Research, News, and Perspectives

Malware

TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM

Moving beyond their LiteLLM campaign, TeamPCP weaponises the Telnyx Python SDK with stealthy WAV‑based payloads to steal credentials across Linux, macOS, and Windows.

Research Mar 30, 2026

Save to Folio

Research Mar 30, 2026

Save to Folio

Artificial Intelligence (AI)

Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise

TeamPCP orchestrated one of the most sophisticated multi-ecosystem supply chain campaigns publicly documented to date. It cascaded through developer tooling and compromised LiteLLM and exposed how AI proxy services that concentrate API keys and cloud credentials become high-value collateral when supply chain attacks compromise upstream dependencies.

Latest News Mar 26, 2026

Save to Folio

Latest News Mar 26, 2026

Save to Folio

APT & Targeted Attacks

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defence supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analysed.

Latest News Mar 26, 2026

Save to Folio

Latest News Mar 26, 2026

Save to Folio

Artificial Intelligence (AI)

Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach

Litellm PyPI breach explained: malicious versions steal cloud credentials, SSH keys, and Kubernetes secrets. Learn impact and urgent mitigation steps.

Expert Perspective Mar 25, 2026

Save to Folio

Expert Perspective Mar 25, 2026

Save to Folio

Malware

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

We look into a stealthy multi‑stage attack campaign that delivers PureLog Stealer entirely in memory using encrypted, fileless techniques.

Research Mar 19, 2026

Save to Folio

Research Mar 19, 2026

Save to Folio

Compliance & Risks

Why East-West Visibility Matters for Grid Security

Learn how east-west traffic visibility helps detect and stop lateral movement attacks inside electric grid infrastructure and critical OT networks.

Consumer Focus Mar 18, 2026

Save to Folio

Consumer Focus Mar 18, 2026

Save to Folio

Cyber Threats

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA

Not every cloud breach starts with malware or a zero-day. In this incident, attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, then used the OAuth2 Resource Owner Password Credentials (ROPC) flow to authenticate without MFA.

Investigations Mar 18, 2026

Save to Folio

Investigations Mar 18, 2026

Save to Folio

New Threat Trends: How Service Providers Stay Ahead

Standing still means falling behind. To me, this phrase perfectly describes the reality that cybersecurity is a continuous process.

Expert Perspective Mar 17, 2026

Save to Folio

Expert Perspective Mar 17, 2026

Save to Folio

Cyber Crime

TrendAI™ Supports Global Law Enforcement Efforts

Learn how TrendAI™ and our researchers contributed threat intelligence and analysis to support INTERPOL against cybercrime.

Latest News Mar 16, 2026

Save to Folio

Latest News Mar 16, 2026

Save to Folio

Ransomware

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defence evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.

Latest News Mar 16, 2026

Save to Folio

Latest News Mar 16, 2026

Save to Folio