.0 / SSH-2.0-libssh-0.6.3. Part two (data from December 2022 onward) documented the campaign migrating to a second hassh f555226df1963d1d3c09daf865abdc9a, corresponding to SSH-2.0-libssh_0.9.5 / SSH-2.0-libssh_0.9.6, with ~30,000 unique IPs across the new fingerprint and a 94.5% confidence link. Part two also documented two new related command variants: chattr -ia .ssh; lockr -ia .ssh as a separate command, and lockr -ia .ssh run on its own, executed alongside the original key-write command. In May 2023, a SANS ISC diary by Jesse La Grew [5] presented two example sessions writing the same SHA-256, captured via a cowrie-log enrichment script. One session originated from a DigitalOcean datacentre IP; the other from a VPN-fronted Tencent IP. Both sessions executed the post-December-2022 split-command variant. In May / June 2023, Guy Bruneau’s monthly DShield diary [6] noted the same key-write playbook in honeypot data and attributed it explicitly to the Outlaw group via the original Trend Micro reporting. That is the public chronology this observation extends. What the April 2026 sensor saw Between 2026-04-14 01:23:41 UTC and 2026-04-21 02:22:56 UTC, my DShield sensor logged 24 unique source IPs writing the SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to /root/.ssh/authorized_keys (and to other compromised account paths). The cluster wrote 229 authorized_keys modifications across 1,230 SSH sessions and executed 4,133 post-authentication commands. The peak burst occurred on 19 April 2026: 20 of the 24 IPs first connected to the sensor between 06:05:19 UTC and 06:07:30 UTC, a 131-second window. The remaining four IPs appeared on neighbouring days but executed the same playbook with the same key. The defensive-disarm and key-write command observed across every successful session is the post-December-2022 split variant documented by port22 part two: The new data point is the SSH client. The new hassh: libssh 0.11.x Every one of the 24 IPs in the April 2026 cluster advertised the SSH client banner SSH-2.0-libssh_0.11.1 and produced the hassh fingerprint 03a80b21afa810682a776a7d42e5e6fb. This hassh does not match the hashes documented in port22 parts one and two, nor in the May 2023 ISC diary. A hassh is a hash of the SSH client’s advertised cipher, MAC, key-exchange, and compression algorithm lists [12]. Different libssh major versions ship with different default algorithm preferences, so each new libssh version a campaign adopts produces a new hassh. The 2026 hassh 03a80b21afa810682a776a7d42e5e6fb is the third documented entry in this campaign’s libssh version walk, separated from port22’s last published value by approximately three years and one major libssh version (0.9 → 0.10 → 0.11). I do not have a baseline of how prevalent this hassh is across the full DShield sensor population - that is the question I would most like other handlers and DShield operators to help answer. On my single sensor, this hassh accounted for 3,473 SSH log lines across the eight-day window, making it the most active SSH attacker-tooling fingerprint observed during the period. The 24-IP burst: small confirmation of an existing observation Twenty of the 24 cluster IPs first connected within a 131-second window. This is consistent with the coordination behaviour documented at much larger scale by port22, and does not represent a new claim. I mention it only for completeness, and because it has one practical implication for detection: per-source-IP rate limits (fail2ban, sshguard) will not trigger on this pattern because each IP performs only ~10 login attempts. Detection rules useful against this campaign should aggregate by target account rather than by source IP - ten distinct IPs attempting steam:Steam29! against the same host within five minutes is a stronger signature than any individual IP’s behaviour. The cluster IPs and the credential dictionary are listed in the indicators section. None of the credential pairs are new: steam:Steam29!, postgres:q1, dev:dev5, sammy:sammy26, root:AAAaaa111, root:root000@, sysadmin:test123, test1:passwd, tester:testerpass, sammy:12345. This is the existing Outlaw target list. Why this matters for defenders The detection-engineering implication of the libssh version walk is straightforward: hassh-based detection rules written in 2022 or 2023 against 51cba57125523ce4b9db67714a90bf6e or f555226df1963d1d3c09daf865abdc9a will silently miss the 2026 generation of the same campaign. The SHA-256 of the authorized_keys file remains the most reliable single indicator (it has not changed in four years), but operators relying on hassh enrichment as a leading indicator - for example, alerting on hassh values before a successful authentication occurs - should add 03a80b21afa810682a776a7d42e5e6fb to their watch lists. More broadly, the four-year libssh version walk suggests the campaign operator (or operators - the persistence model has always been consistent with shared infrastructure rather than self-propagation in the strict sense) keeps the targeting infrastructure stable while letting the underlying client library age forward. A defender writing a detection rule against this campaign should expect the hassh to change again on a roughly multi-year cadence as libssh ships new defaults, and should pin alerting to the SHA-256, the public key blob, the mdrfckr comment string, and the recon command sequence - none of which have changed since 2018 - rather than to any single hassh value. What I am not claiming The 24-IP April 2026 cluster is much smaller than the populations port22 worked with. I cannot meaningfully extend port22’s hassh-confidence statistics from one sensor’s eight-day window. The 99.1% / 94.5% figures published in 2022 and 2023 should not be extrapolated to the 2026 hassh from this data alone - that calculation requires a multi-sensor population study, which is exactly the kind of analysis ISC handlers and the DShield operator community are positioned to do better than any of my sensors. Indicators authorized_keys SHA-256 (unchanged since 2018):a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 Public key comment string: mdrfckr April 2026 hassh: 03a80b21afa810682a776a7d42e5e6fb April 2026 SSH client banner: SSH-2.0-libssh_0.11.1 Burst window: 19 April 2026, 06:05:19 → 06:07:30 UTC Credential dictionary: steam:Steam29! ,postgres:q1 ,dev:dev5 ,sammy:sammy26 ,root:AAAaaa111 ,root:root000@ ,sysadmin:test123 ,test1:passwd ,tester:testerpass ,sammy:12345 24 source IPs from the April 2026 cluster (Appendix A) Conclusion The mdrfckr campaign is older than many of the SSH honeypots currently watching it. Its authorized_keys file is approaching its eighth anniversary on VirusTotal and has not been rotated. Its target dictionary, recon sequence, and competitor-cleanup playbook have all remained stable across the four years that public researchers have been tracking the libssh version walk. What changes is the client. The April 2026 hassh 03a80b21afa810682a776a7d42e5e6fb joins 51cba57125523ce4b9db67714a90bf6e and f555226df1963d1d3c09daf865abdc9a as the third documented entry in this campaign’s lineage. Detection rules pinned to either earlier hassh will miss it. I would be very interested to hear from any other DShield operator or ISC handler who has independently observed the 0.11.x hassh writing the SHA-256 above - particularly with population data that would let the community update the hassh-to-mdrfckr confidence figures published by port22 in 2022 and 2023. Acknowledgments Drafting assistance from Claude (Anthropic) [13]. All log review, the hassh and SHA-256 verification, the credential and IP enumeration, and the comparison against prior reporting were done from the sensor’s own logs and the cited public sources. References [3] Trend Micro, https://www.trendmicro.com/en/research/20/b/outlaw-updates-kit-to-kill-older-miner-versions-targets-more-systems.html [4] port22.dk, “mdrfckrs – part one,” March 2023. https://blog.port22.dk/mdrfckrs-part-one/ [5] Jesse La Grew, “More Data Enrichment for Cowrie Logs,” SANS Internet Storm Center, 24 May 2023. https://isc.sans.edu/diary/29878 [6] Guy Bruneau, “DShield Honeypot Activity for May 2023,” SANS Internet Storm Center, 11 June 2023. https://isc.sans.edu/diary/29932 [7] port22.dk, “mdrfckrs – part two,” July 2023. https://blog.port22.dk/mdrfckrs-part-two/ [8] https://isc.sans.edu/honeypot.html [9] Yoroi, “Outlaw is Back: A New Crypto-Botnet Targets European Organizations.” https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/ [10] Juniper Threat Research, “Dota3: Is your Internet of Things device moonlighting?” https://blogs.juniper.net/en-us/threat-research/dota3-is-your-internet-of-things-device-moonlighting [11] CounterCraft, “Dota3 malware again and again.” https://www.countercraftsec.com/blog/dota3-malware-again-and-again/

isc.sans.eduMay 15, 2026extracted

Organizations Overlook AI Risk as Governance Fails to Keep Up

Stay connected with press releases from Trend teams in your region. TrendAI™ research reveals pressure to deploy AI for business speed is outpacing control, visibility and accountability DALLAS, March 25, 2026 /PRNewswire/ -- TrendAI™, the enterprise AI security leader from Trend Micro Incorporated (TYO: 4704; TSE: 4704), has published new research revealing that organizations worldwide are pushing ahead with AI deployment despite known security and compliance risks. To read the full report visit: https://www.trendmicro.com/explore/trendai-global-ai-study/ The new global study of 3,700 business and IT decision makers found that 67% have felt pressured to approve AI despite security concerns, with one in seven describing those concerns as "extreme" but overridden to keep pace with competitors and internal demand. Rachel Jin, Chief Platform & Business Officer, Head of TrendAI: "Organizations are not lacking awareness of risk, they're lacking the conditions to manage it. When deployment is driven by competitive pressure rather than governance maturity, you create a situation where AI is embedded into critical systems without the controls needed to manage it safely. This research reenforces our focus on helping organizations drive solid business outcomes with AI while still managing business risk." The risk of pressure-driven AI rollout is exacerbated by governance inconsistencies and unclear responsibility for AI risk that are becoming widespread. The same is true for security teams working on a reactive basis to top-down AI rollout decisions, which often leads to workarounds and increased use of unsanctioned or "shadow" AI tools. Recent TrendAI™ threat research reinforces this shift, showing how attackers are already using AI to automate reconnaissance, accelerate phishing campaigns and lower the barrier to entry for cybercrime, increasing both the speed and scale of attacks. AI adoption is outpacing control Organizations are deploying AI faster than they can manage the associated risks, creating a widening gap between ambition and oversight. 57% say AI is advancing more quickly than they can secure it, while more than half (64%) report only moderate confidence in their understanding of the legal frameworks governing AI. Governance maturity remains low. Only around a third (38%) of organizations have comprehensive AI policies in place, with many still drafting them, and 41% cite unclear regulation or compliance standards as a barrier. In practice, AI is being operationalized before the rules governing its use are fully established. Trust in autonomous AI remains uncertain Confidence in more advanced, autonomous systems is still in the maturing phase. Less than half (48%) believe agentic AI will significantly improve cyber defense in the short term, with ongoing concerns around data access, misuse and lack of oversight. The data shows where those concerns are landing. More than four in ten organizations (44%) say AI agents accessing sensitive data is their biggest risk. Over a third (36%) warn malicious prompts could compromise security, while one in three (33%) point to a growing attack surface for cyber criminals. A similar proportion (33%) fear abuse of trusted AI status and risks linked to autonomous code deployment. At the same time, nearly a third (31%) admit they lack observability or auditability over these systems, raising serious questions about how organizations can control or intervene once agents are deployed. Around 40% of organizations support the introduction of AI "kill switch" mechanisms to shut down systems in the event of failure or misuse, while nearly half remain unsure. This lack of consensus highlights a deeper issue. Organizations are moving towards autonomous AI without agreement on how to retain control when it matters most. "Agentic AI is moving organizations into a new risk category," added Rachel Jin. "Our research shows the concerns are already clear, from sensitive data exposure to loss of oversight. Without visibility and control, organizations are deploying systems they don't fully understand or govern, and that risk is only going to increase unless action is taken." About TrendAI™ TrendAI™, a global leader in AI security, empowers enterprises to innovate fearlessly by securing AI, cloud, networks, endpoints, and data across the modern attack surface. At the core is TrendAI Vision One™, a unified cybersecurity platform that centralizes cyber risk exposure management and security operations to protect the entire AI lifecycle from infrastructure to models to users. The platform is fueled by world-class threat intelligence and insights that protect organizations from hundreds of millions of threats every day. With 6,000 TrendAI™ experts across 75 countries, TrendAI™ empowers security leaders to stay ahead of threats, driving proactive security outcomes across the entire attack surface. This includes critical environments like AWS, Google, Microsoft, and NVIDIA. AI Fearlessly. SOURCE TrendAI

newsroom.trendmicro.comMar 25, 2026extracted

HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns

Over the past few years, we’ve been observing and monitoring the espionage activities of HoneyMyte (aka Mustang Panda or Bronze President) within Asia and Europe, with the Southeast Asia region being the most affected. The primary targets of most of the group’s campaigns were government entities. As an APT group, HoneyMyte uses a variety of sophisticated tools to achieve its goals. These tools include ToneShell, PlugX, Qreverse and CoolClient backdoors, Tonedisk and SnakeDisk USB worms, among others. In 2025, we observed HoneyMyte updating its toolset by enhancing the CoolClient backdoor with new features, deploying several variants of a browser login data stealer, and using multiple scripts designed for data theft and reconnaissance. Additional information about this threat, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service. If you are interested, please contact [email protected]. CoolClient backdoor An early version of the CoolClient backdoor was first discovered by Sophos in 2022, and TrendMicro later documented an updated version in 2023. Fast forward to our recent investigations, we found that CoolClient has evolved quite a bit, and the developers have added several new features to the backdoor. This updated version has been observed in multiple campaigns across Myanmar, Mongolia, Malaysia and Russia where it was often deployed as a secondary backdoor in addition to PlugX and LuminousMoth infections. In our observations, CoolClient was typically delivered alongside encrypted loader files containing encrypted configuration data, shellcode, and in-memory next-stage DLL modules. These modules relied on DLL sideloading as their primary execution method, which required a legitimate signed executable to load a malicious DLL. Between 2021 and 2025, the threat actor abused signed binaries from various software products, including BitDefender, VLC Media Player, Ulead PhotoImpact, and several Sangfor solutions. The latest CoolClient version analyzed in this article abuses legitimate software developed by Sangfor. Below, you can find an overview of how it operates. It is worth noting that its behavior remains consistent across all variants, except for differences in the final-stage features. However, it is worth noting that in another recent campaign involving this malware in Pakistan and Myanmar, we observed that HoneyMyte has introduced a newer variant of CoolClient that drops and executes a previously unseen rootkit. A separate report will be published in the future that covers the technical analysis and findings related to this CoolClient variant and the associated rootkit. CoolClient functionalities In terms of functionality, CoolClient collects detailed system and user information. This includes the computer name, operating system version, total physical memory (RAM), network details (MAC and IP addresses), logged-in user information, and descriptions and versions of loaded driver modules. Furthermore, both old and new variants of CoolClient support file upload to the C2, file deletion, keylogging, TCP tunneling, reverse proxy listening, and plugin staging/execution for running additional in-memory modules. These features are still present in the latest versions, alongside newly added functionalities. In this latest variant, CoolClient relies on several important files to function properly: Parameter modes in second-stage DLL CoolClient typically requires three parameters to function properly. These parameters determine which actions the malware is supposed to perform. The following parameters are supported. Final stage DLL The write.exe process decrypts and launches the main.dat file, which contains the third (final) stage DLL. CoolClient’s core features are implemented in this DLL. When launched, it first checks whether the keylogger, clipboard stealer, and HTTP proxy credential sniffer are enabled. If they are, CoolClient creates a new thread for each specific functionality. It is worth noting that the clipboard stealer and HTTP proxy credential sniffer are new features that weren’t present in older versions. Clipboard and active windows monitor A new feature introduced in CoolClient is clipboard monitoring, which leverages functions that are typically abused by clipboard stealers, such as GetClipboardData and GetWindowTextW, to capture clipboard information. CoolClient also retrieves the window title, process ID and current timestamp of the user’s active window using the GetWindowTextW API. This information enables the attackers to monitor user behavior, identify which applications are in use, and determine the context of data copied at a given moment. The clipboard contents and active window information are encrypted using a simple XOR operation with the byte key 0xAC, and then written to a file located at C:\ProgramData\AppxProvisioning.xml. HTTP proxy credential sniffer Another notable new functionality is CoolClient’s ability to extract HTTP proxy credentials from the host’s HTTP traffic packets. To do so, the malware creates dedicated threads to intercept and parse raw network traffic on each local IP address. Once it is able to intercept and parse the traffic, CoolClient starts extracting proxy authentication credentials from HTTP traffic intercepted by the malware’s packet sniffer. The function operates by analyzing the raw TCP payload to locate the Proxy-Connection header and ensure the packet is relevant. It then looks for the Proxy-Authorization: Basic header, extracts and decodes the Base64-encoded credential and saves it in memory to be sent later to the C2. C2 command handler The latest CoolClient variant uses TCP as the main C2 communication protocol by default, but it also has the option to use UDP, similar to the previous variant. Each incoming payload begins with a four-byte magic value to identify the command family. However, if the command is related to downloading and running a plugin, this value is absent. If the client receives a packet without a recognized magic value, it switches to plugin mode (mechanism used to receive and execute plugin modules in memory) for command processing. 0xFFAABBCC – Beacon and configuration commands Below is the command menu to manage client status and beaconing: 0xFFAABBCD – Operational commands This command group implements functionalities such as data theft, proxy setup, and file manipulation. The following is a breakdown of known subcommands: CoolClient plugins CoolClient supports multiple plugins, each dedicated to a specific functionality. Our recent findings indicate that the HoneyMyte group actively used CoolClient in campaigns targeting Mongolia, where the attackers pushed and executed a plugin named FileMgrS.dll through the C2 channel for file management operations. Further sample hunting in our telemetry revealed two additional plugins: one providing remote shell capability (RemoteShellS.dll), and another focused on service management (ServiceMgrS.dll). ServiceMgrS.dll – Service management plugin This plugin is used to manage services on the victim host. It can enumerate all services, create new services, and even delete existing ones. The following table lists the command IDs and their respective actions. FileMgrS.dll – File management plugin A few basic file operations are already supported in the operational commands of the main CoolClient implant, such as listing directory contents and deleting files. However, the dedicated file management plugin provides a full set of file management capabilities. RemoteShellS.dll – Remote shell plugin Based on our analysis of the main implant, the C2 command handler did not implement remote shell functionality. Instead, CoolClient relied on a dedicated plugin to enable this capability. This plugin spawns a hidden cmd.exe process, redirecting standard input and output through pipes, which allows the attacker to send commands into the process and capture the resulting output. This output is then forwarded back to the C2 server for remote interaction. Browser login data stealer While investigating suspicious ToneShell backdoor traffic originating from a host in Thailand, we discovered that the HoneyMyte threat actor had downloaded and executed a malware sample intended to extract saved login credentials from the Chrome browser as part of their post-exploitation activities. We will refer to this sample as Variant A. On the same day, the actor executed a separate malware sample (Variant B) targeting credentials stored in the Microsoft Edge browser. Both samples can be considered part of the same malware family. During a separate threat hunting operation focused on HoneyMyte’s QReverse backdoor, we retrieved another variant of a Chrome credential parser (Variant C) that exhibited significant code similarities to the sample used in the aforementioned ToneShell campaign. The malware was observed in countries such as Myanmar, Malaysia, and Thailand, with a particular focus on the government sector. The following table shows the variants of this browser credential stealer employed by HoneyMyte. These stealers may be part of a new malware toolset used by HoneyMyte during post-exploitation activities. Initial infection As part of post-exploitation activity involving the ToneShell backdoor, the threat actor initially executed the Variant A stealer, which targeted Chrome credentials. However, we were unable to determine the exact delivery mechanism used to deploy it. A few minutes later, the threat actor executed a command to download and run the Variant B stealer from a remote server. This variant specifically targeted Microsoft Edge credentials. Within the same hour that Variant B was downloaded and executed, we observed the threat actor issue another command to exfiltrate the Firefox browser cookie file (cookies.sqlite) to Google Drive using a curl command. Variant C analysis Unlike Variants A and B, which use hardcoded file paths, the Variant C stealer accepts two runtime arguments: file paths to the browser’s Login Data and Local State files. This provides greater flexibility and enables the stealer to target any Chromium-based browser such as Chrome, Edge, Brave, or Opera, regardless of the user profile or installation path. An example command used to execute Variant C is as follows: In this context, the Login Data file is an SQLite database that stores saved website login credentials, including usernames and AES-encrypted passwords. The Local State file is a JSON-formatted configuration file containing browser metadata, with the most important value being encrypted_key, a Base64-encoded AES key. It is required to decrypt the passwords stored in the Login Data database and is also encrypted. When executed, the malware copies the Login Data file to the user’s temporary directory as chromeTmp. To retrieve saved credentials, the malware executes the following SQL query on the copied database: This query returns the login URL, stored username, and encrypted password for each saved entry. Next, the malware reads the Local State file to extract the browser’s encrypted master key. This key is protected using the Windows Data Protection API (DPAPI), ensuring that the encrypted data can only be decrypted by the same Windows user account that created it. The malware then uses the CryptUnprotectData API to decrypt this key, enabling it to access and decrypt password entries from the Login Data SQLite database. With the decrypted AES key in memory, the malware proceeds to decrypt each saved password and reconstructs complete login records. Finally, it saves the results to the text file C:\Users\Public\Libraries\License.txt. Login data stealer’s attribution Our investigation indicated that the malware was consistently used in the ToneShell backdoor campaign, which was attributed to the HoneyMyte APT group. Another factor supporting our attribution is that the browser credential stealer appeared to be linked to the LuminousMoth APT group, which has previously been connected to HoneyMyte. Our analysis of LuminousMoth’s cookie stealer revealed several code-level similarities with HoneyMyte’s credential stealer. For example, both malware families used the same method to copy targeted files, such as Login Data and Cookies, into a temporary folder named ChromeTmp, indicating possible tool reuse or a shared codebase. Both stealers followed the same steps: they checked if the original Login Data file existed, located the temporary folder, and copied the browser data into a file with the same name. Based on these findings, we assess with high confidence that HoneyMyte is behind this browser credential stealer, which also has a strong connection to the LuminousMoth APT group. Document theft and system information reconnaissance scripts In several espionage campaigns, HoneyMyte used a number of scripts to gather system information, conduct document theft activities and steal browser login data. One of these scripts is a batch file named 1.bat. 1.bat – System enumeration and data exfiltration batch script The script starts by downloading curl.exe and rar.exe into the public folder. These are the tools used for file transfer and compression. It then collects network details and downloads and runs the nbtscan tool for internal network scanning. During enumeration, the script also collects information such as stored credentials, the result of the systeminfo command, registry keys, the startup folder list, the list of files and folders, and antivirus information into a file named log.dat. It then uploads this file via FTP to http://113.23.212[.]15/pub/. Next, it deletes both log.dat and the nbtscan executable to remove traces. The script then terminates browser processes, compresses browser-related folders, retrieves FileZilla configuration files, archives documents from all drives with rar.exe, and uploads the collected data to the same server. Finally, it deletes any remaining artifacts to cover its tracks. Ttraazcs32.ps1 – PowerShell-based collection and exfiltration The second script observed in HoneyMyte operations is a PowerShell file named Ttraazcs32.ps1. Similar to the batch file, this script downloads curl.exe and rar.exe into the public folder to handle file transfers and compression. It collects computer and user information, as well as network details such as the public IP address and Wi-Fi network data. All gathered information is written to a file, compressed into a password-protected RAR archive and uploaded via FTP. In addition to system profiling, the script searches multiple drives including C:\Users\Desktop, Downloads, and drives D: to Z: for recently modified documents. Targeted file types include .doc, .xls, .pdf, .tif, and .txt, specifically those changed within the last 60 days. These files are also compressed into a password-protected RAR archive and exfiltrated to the same FTP server. t.ps1 – Saved login data collection and exfiltration The third script attributed to HoneyMyte is a PowerShell file named t.ps1. The script requires a number as a parameter and creates a working directory under D:\temp with that number as the directory name. The number is not related to any identifier. It is simply a numeric label that is probably used to organize stolen data by victim. If the D drive doesn’t exist on the victim’s machine, the new folder will be created in the current working directory. The script then searches the system for Chrome and Chromium-based browser files such as Login Data and Local State. It copies these files into the target directory and extracts the encrypted_key value from the Local State file. It then uses Windows DPAPI (System.Security.Cryptography.ProtectedData) to decrypt this key and writes the decrypted Base64-encoded key into a new file named Local State-journal in the same directory. For example, if the original file is C:\Users\$username \AppData\Local\Google\Chrome\User Data\Local State, the script creates a new file C:\Users\$username\AppData\Local\Google\Chrome\User Data\Local State-journal, which the attacker can later use to access stored credentials. Once the credential data is ready, the script verifies that both rar.exe and curl.exe are available. If they are not present, it downloads them directly from Google Drive. The script then compresses the collected data into a password-protected archive (the password is “PIXELDRAIN”) and uploads it to pixeldrain.com using the service’s API, authenticated with a hardcoded token. Pixeldrain is a public file-sharing service that attackers abuse for data exfiltration. This approach highlights HoneyMyte’s shift toward using public file-sharing services to covertly exfiltrate sensitive data, especially browser login credentials. Conclusion Recent findings indicate that HoneyMyte continues to operate actively in the wild, deploying an updated toolset that includes the CoolClient backdoor, a browser login data stealer, and various document theft scripts. With capabilities such as keylogging, clipboard monitoring, proxy credential theft, document exfiltration, browser credential harvesting, and large-scale file theft, HoneyMyte’s campaigns appear to go far beyond traditional espionage goals like document theft and persistence. These tools indicate a shift toward the active surveillance of user activity that includes capturing keystrokes, collecting clipboard data, and harvesting proxy credential. Organizations should remain highly vigilant against the deployment of HoneyMyte’s toolset, including the CoolClient backdoor, as well as related malware families such as PlugX, ToneShell, Qreverse, and LuminousMoth. These operations are part of a sophisticated threat actor strategy designed to maintain persistent access to compromised systems while conducting high-value surveillance activities. Indicators of compromise CoolClient F518D8E5FE70D9090F6280C68A95998F libngs.dll 1A61564841BBBB8E7774CBBEB3C68D5D loader.dat AEB25C9A286EE4C25CA55B72A42EFA2C main.dat 6B7300A8B3F4AAC40EEECFD7BC47EE7C time.dat CoolClient plugins 7AA53BA3E3F8B0453FFCFBA06347AB34 ServiceMgrS.dll A1CD59F769E9E5F6A040429847CA6EAE FileMgrS.dll 1BC5329969E6BF8EF2E9E49AAB003F0B RemoteShellS.dll Browser login data stealer 1A5A9C013CE1B65ABC75D809A25D36A7 Variant A E1B7EF0F3AC0A0A64F86E220F362B149 Variant B DA6F89F15094FD3F74BA186954BE6B05 Variant C Scripts C19BD9E6F649DF1DF385DEEF94E0E8C4 1.bat 838B591722512368F81298C313E37412 Ttraazcs32.ps1 A4D7147F0B1CA737BFC133349841AABA t.ps1 CoolClient C2 account.hamsterxnxx[.]com popnike-share[.]com japan.Lenovoappstore[.]com FTP server 113.23.212[.]15

securelist.comJan 27, 2026extracted

Battling Cryptojacking, Botnets, and IABs [Guest Diary], (Thu, Jan 15th)

[This is a Guest Diary by Matthew Presnal, an ISC intern as part of the SANS.edu BACS program] Cryptojacking and botnets can pose a greater threat than a simple drain of resources. These organizations have been known to engage in “DDoS for Hire” or even selling off footholds, acting as Initial Access Brokers (IABs). To better understand how to get ahead of the adversary, I am going to walk you through the real-world attacks observed on my DShield honeypot and attempt to better predict their next steps. Early Recognition As we know from a certain company's model for stopping attacks (I'll let you fill in the blanks), the earlier you are able to break the chain, the better the outcome. While the ideal situation is to have impenetrable defenses, thus making it so you have nothing to worry about, that is just not realistic. If we are able to recognize early signs of a potential attack, i.e recon, we can posture or even preempt the attack by implementing hardening that we may otherwise avoid due to operational impact. The screenshot below is from recent activity observed on my honeypot. In this instance, the IP points back to a Digital Ocean machine, but I have numerous other accounts of this exact script being run to enumerate the system from several other IPs outside of this range. In the interest of readability, I have supplied the enumeration script here: At this stage, the threat actor already has access (this resulted from SSH spraying), and they are enumerating the machine for kernel info, system architecture, uptime, CPU model and capabilities, GPU info, binary versions, and login info. They then output all of this information in a standardized format to be parsed, either via an automated process or handed off to someone to start building persistence/determining if the system is suitable for the botnet. In a real environment recognizing this as a potential adversarial first step does a few different things for us in addition to activating the Incident Response Plan (IRP): 1. It gives us the opportunity to ensure adequate coverage of the network 2. An opportunity to start diverting traffic away from a known compromised machine and introducing isolation/quarantining the machine 3. The ability to “play by play” adversarial actions and build detection rules that can be implemented across the network 4. Roll out hardening tailored to the adversarial activity to enact the “Pyramid of Pain” at the TTP level (Bonus points if you are able to attribute the attack real-time) Actions on Objective The attack chain below was witnessed on the same honeypot, and I believe it to be part of the same “run book” presumably carried out by the cryptojacking and botnet organization “Outlaw": Actor IP: 197.221.232.44 Kibana GeoIP: Harare, Zimbabwe The first several lines of this chain are more enumeration and situational awareness, gathering more system info, user info, processes, and even which users are logged in with the ‘w’ command. The first real exploitation action starts with the recursive remove command, prepping the system for the SSH persistence mechanism Outlaw is known for. Malware In the interest of brevity, this section will not go into any real depth but will rather attempt to further flesh out the post-exploitation phase of the attack. As you can see in the screenshots below, the hash of the malware downloaded on the honeypot is identified as a Trojan and a Miner, and it has references to a ‘zombie’ within the strings of the code itself suggesting likely botnet involvement. This malware stems from a series of Chinese IPs that are all within the same ASN. While I cannot directly relate these to the suspected “Outlaw” scripts earlier, the Kibana logs are interesting for these IPs. They all start with a successful SSH connection and quickly move to an SFTP transfer of the malware. The malware itself appears to be a Go binary which is a deviation from the expected “Perl-based backdoor” noted by TrendMicro [4]. With this unlikely to be “Outlaw” directly, I am choosing to include this activity for two main reasons: 1) I am using “Outlaw” activity as more of a threat model rather than the group being the primary subject for this post 2) Each occurrence of this payload is precluded by activity identical or nearly identical to the scanning and persistence discussed earlier This behavior is suggestive of either an evolution of processes by implementing specialization within the organization or the IAB-like activity mentioned earlier. This malware was the result of: shield@dshield:/srv/cowrie/var/lib/cowrie/downloads$ sudo strings -a 649eecfd7b02b59248ef5d1fce494e2f1b9d2fc20eef43fc4c74be8bc10ce1c1 -n 80 | less What Can Be Done? In the Early Recognition section, I gave a few suggestions of what you can do to cutoff the threat actor at the first sign of intrusion. This section aims to use some best practices to defend the network against this type of activity. Enforce strong authentication controls for remote access by disabling password-based SSH authentication in favor of key-based authentication Enforce multi-factor authentication (MFA) for administrative access were supported Use TCP Wrappers (/etc/hosts.allow and /etc/hosts.deny) as a defense-in-depth mechanism to restrict access to known management networks and reduce unauthenticated connection attempts Apply file integrity monitoring (FIM) to critical system and configuration files, including /etc/hosts.allow, /etc/hosts.deny, user .ssh directories, authorized_keys, and cron configurations Monitor for post-exploitation enumeration activity by alerting on rapid execution of common reconnaissance commands such as uname, lscpu, cat /proc/cpuinfo, w, top, and crontab -l Detect and investigate destructive or preparatory commands often used to enable persistence, such as recursive deletion of .ssh directories, use of chattr Routinely audit user accounts, group memberships, and privilege assignments Centralize authentication, process execution, and network logs, ensuring a minimum of 90 days log retention to support incident response and threat hunting activities Perform routine patching and vulnerability management for operating systems and exposed services to reduce the effectiveness of automated exploitation and scanning frameworks Test and exercise the incident response plan (IRP) to ensure rapid containment, isolation, and investigation can occur when early indicators of compromise are detected Consider investing resources into Threat Hunting and Cyber Threat Intelligence to better identify and predict adversarial activity Conclusion This style of attack (Password spray of SSH -> System enumeration -> Persistence mechanisms via SSH -> Transfer of malicious file) is the most common attack I witnessed while monitoring DShield via Kibana. While it makes sense for a cybercrime organization to carry this out due to the amount of automation that can be used, the actual attack chains seem to be relatively simple to defend. We have seen cybercrime organizations specialize and organize in a more corporate structure, meaning certain organizations deal in initial access, others exploitation, and other actions on objective. It seems cryptojacking goups like ‘Outlaw’ would fall more on the initial access side with them choosing whether or not the victim fits their use case. What we can do is continue to encourage defenders to stay up to date with CTI and take a proactive approach to threat hunting we can make the job of the adversary significantly more difficult. Ultimately stifling the IABs, reducing funding to lower tiered groups, and potentially destabilizing the structure and segmentation of roles within the cybercrime field. [1] https://isc.sans.edu/diary/Decoding+the+Patterns+Analyzing+DShield+Honeypot+Activity+Guest+Diary/30428 [2] https://www.attackiq.com/glossary/pyramid-of-pain-2/ [3] https://isc.sans.edu/diary/DShield+Honeypot+Activity+for+May+2023/29932 [4] https://www.trendmicro.com/en_us/research/19/f/outlaw-hacking-groups-botnet-observed-spreading-miner-perl-based-backdoor.html [5] https://krebsonsecurity.com/tag/ddos-for-hire/ [6] https://attack.mitre.org/ [7] https://www.sans.edu/cyber-security-programs/bachelors-degree/ ----------- Guy Bruneau IPSS Inc. My GitHub Page Twitter: GuyBruneau gbruneau at isc dot sans dot edu

isc.sans.eduJan 15, 2026extracted

Trend Micro Predicts 2026 as the Year Scams Become AI-Driven, AI-Scaled, and Emotion-Engineered

Stay connected with press releases from Trend teams in your region. DALLAS, December 3, 2025 – Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today released its 2026 Consumer Security Predictions Report, warning that the coming year will see scams reach unprecedented AI-driven scale as automation reshapes how fraudsters target victims. From synthetic relationships to multi-channel fraud journeys, cybercriminals are merging automation with emotional manipulation, creating unprecedented speed, realism, and scale. To read the full report, 2026 Scam Predictions: How AI and Emotion Are Re-Engineering Global Scams, please visit: https://www.trendmicro.com/explore/2026-consumer-threat-predictions Lynette Owens, Vice President of Consumer Education & Marketing at Trend Micro: “We are entering an era where cybercriminals are employing AI to make their deception both effortless and highly personalized. Consumers are being targeted in ways that are harder for them to discern by the once easily recognizable hallmarks of suspicious content. The challenge ahead is how to ensure consumers have both the skills and tools to protect themselves from modern digital threats versus those of the past.” The report highlights how AI-generated personas, deepfake media, and agentic automation are transforming global scam operations. Fraudsters can now clone voices, write personalized messages, and shift conversations across SMS, chat apps, and fake websites more efficiently than ever before. Furthermore, multi-channel scams, where victims are lured from social media or text messages into encrypted chats and fraudulent payment pages, will become the dominant pattern in 2026. Relationship and investment scams will continue to drive the highest financial losses. AI chatbots, deepfake companions, and manipulated imagery will blur the line between real and synthetic interactions, while crypto-related investment fraud will expand through sophisticated scam-as-a-service networks. At the same time, instant payment fraud is expected to surge as criminals exploit peer-to-peer money apps and irreversible transfers. High volume impersonation scams, including delivery, billing, and subscription renewal fraud, will remain the most common global threat. These campaigns increasingly rely on localized smishing kits and professional-grade branding, making them nearly indistinguishable from legitimate communications. To help consumers navigate this new era of AI-driven scams, Trend Micro highlights its ScamCheck tool as a key protection layer. ScamCheck allows users to instantly verify suspicious texts, links, social messages, and phone numbers – directly addressing the multi-channel fraud journeys outlined in the report. It analyzes impersonation patterns, risky URLs, and behavioral cues commonly seen in delivery, billing, investment, and relationship scams. ScamCheck gives consumers immediate verification guidance, helping them spot AI-engineered or highly polished scams that bypass traditional forms of detection. Trend advises consumers worldwide to adopt new “verification-first” habits as tactics evolve. AI-enhanced fraud is making older warning signs, such as poor spelling or grammar, obsolete. Instead, users must rely on identity checks, cross-channel verification, and an awareness that even convincing messages can be engineered to manipulate trust. Trend’s 2026 consumer predictions underscore a future where scams operate as AI-scaled ecosystems. Those who stay informed, use secure-by-design platforms, and adopt modern verification practices will be best equipped to protect themselves in an increasingly deceptive digital world. To learn more about Trend Micro’s 2026 Consumer Threat Predictions, visit https://www.trendmicro.com/explore/2026-consumer-threat-predictions About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information between people, governments, and enterprises. Trend leverages decades of security expertise and the power of AI to protect more than 500,000 enterprises and millions of individuals worldwide. As a leader in consumer cybersecurity and the fight against scams, Trend delivers industry-first and award-winning products to protect millions of consumers from modern online threats. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. Learn more at www.trendmicro.com. Media Contact: Trend Micro Communications 817-522-7911 [email protected]

newsroom.trendmicro.comDec 3, 2025extracted

Trend Micro Predicts 2026 as the Year Cybercrime Becomes Fully Industrialized

Stay connected with press releases from Trend teams in your region. DALLAS, Nov. 25, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today released its annual Security Predictions Report for 2026, warning that the coming year will mark the true industrialization of cybercrime. Artificial intelligence (AI) and automation are now enabling threat actors to run entire campaigns autonomously, from reconnaissance to extortion, creating unprecedented speed, scale, and complexity for enterprise defenders. To read the full report, The AI-fication of Cyberthreats - Trend Micro Security Predictions for 2026, please visit: https://www.trendmicro.com/vinfo/us/security/research-and-analysis/predictions/the-ai-fication-of-cyberthreats-trend-micro-security-predictions-for-2026 Ryan Flores, Lead of Forward-Looking Threat Research at Trend: "2026 will be remembered as the year cybercrime stopped being a service industry and became a fully automated one. We are entering an era where AI agents will discover, exploit, and monetize weaknesses without human input. The challenge for defenders is no longer simply detecting attacks, it's keeping pace with the machine-driven tempo of threats." The report highlights how generative AI and agentic systems are transforming the economics of cybercrime. Autonomous intrusion campaigns that adapt in real time, polymorphic malware that constantly rewrites its own code, and deepfake-driven social engineering will be standard tools for attackers. The same automation also threatens to flood businesses with synthetic code, poisoned AI models, and flawed modules hidden inside legitimate workflows, blurring the line between innovation and exploitation. Hybrid cloud environments, software supply chains, and AI infrastructures are expected to be the primary targets in 2026. Poisoned open-source packages, malicious container images, and over-privileged cloud identities will become common attack vectors, while state-sponsored groups will increasingly turn to "harvest-now, decrypt-later" strategies to future-proof espionage against the advance of quantum computing. Ransomware is evolving into an AI-powered ecosystem capable of managing itself, e.g. identifying victims, exploiting weaknesses, and even negotiating with targets via automated "extortion bots." Trend threat researchers expect these campaigns to become faster, harder to trace, and more persistent, driven by data rather than encryption alone. Trend advises organizations worldwide to move from reactive defense to proactive resilience by embedding security across every layer of AI adoption, cloud operations, and supply chain management. Organizations that integrate ethical AI use, adaptive defense, and human oversight will be the ones best positioned to succeed in the future. Trend's 2026 predictions outline a path forward based on visibility, automation with human validation, and a cultural shift that treats security as strategic infrastructure. Those who innovate securely, by balancing speed with governance and intelligence with ethics, will set the standard for trust and resilience in an increasingly autonomous world. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information between people, governments, and enterprises. Trend leverages security expertise and AI to protect more than 500,000 enterprises and millions of individuals across clouds, networks, endpoints, and devices worldwide. At the core is Trend Vision One™, the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management and security operations, delivering layered protection across on-premises, hybrid, and multi-cloud environments. The unmatched threat intelligence delivered by Trend empowers organizations to proactively defend against hundreds of millions of threats every day. Proactive security starts here. TrendMicro.com SOURCE Trend Micro Incorporated

newsroom.trendmicro.comNov 25, 2025extracted

New Trend Micro Survey Shows Economic Strain and Overconfidence put Holiday Shoppers at Greater Risk of Online Scams

Stay connected with press releases from Trend teams in your region. From job losses to rising costs, consumers are spending less, but risking more as they chase online deals too good to be true DALLAS, November 19, 2025 – Trend Micro Incorporated, a global leader in cybersecurity, today released its Holidays, Scams, and AI study, which surveyed over 6,500 consumers across six countries (United States, United Kingdom, Australia, New Zealand, Singapore, and Taiwan). The 2,100 U.S. participants revealed a worrying disconnect: people believe they can spot a scam, but many admit to already having been targeted by scammers. The findings come as consumers face mounting financial pressures, rising living costs, and a flood of AI-fueled scams that are increasingly difficult to detect. A majority (56%) of Americans indicated that they are either very or extremely confident in their ability to spot a scam. Additionally, nearly half (43%) of Americans said they’ve already seen what they believed to be a scam promoting discounted prices for holiday gifts or travel this season. One-third (33%) of respondents reported that they had already seen an online advertisement, email, text message, social media post, or website related to holiday gifts or travel this year that was fraudulently impersonating a well-known brand. But consumers’ behavior tells a different story: 86% of U.S. respondents would consider buying a gift or booking travel from a seller they’ve never heard of because it was a very good price. Additionally, over half (54%) of respondents plan to spend more time looking for end of year holiday shopping and travel deals – widening the attack range for cybercriminals. Lynette Owens, VP of Consumer Education & Marketing at Trend: “People are under real pressure this year: Consumers are working with tighter wallets, higher anxiety, and a false sense of digital confidence. Scammers know this and are using age-old manipulation tactics together with AI to exploit shoppers faster and more effectively than ever before, raising the urgency for consumers to fight back and protect themselves from scams.” Even as they appear increasingly vulnerable to scams, consumers are not increasingly cautious. Fewer Americans in 2025 (54%) reported being at least “moderately worried” about getting scammed compared to similar Trend research from 2024 (58%). Americans are also potentially at greater risk this year, with nearly a quarter (23%) reporting they had already been victims of an online scam in 2025, compared to 17% reporting the same in the 2024 study. Interestingly, 32% of those who earn at least $150,000 a year report having been scammed this year, the highest income group surveyed. This suggests that while some groups may be looking harder for bargains online, everyone could be a target regardless of income. The study also uncovered some wide differences by age. 70% of U.S. respondents aged 18-44 claim they feel very confident in being able to spot a scam, but the number drastically decreases with age, with only 36% of those aged 65+ saying the same. Moreover, younger groups are more likely to participate in risky online shopping behavior, with 54% of those aged 25-44 willing to purchase from a brand they had never heard of before, while only 24% of those aged 65+ say they would do the same. The increasing prevalence of AI further complicates safe holiday shopping. Over half of U.S. respondents (52%) said they are definitely or are considering using AI technology (a tool, browser, and/or shopping assistant) to help them with holiday shopping this season. Additionally, a staggering 82% of consumers believe they will see AI generated images or videos online during the holiday season. Today’s scammers are using AI to formulate multi-step, multi-channel, and hyper-personalized scams. This new generation of scams doesn’t come as one-off messages. They unfold as stories designed to lure victims step-by-step. To help quell this growing trend, Trend developed Scam Radar, a new feature within its ScamCheck tool, designed to proactively scan for scam signals across texts, calls, websites, and social media links. Instead of reacting after the fact, Scam Radar connects the dots in real time, issuing early alerts before consumers engage with the tactics employed by scammers. Trend also recently released a research paper titled “Reimagining Fraud Operations: The Rise of AI-Powered Scam Assembly Lines” that details how cybercriminals are using AI to make old scams faster, smarter, and more convincing than ever. “While consumers see the upside of AI to help, AI is also being used to cause them harm. Scammers are employing it to develop sophisticated scams that take advantage of consumers who are looking for a bargain while under financial stress,” said Owens. “It is increasingly difficult for even AI-savvy shoppers to detect fake products, websites, or advertisements, raising the urgency to use tools like Scam Check to fight back.” In addition to ScamCheck, Trend suggests several tips to empower consumers to fight scams this holiday season: This year, holiday scams are more convincing, more automated, and more personal than ever. But with the right awareness and tech tools, consumers can protect themselves, their loved ones, and their wallets. The Holidays, AI, and Scams survey was conducted online from October 31 – November 10 among 6,536 consumers in Australia, New Zealand, Singapore, Taiwan, the United Kingdom and the United States. To learn more about holiday scams, visit trendmicro.com. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information between people, governments, and enterprises. Trend leverages decades of security expertise and the power of AI to protect more than 500,000 enterprises and millions of individuals worldwide. As a leader in consumer cybersecurity and the fight against scams, Trend delivers industry-first and award-winning products to protect millions of consumers from modern online threats. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. Learn more at www.trendmicro.com.

newsroom.trendmicro.comNov 19, 2025extracted

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

We have identified two interconnected malware campaigns active throughout 2025, using large-scale brand impersonation to deliver Gh0st remote access Trojan (RAT) variants to Chinese-speaking users. From the first campaign to the second, the adversary advanced from simple droppers to complex, multi-stage infection chains that misuse legitimate, signed software to bypass modern defenses. This report provides a detailed breakdown of the campaigns' anatomy, offering new intelligence on the attackers' operational playbook. We analyze an initial campaign from February–March 2025 that mimicked three brands across over 2,000 domains and a more sophisticated campaign starting in May 2025 that impersonated over 40 applications. The impersonated software primarily includes widely used enterprise tools, secure messaging apps, gaming platforms and popular AI software. By analyzing the evolution of the attack methods, infrastructure and targeting, we establish a clear operational playbook. Understanding the adversary’s adaptive tactics, techniques and procedures (TTPs), such as using cloud infrastructure for payload delivery and DLL side-loading for evasion, provides crucial insights for enhancing security postures. Our analysis is based on data from Palo Alto Networks products, including Advanced URL Filtering and Advanced WildFire, which provided visibility into the malware's behavior and infection chains. This internal data was supplemented by passive DNS (pDNS) analysis and open-source intelligence. We provide organizations with indicators of compromise (IoCs) to mitigate against this threat. Palo Alto Networks customers are better protected from this activity through the following products and services: Advanced WildFire Advanced URL Filtering and Advanced DNS Security Advanced Threat Prevention Cortex XDR and XSIAM Cortex Cloud DSPM If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. In recent years, malware campaigns specifically tailored to target Chinese-speaking users globally have emerged as a notable trend in the threat landscape. These operations demonstrate a complex understanding of the target demographic's digital ecosystem and online behaviors. The lures used are often not generic. Instead, attackers carefully select them to appeal to this specific audience. Attackers frequently impersonate the following types of applications: Software that is widely popular within the community (e.g., Youdao dictionary or Sogou browser) Tools used to circumvent state-imposed internet restrictions (e.g., VPNs and encrypted messaging applications) How would potential victims find these malicious sites impersonating legitimate software? Attackers have a variety of options. They could generate traffic to these sites through malicious online ads or search engine poisoning. Attackers can also post on social media and other online forums to promote these sites. Email is another vector for leading potential victims to these sites. The choice to target people seeking tools to bypass censorship is particularly strategic. This suggests an adversary who is interested in people already attempting to operate outside of easily monitored channels, making them prime targets for surveillance or espionage. The final payload in these campaigns is often a RAT that grants the attacker comprehensive control over a compromised system. The Gh0st RAT and its many variants are a prominent choice, particularly for Chinese-nexus cybercrime and espionage actors who have used these tools for over a decade. We refer to this initial activity as Campaign Trio due to its impersonation of three distinct software brands. Active from February–March 2025, this phase established a baseline operational model of the adversary. This campaign involved a massive number of domains, used an aggressive approach to infrastructure deployment and a clear, focused targeting strategy. The malware distribution strategy of this campaign relied on a vast network of malicious websites that convincingly mimicked legitimate software download portals to lure victims. Between February and March 2025, attackers registered over 2,000 domains, with significant surges in activity in early February and early March. Attackers appear to have automated their domain registration, typically combining the impersonated brand name with a random-looking alphanumeric suffix and using TLDs like .top or .vip. The entire network of over 2,000 domains was hosted on just three IP addresses: 154.82.84[.]227 156.251.25[.]43 156.251.25[.]112 This high-volume domain approach is designed to persist in the face of reputation-based blocking systems. It also ensures that even if some domains are taken down, many other domains remain available. Figure 1 shows a sample attack infrastructure of Campaign Trio including the following info: Three clusters of brand impersonating domains Their association with web server IP addresses An additional server hosting the malware for downloading This centralized model, with over 2,000 domains resolving to just three IP addresses, suggests that attackers viewed components of the infrastructure as disposable. This also implies an aggressive approach to infrastructure deployment that allows the attackers to rapidly establish new websites. The choice of impersonated brands for this campaign reveals a deliberate targeting strategy: i4tools: With over 1,400 domains, this was the most impersonated brand. This is Chinese-language, multi-function software for managing and transferring files to and from Apple-based mobile devices. Youdao: Attackers created over 600 domains to impersonate this popular Chinese dictionary and translation application, strongly indicating a focus on Chinese-speaking users. DeepSeek: We identified only five domains. The impersonation of this AI company demonstrates the attackers' interest in capitalizing on current technology trends. The landing pages hosted on these domains closely mimicked the legitimate sites to deceive victims into downloading the trojanized software installers shown in Figures 2, 3 and 4. Webpages from over 2,000 domains served their malicious payloads from a single source: hxxps[:]//xiazailianjieoss[.]com. This domain hosted ZIP archives containing the trojanized installers. The downloaded archives contained either a malicious Microsoft Installer (MSI) file or a standalone executable. The MSI installers used a custom action to execute a secondary, smaller executable, separating the malicious logic from the main installer to bypass static analysis. MSI-based malware delivery can include a substantial variety of actions also typically executed by benign MSI files. This allows malicious actions to hide within the many legitimate operations generated by an attacker's MSI file. Figure 5 illustrates this concept in action. It shows a malicious MSI sample from Campaign Trio running the embedded malware within the MSI package. Using Microsoft's Orca tool, we can search the malicious MSI file's custom actions for anything suspicious. Running the malicious executable is one of 43 custom actions, not including all the normal actions and processes generated by an MSI file. The MSI file in Figure 5 employs a seemingly legitimate graphical user interface (GUI) for its installation procedure. The Orca tool reveals the MSI file's custom action table, where we've highlighted the malicious action run in the background during the installation. In this instance, the custom action LaunchApplication executes the second-stage malware, a 1.7 MB executable named [System Process]5.exe. Primary functions of [System Process]5.exe are to: Download an obfuscated binary from a staging server Decode the binary and Run it The obfuscated binary was hosted on URLs from fs-im-kefu.7moor-fs1[.]com, a malware distribution point linked to previous Gh0st RAT activity. The deobfuscated binary is the final payload. We identified this final payload as Gh0st RAT, which provides attackers with the following capabilities: Logging keystrokes Capturing screenshots Remote shell access Downloading additional malware These Gh0st RAT samples create scheduled tasks for persistence and use powershell.exe to add exclusions in Windows Defender, so they can run undetected. Once active, these Gh0st RAT samples establish command and control (C2) communication via encrypted TCP traffic over port 8080 to servers with domains like xiaobaituziha[.]com, which resolved to 103.181.134[.]138. We refer to the second campaign as Campaign Chorus because attackers expanded their lures to impersonate over 40 different software applications. Launched in May 2025, this campaign built upon the foundation of the first and showed a significant expansion in targeting. Its TTPs evolved to enhance evasion and bypass security controls. While maintaining a focus on Chinese-speaking users, attackers broadened their lure selection to maximize their potential targets. The attackers organized Campaign Chorus in a more structured manner. In Campaign Chorus, attackers impersonated widely used enterprise messaging software, Chinese versions of secure messaging apps and popular gaming platforms. They also continued targeting software popular with Chinese speakers, such as QQ Music and Sogou browser. This indicates a strategy to reach a wider demographic of Chinese speakers. Figure 6 shows examples of impersonated applications from this campaign. This campaign was initially executed in two distinct waves, distinguished by domain naming conventions and registration dates: Wave 1 (registered May 15, 2025): This wave consisted of 40 domains, all beginning with the prefix guwaanzh Wave 2 (registered May 26–28, 2025): This wave included 51 domains, all starting with the prefix xiazaizhadia The use of structured, wave-based attacks with different domain prefixes and corresponding redirection servers (djbzdhygj[.]com for Wave 1 and yqmqhjgn[.]com for Wave 2) suggests a more organized and possibly experimental approach. The attackers could have been testing the effectiveness of different lures or attempting to compartmentalize their infrastructure to make it more resilient to takedowns. Figure 7 shows an infrastructure map diagram illustrating the two distinct attack waves, their respective redirection servers and how the domains were hosted on a single IP address. Figure 8 shows the most significant advancement during this campaign: adopting a more intricate and elusive infection chain. This multi-stage evolution from the previous campaign increases the complexity of malware embedded in the MSI file. This indicates an increased effort to evade detection. The previous campaign's infection chain was more easily detectable by endpoint detection and response (EDR) solutions. This new chain is explicitly designed to circumvent these protections. In a tactical shift from previous activity, the actor behind Campaign Chorus moved away from a single, self-hosted payload server. Instead, the malicious landing pages used intermediary redirection domains to fetch the malicious ZIP archives from public cloud service buckets. For this tactic, attackers misused cloud services, leveraging trusted reputations to make malicious download traffic appear benign. Consequently, the malicious downloads might bypass network filters that would otherwise block traffic from an unknown or newly registered domain. This also increases the actor's operational resilience, as disrupting a cloud service bucket is a more involved process for defenders than simply blocklisting a malicious IP address. As noted earlier in Figure 8, the core of this new infection chain is an embedded VBScript file run as a custom action by the MSI installer. The VBScript file acts as a file assembler and decryptor for the next-stage malware. This next-stage payload is stored within the MSI file, but not as a single encoded binary. Instead, it is split across multiple data files contained within the MSI's embedded .cab archive. The VBScript file reads these separate components, merges them into a single binary and uses a stored password to decrypt the combined data. This process creates the next-stage malware. This technique is designed to evade static analysis tools that might otherwise detect a single binary containing malicious content within the MSI. The final and most complex step in the infection chain is using DLL side-loading to execute the payload. The VBScript file decodes data binaries within the MSI and saves the resulting two files to disk: The first file is a copy of a legitimate signed executable (wsc_proxy.exe) The second file is a malicious, attacker-crafted DLL named wsc.dll When wsc_proxy.exe is executed, the Windows loader searches for its required dependency, wsc.dll. Because the malicious version is in the same directory, it is loaded into the process memory before the legitimate version in the system directory would be found. This is a classic example of DLL side-loading. It is an evasion technique that allows the attacker's code to run under the guise of a trusted, signed process. The misuse of a legitimate executable is meant to bypass application allow-listing and process-based monitoring. The parent process initiating the malicious activity is itself benign and digitally signed by a reputable vendor. This makes it significantly harder for security tools to flag the activity as malicious. When analyzed together, the evidence from Campaign Trio and Campaign Chorus reveals a consistent operational playbook, allowing us to build a distinct behavioral profile. The technical differences are best understood not as the work of two unrelated campaigns, but as the logical evolution of a single group adapting its methods. The campaigns have several key characteristics that form a strategic signature: Mass-scale programmatic infrastructure: Both campaigns rely on the programmatic generation of domains for brand impersonation using a consistent naming convention. Specific demographic focus: Both campaigns focus heavily on software popular with Chinese-speaking users, even when deploying infrastructure in regions like the U.S. and Singapore. This indicates an actor with a deep and specific understanding of this demographic, rather than an opportunistic actor casting a wide, generic net. “Burn-and-churn” operational tempo: Both campaigns use a centralized and disposable infrastructure model. The strategy of hosting thousands of domains on a handful of IP addresses demonstrates a rapid deployment approach where the attackers consider the infrastructure expendable. The actor prioritizes the speed and scale of deployment over stealth and long-term resilience. They are confident in their ability to quickly pivot to new domains and servers. Two-tiered infrastructure: The actor exhibits a clear separation between its disposable, high-volume access infrastructure (the thousands of impersonation domains) and its more critical operational infrastructure (the payload and C2 servers). While the access layer is designed to be burned, the operational layer shows evolution (from self-hosted to cloud-hosted) aimed at increasing longevity and resilience. This architectural choice allows the actor to absorb the loss of their frontend domains without losing its core payload delivery and C2 capabilities. Table 1 shows the adversary's methods mapped to the MITRE ATT&CK framework, providing a standardized view of its operational tactics. Table 1. TTP profile summary (MITRE ATT&CK mapping). The results of our investigation reinforce that these campaigns are not isolated, short-term events. Attackers are actively maintaining and expanding their infrastructure, indicating a persistent, long-term operation. We investigated the WHOIS creation dates of domains associated with both these campaigns and found that they have consistently registered domains from February–August 2025. Our analysis showed a significant surge in activity between February and May 2025. During these four months, attackers created over 2,500 domains, accounting for 87.4% of all malicious domains identified in connection with these campaigns. Figure 9 shows the distribution of domains belonging to these campaigns created per week according to their WHOIS creation dates. In February and March of 2025, we observed over 1,500 domains belonging to the first campaign being registered. We also noticed an interesting pattern where attackers registered between 100-200 domains every week for a month. This pattern started with 100 domains registered on April 15, 2025. This was followed by 237 more in the week of April 21–27, the majority of which were registered on April 22. This was followed by another 191 domains between April 28–May 4. Of these, 104 were registered on April 29. This was followed by a week of low activity (around May 5, 2025) and ended with almost 261 domains registered between May 13–15, 2025. This regularity suggests an automated or highly structured process for routine infrastructure replenishment, likely to replace domains that have been blocked during operations. From the pDNS data, we find that these new domains are pointed to the same core IP addresses used in both campaigns, with activity observed as recently as July 2025. Domains associated with the first campaign's infrastructure continue to resolve to 156.251.25[.]112. For example, we observed domains such as youdaxxyzr[.]top and i4toolscacsm[.]top actively resolving to this IP address. This demonstrates that the actor did not simply abandon its initial core IP address infrastructure but continued to leverage the IP address for ongoing attacks. Similarly, the infrastructure for the second campaign remains active. The IP address 95.173.197[.]195 continues to serve new malicious domains as of early October 2025. Continuously registering and refreshing domains is a clear tactic to evade blocklists. It helps ensure the longevity of the campaigns, pointing to a well-resourced and determined adversary. Figure 10 depicts a graph of the first campaign. It shows domains involved in both campaigns. Both campaigns use the same elements, like nameservers and hosting IP addresses. This graph depicts 683 domains that share the same set of nameservers and resolve to the same hosting IP address 156.251.25[.]112. This IP address is geolocated to Hong Kong. Furthermore, we analyzed pDNS query volumes for domains associated with the first campaign to quantify its sustained activity over time. We found that while daily query volumes fluctuated, there was a gradual upward trend in queries toward domains associated with this campaign between March 2025 and July 2025. Figure 11 shows a large peak in the number of queries toward these domains on July 12, 2025. We investigated domains contributing to this peak, and over 68% of these queries were generated for domains registered between March 6 and March 13, 2025, representing an exact four-month gap. This increase in query volume could be due to changes in the attackers' content or their connections to other entities. The parallel operation of both old and new infrastructure through sustained activity suggests an operation that is not merely evolving but consists of multiple infrastructures and distinct tool sets simultaneously. This could indicate A/B testing of TTPs, targeting different victim sets with different levels of complexity, or simply a cost-effective strategy of continuing to leverage older assets as long as they remain effective. The campaigns detailed in this article represent a persistent, large-scale and evolving threat. Operating at scale combined with a continuous adaptation of TTPs presents a significant challenge for defenders. There is a clear evolution in these two campaigns. Campaign Trio, the first campaign, uses direct droppers. Campaign Chorus, the second campaign, leverages a more complex multi-stage infection chain and uses DLL sideloading. The following traits are notable: Consistent focus on a Chinese-speaking demographic Programmatically generating thousands of domains Strategically using both self-hosted and major cloud provider infrastructure This signals a broader trend where threat actors will increasingly leverage legitimate cloud services and signed software, shifting the defensive focus from blocking known-bad indicators to detecting sophisticated behavioral anomalies. Palo Alto Networks customers are better protected from the threats discussed above through the following products: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Advanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time. Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. Cortex Cloud DSPM can help organizations detect if their cloud infrastructure has been used to host malicious binaries like those described in this article by routinely scanning cloud storage containers and properly classifying the data within. - This functionality can assist organizations from unwittingly being used to host malicious binaries placed by threat actors. - While the nature of the article does not point to the compromise of victim cloud environments to host these binaries, Cortex Cloud DSPM can detect malicious data and prevent it from harming the organization itself or, in this case, external organizations. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. A comprehensive list of IoCs associated with these campaigns can be found in the tables below. Campaign Trio IoCs Campaign Chorus IoCs Observed Domain Activity (Based on pDNS Data) The authors would like to thank Shehroze Farooqi, Bradley Duncan and Alex Starov for their valuable insights and feedback to improve the research work mentioned in this article. Trojanized Installer Distribution Campaign – Unit 42, Palo Alto Networks Legitimate Software Impersonation Campaign – Unit 42, Palo Alto Networks Ghost RAT (Malware Family) - Malpedia Gh0st RAT: malware active for 15 years is still used by threat operators – Side Channel Blog 7m-sdk.7moor-fs1.com URL Report – IBM X-Force Exchange Behind the Great Wall Void Arachne Targets Chinese-Speaking Users – TrendMicro Malware Campaigns Targets Chinese Speaking Users With Fake Installers – DigiAlert Musical Chairs: A Multi-Year Campaign Involving a New Variant of Gh0st Malware – Unit 42, Palo Alto Networks

unit42.paloaltonetworks.comNov 14, 2025extracted

Trend Micro Awards Over $1,000,000 to Ethical Hackers

Stay connected with press releases from Trend teams in your region. Participants at Pwn2Own Ireland discovered scores of zero-day vulnerabilities DALLAS, Oct. 27, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today celebrated the efforts of the global security research community at Pwn2Own Ireland. Contestants discovered and disclosed 73 unique zero-day vulnerabilities in printers, network storage systems, smart home devices, surveillance equipment, home networking equipment, flagship smartphones, and wearable technology. To learn more about Pwn2Own Ireland 2025, please visit: https://www.zerodayinitiative.com/blog/2025/10/23/pwn2own-ireland-2025-day-three-and-master-of-pwn Rachel Jin, Chief Platform and Business Officer at Trend: "Our mission is to approach security proactively and gather the deepest threat intelligence in the industry. The 73 zero-day bugs discovered at Pwn2Own will directly help make the digital world a safer place. We're proud to empower vendors to patch these vulnerabilities while offering our customers protection from exploits well ahead of any other cybersecurity provider. As cyber risk continues to rise worldwide, Pwn2Own remains a valuable tool in staying ahead." A total of $1,024,750 in prizes were awarded to the participants. Research conducted at Pwn2Own enables Trend to protect customers from zero-day exploits an average of 71 days ahead of the industry, an essential advantage in the race against cybercriminals. The event featured a variety of highlights as hackers competed for a cash prize pool of over $2 million: The next competition, Pwn2Own Automotive, will be held in Tokyo, Japan on January 21-23, 2026. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information between people, governments, and enterprises. Trend leverages security expertise and AI to protect more than 500,000 enterprises and millions of individuals across clouds, networks, endpoints, and devices worldwide. At the core is Trend Vision One™, the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management and security operations, delivering layered protection across on-premises, hybrid, and multi-cloud environments. The unmatched threat intelligence delivered by Trend empowers organizations to proactively defend against hundreds of millions of threats every day. Proactive security starts here. TrendMicro.com SOURCE Trend Micro Incorporated

newsroom.trendmicro.comOct 27, 2025extracted

Optimize security operations with AWS Security Incident Response

aws.amazon.comSep 23, 2025extracted

Trend Micro Unmasks Global "Task Scam" Industry

Stay connected with press releases from Trend teams in your region. New research exposes operations behind deceptive digital job platforms and highlights growing financial and psychological harm to victims DALLAS, Aug. 19, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global leader in cybersecurity, today released new research revealing the mechanics and scale of a rapidly growing fraud model known as "task scams": sophisticated online job scams that lure victims into repetitive digital tasks and systematically strip them of funds through escalating deposit demands. To read the full report, Unmasking Task Scams, visit: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/unmasking-task-scams-to-prevent-financial-fallout-from-fraud Robert McArdle, Director of Forward Threat Research at Trend: "Task scams are now one of the most financially and psychologically damaging cybercrime threats individuals face today. The infrastructure enabling them, from domain registrars to SMS blasting services, requires immediate attention. Meanwhile, organizations can reduce risk by making their recruitment practices transparent and educating job seekers on how to identify legitimate communications." Trend™ Research uncovers a sprawling global criminal infrastructure that impersonate legitimate companies, exploit trusted communications channels, and prey on job seekers using gamification techniques. Trend reports that scammers are transferring millions via cryptocurrency wallets, with victims losing between hundreds and hundreds of thousands of dollars each. Modern scam tactics are highly targeted and designed to go undetected. In a recent global study of over 6,500 consumers conducted by Trend, 39% reported becoming aware of being a scam victim only after losing a significant amount of money. The report includes firsthand engagements with scammers, infrastructure mapping of malicious websites, and forensic analysis of associated cryptocurrency wallets. In one case, a single wallet received over US $187,000 in less than two months. Another wallet was linked to more than US $1.2 million in transactions. Key findings include: Victims report a high emotional toll, often describing behaviors akin to gambling addiction. In some cases, task scams are linked to larger criminal operations that include forced scam labor and human trafficking in Southeast Asia, though such ties are not confirmed in every case. Using Trend Micro ScamCheck with Scam Radar can help users recognize early on when they are being targeted by a scammer. An industry first, Scam Radar offers real-time protection by identifying scam tactics utilized by cybercriminals as they happen, alerting users and empowering them to take action before any harm is done. The latest version of Trend Micro ScamCheck is available on the Apple App Store and Google Play. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's AI-powered cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, Trend's platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, central visibility for better, faster detection and response. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com. SOURCE Trend Micro Incorporated

newsroom.trendmicro.comAug 19, 2025extracted

Trend Micro Warns of Thousands of Exposed AI Servers

Stay connected with press releases from Trend teams in your region. Latest research reveals mounting infrastructure-level risks from diverse components DALLAS, July 29, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today urged AI engineers and IT leaders to heed best practices in developing and deploying secure systems, or risk exposure to data theft, poisoning, ransom, and other attacks. To learn more about how network defenders and adversaries are using AI, read Trend Micro State of AI Security Report, 1H 2025: https://www.trendmicro.com/vinfo/us/security/news/threat-landscape/trend-micro-state-of-ai-security-report-1h-2025 Rachel Jin, Chief Enterprise Platform Officer at Trend: "AI may represent the opportunity of the century for global businesses. But those rushing in too fast without taking adequate security precautions may end up causing more harm than good. As our report reveals, too much AI infrastructure is already being built from unsecured and/or unpatched components, creating an open door for threat actors." Trend's report highlights several AI-related security challenges: 1) Vulnerabilities/exploits in critical components Organizations wishing to develop, deploy and use AI applications must leverage multiple specialized software components and frameworks, which may contain vulnerabilities one may find in regular software. The report reveals zero-day vulnerabilities and exploits in core components including ChromaDB, Redis, NVIDIA Triton, and NVIDIA Container Toolkit. 2) Accidental exposure to the internet Vulnerabilities are often the result of rushed development and deployment timelines, as are instances when AI systems are accidentally exposed to the internet, where they can be probed by adversaries. As detailed in the report, Trend has found 200+ ChromaDB servers, 2,000 Redis servers, and 10,000+ Ollama servers exposed to the internet with no authentication. 3) Vulnerabilities in open-source components Many AI frameworks and platforms use open-source software libraries to provide common functionality. However, open-source components often contain vulnerabilities that end up creeping into production systems, where they are hard to detect. At the recent Pwn2Own Berlin, which featured a new AI category, researchers uncovered an exploit for the Redis vector database, which stemmed from an outdated Lua component. 4) Container-based weaknesses A great deal of AI infrastructure runs on containers, meaning it is exposed to the same security vulnerabilities and threats that impact cloud and container environments. As outlined in the report, Pwn2Own researchers were able to uncover an exploit for the NVIDIA Container Toolkit. Organizations should sanitize inputs and monitor runtime behavior to mitigate such risks. Stuart MacLellan, CTO, NHS SLAM: "There are still lots of questions around AI models and how they could and should be used. We now get much more information now than we ever did about the visibility of devices and what applications are being used. It's interesting to collate that data and get dynamic, risk-based alerts on people and what they're doing depending on policies and processes. That's going to really empower the decisions that are made organizationally around certain products." Both the developer community and its customers must better balance security with time to market in order to mitigate the risks outlined above. Concrete steps could include: About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's AI-powered cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, Trend's platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com. SOURCE Trend Micro Incorporated

newsroom.trendmicro.comJul 29, 2025extracted

AI-Generated Media Drives Real-World Fraud, Identity Theft, and Business Compromise

Stay connected with press releases from Trend teams in your region. Trend Micro uncovers the criminal playbook for deepfake-enabled cybercrime DALLAS, July 9, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today released a new report exposing the scale and maturity of deepfake-enabled cybercrime. As generative AI tools become more powerful, affordable, and accessible, cybercriminals are rapidly adopting them to support attacks, ranging from business fraud to extortion and identity theft. To read the full report, Deepfake it 'til You Make It: A Comprehensive View of the New AI Criminal Toolset, please visit: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/deepfake-it-til-you-make-it-a-comprehensive-view-of-the-new-ai-criminal-toolset The report shows how deepfakes have moved beyond hype into real-world exploitation, undermining digital trust, exposing companies to new risks, and accelerating the business models of cybercriminals. David Sancho, senior threat researcher at Trend: "AI-generated media is not just a future risk, it's a real business threat. We're seeing executives impersonated, hiring processes compromised, and financial safeguards bypassed with alarming ease. This research is a wake up call—if businesses are not proactively preparing for the deepfake era, they're already behind. In a world where seeing is no longer believing, digital trust must be rebuilt from the ground up." The research found that threat actors no longer need underground expertise to launch convincing attacks. Instead, they are using off-the-shelf video, audio, and image generation platforms, many of which are marketed to content creators, to generate realistic deepfakes that deceive both individuals and organizations. These tools are inexpensive, easy to use, and increasingly capable of bypassing identity verification systems and security controls. The report outlines a growing cybercriminal ecosystem where these platforms are used to execute convincing scams, including: The criminal underground is actively trading tutorials, toolkits, and services to streamline these operations. From step-by-step playbooks for bypassing onboarding procedures to plug-and-play face-swapping tools, the barrier to entry is now minimal. As deepfake-enabled scams grow in frequency and complexity, businesses are urged to take proactive steps to minimize their risk exposure and protect their people and processes. This includes educating staff on social engineering risks, reviewing authentication workflows, and exploring detection solutions for synthetic media. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's AI-powered cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, Trend's platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com. SOURCE Trend Micro Incorporated

newsroom.trendmicro.comJul 9, 2025extracted

AI on the Frontline: Global Firms Back Innovation, Brace for New Cyber Threats

Stay connected with press releases from Trend teams in your region. New Trend Micro research reveals widespread AI adoption in cybersecurity strategies, but mounting concerns cyber risk exposure DALLAS, July 1, 2025 /PRNewswire/ -- Global AI cybersecurity leader Trend Micro Incorporated (TYO: 4704; TSE: 4704) published new research* today revealing that while organizations are embracing artificial intelligence to strengthen their cyber defenses, many are increasingly concerned about the technology's potential to expand their attack surface and introduce new risks. To learn more about Trend's latest research, visit: https://www.trendmicro.com/explore/aichangingcyberrisk Rachel Jin, Chief Enterprise Platform Officer at Trend: "AI holds enormous promise for strengthening cyber defenses, from identifying anomalies faster to automating time-consuming tasks. But attackers are just as eager to leverage AI for their own purposes, and that creates a rapidly shifting threat landscape. Our research and real-world testing make it clear that security must be built into AI systems from the outset. There is simply too much at stake to treat this as an afterthought." According to the study, 81% of global businesses are already using AI-driven tools as part of their cybersecurity strategy, with a further 16% actively exploring implementation. Nearly all respondents (97%) are open to using AI in some capacity. Over half are already relying on it for essential processes such as automated asset discovery, risk prioritization and anomaly detection. AI and automation are now considered top priorities for improving cybersecurity over the next 12 months by 42% of surveyed organizations. This optimism also comes with significant risk. An overwhelming 94% of businesses believe that AI will negatively impact their cyber risk exposure within the next three to five years. Over half expect a surge in the scale and complexity of AI-driven attacks, which they say will force them to rethink and reshape existing cybersecurity strategies. Many point to the risk of sensitive data exposure, uncertainty around how data is processed and stored by AI systems, the potential for proprietary data to be exploited by untrusted models, as well as increased compliance pressures and monitoring challenges stemming from a proliferation of new endpoints, APIs and shadow IT. The tension between opportunity and risk was evident at Trend's Pwn2Own event in Berlin, where the AI category was introduced for the first time. The results offered a compelling snapshot of where AI security currently stands. Twelve entries targeted four major AI frameworks, with the NVIDIA Triton Inference Server receiving the most attention. Chroma, Redis, and the NVIDIA Container Toolkit were also successfully exploited, in some cases using just a single bug to achieve full compromise. In total, seven unique zero-day vulnerabilities were uncovered in the AI frameworks. The vendors now have 90 days to patch the flaws before technical details are made public. As AI becomes more deeply integrated in enterprise IT environments, Trend urges security leaders to proactively evaluate the evolving risk landscape and embed rigorous security practices into every stage of AI adoption. *Trend Micro commissioned Sapio Research to interview 2250 individuals with responsibility for IT and/or cybersecurity—across multiple verticals, organization sizes and 21 countries in Europe, North America and APAC. About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's AI-powered cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, Trend's platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com. SOURCE Trend Micro Incorporated

newsroom.trendmicro.comJul 1, 2025extracted