Research, News, and Perspectives

Ransomware

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.

Latest News 2026/03/16

Save to Folio

Latest News 2026/03/16

Save to Folio

Malware

Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites

Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.

Research 2026/03/10

Save to Folio

Research 2026/03/10

Save to Folio

Artificial Intelligence (AI)

CISOs in a Pinch: A Security Analysis of OpenClaw

Learn about OpenClaw (a sovereign agent) and how this can be viable for enterprises.

Expert Perspective 2026/03/10

Save to Folio

Expert Perspective 2026/03/10

Save to Folio

Artificial Intelligence (AI)

TrendAI™ at [un]prompted 2026: From KYC Exploits to Agentic Defense

At [un]prompted 2026, TrendAI™ demonstrated how documents can be used to exploit AI-driven KYC pipelines and introduced FENRIR, an automated system for discovering AI vulnerabilities at scale.

Latest News 2026/03/09

Save to Folio

Latest News 2026/03/09

Save to Folio

Malware

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages

The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users.

Research 2026/03/05

Save to Folio

Research 2026/03/05

Save to Folio

Cyber Threats

Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations

Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) proxying.

Latest News 2026/03/04

Save to Folio

Latest News 2026/03/04

Save to Folio

Artificial Intelligence (AI)

CISOs in a Pinch: A Security Analysis of OpenClaw

Learn how Claude Code Security set Cybersecurity stocks on fire.

Expert Perspective 2026/03/03

Save to Folio

Expert Perspective 2026/03/03

Save to Folio

Artificial Intelligence (AI)

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer

Malicious OpenClaw skills trick AI agents and users into installing a new AMOS variant that steals extensive data at scale.

Research 2026/02/23

Save to Folio

Research 2026/02/23

Save to Folio

Spam

Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate Entities

We uncover how a campaign used Atlassian Jira Cloud to launch automated and targeted spam campaigns, exploiting trusted SaaS workflows to bypass security controls.

Research 2026/02/17

Save to Folio

Research 2026/02/17

Save to Folio

Compliance & Risks

U.S. Public Sector Under Siege

Discover why Government and Education must prioritize Cyber Risk Management.

Expert Perspective 2026/02/06

Save to Folio

Expert Perspective 2026/02/06

Save to Folio