Research, News, and Perspectives

Exploits & Vulnerabilities

Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities

In this blog entry, we provide an analysis of the recent remote code execution attacks related to Progress Software’s WhatsUp Gold that possibly abused the vulnerabilities CVE-2024-6670 and CVE-2024-6671.

Research Sep 12, 2024

Save to Folio

Research Sep 12, 2024

Save to Folio

Malware

Earth Preta Evolves its Attacks with New Malware and Strategies

In this blog entry, we discuss our analysis of Earth Preta’s enhancements in their attacks by introducing new tools, malware variants and strategies to their worm-based attacks and their time-sensitive spear-phishing campaign.

Research Sep 09, 2024

Save to Folio

Research Sep 09, 2024

Save to Folio

APT & Targeted Attacks

TIDRONE Targets Military and Satellite Industries in Taiwan

Our research reveals that an unidentified threat cluster we named TIDRONE have shown significant interest in military-related industry chains, particularly in the manufacturers of drones.

Research Sep 06, 2024

Save to Folio

Research Sep 06, 2024

Save to Folio

Phishing

Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility Command

Notorious Mekotio and BBTok are having a resurgence targeting Latin American users. Mekotio’s latest variant suggests the gang behind it is broadening their target, while BBTok is seen abusing MSBuild.exe to evade detection.

Research Sep 05, 2024

Save to Folio

Research Sep 05, 2024

Save to Folio

Malware

Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

While monitoring Earth Lusca, we discovered the threat group’s use of KTLVdoor, a highly obfuscated multiplatform backdoor, as part of a large-scale attack campaign.

Research Sep 04, 2024

Save to Folio

Research Sep 04, 2024

Save to Folio

Artificial Intelligence (AI)

How AI Goes Rogue

This is the second blog in an ongoing series on Rogue AI. Keep following for more technical guidance, case studies, and insights.

Expert Perspective Sep 03, 2024

Save to Folio

Expert Perspective Sep 03, 2024

Save to Folio

Malware

Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence

Trend Micro discovered that old Atlassian Confluence versions that were affected by CVE-2023-22527 are being exploited using a new in-memory fileless backdoor.

Research Aug 30, 2024

Save to Folio

Research Aug 30, 2024

Save to Folio

Artificial Intelligence (AI)

AI Pulse: Sticker Shock, Rise of the Agents, Rogue AI

This issue of AI Pulse is all about agentic AI: what it is, how it works, and why security needs to be baked in from the start to prevent agentic AI systems from going rogue once they’re deployed.

Latest News Aug 29, 2024

Save to Folio

Latest News Aug 29, 2024

Save to Folio

Malware

Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool

Threat actors are targeting users in the Middle East by distributing sophisticated malware disguised as the Palo Alto GlobalProtect tool.

Research Aug 29, 2024

Save to Folio

Research Aug 29, 2024

Save to Folio

Exploits & Vulnerabilities

Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem

A technical analysis on how CVE-2023-22527 can be exploited by malicious actors for cryptojacking attacks that can spread across the victim’s system.

Research Aug 28, 2024

Save to Folio

Research Aug 28, 2024

Save to Folio