Research reports

1,224 reports from 387 publishers45 added in the past week

9 reports

9 reports, newest added first

Added Wed 2 Sep

Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant
RedC2 extends its control layer with an AI-driven component called Red post-exploitation tasks, from network reconnaissance to credential dumping, using natu
MalwareSupply chain

Trend Micro

TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…
MalwarePhishing

Trend MicroPublished 29 Jun

Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud
An MDR investigation correlated attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that TrendAI™ tracks as SHADOW-WATER-063. By correlating artifacts like…
Malware

Trend MicroPublished 19 May

Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Save to Folio Key takeaways Void Dokkaebi (aka Famous Chollima) has migrated…
Malware

Trend MicroPublished 22 May

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…
Malware

Trend MicroPublished 30 Apr

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
MalwareInfostealers

Trend MicroPublished 5 Mar

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…
Malware

Trend MicroPublished 21 Apr
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
MalwarePhishingSupply chain

Trend MicroPublished 4 May

Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News Links
By Elliot Cao, Joseph C. Chen, William Gamazo Sanchez, Lilang Wu, and Ecular Xu Contents 1 Attack Chain 1.1 Watering hole attack tactic 1.2 Infection chain 2 Exploits Analyses 2.1 The JavaScriptCore exploit 2.1.1 Bug triggering 2.1.2 The addrof/fakeobj…
MalwareVulnerabilitiesMobile

Trend MicroPDF

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.