Research reports

Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

Note: This group's name is a generic identification based on components found during our investigation, and it might be used by other legitimately registered companies that legally render services and products. The illicit entity "Lemon Group" identified here…

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

In August 2025, we investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities…

Ransomware

Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant

RedC2 extends its control layer with an AI-driven component called Red post-exploitation tasks, from network reconnaissance to credential dumping, using natu

MalwareSupply chain

Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft

By By: Jacob Santos, John Rainier Navato May 13, 2026 Read time: 17 min (4541 words) Summary Our research analyzed the April 22 Checkmarx Keeping Infrastructure as Code Secure (KICS) and April 24 elementary-data incidents as two case studies within a broader…

Supply chain

TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…

MalwarePhishing

Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

An MDR investigation correlated attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that TrendAI™ tracks as SHADOW-WATER-063. By correlating artifacts like…

Malware

Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware

Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Save to Folio Key takeaways Void Dokkaebi (aka Famous Chollima) has migrated…

Malware

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…

Malware

New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages

The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…

MalwareInfostealers

Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads

Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript and triggering rapid mirroring across GitHub. Within 24 hours, threat actors took advantage…

Infostealers

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…

Malware

Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities

Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…

MalwarePhishingSupply chain

Ransomware Spotlight: Ransomhub

The following section details the initial infection chain observed from RansomHub activity as illustrated in Figure 1. Initial Access The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering…

Ransomware

Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™

Scenario 1 (Demeter), an emulation inspired by SHADOW-AETHER-015 shows the complexity of modern cloud attacks, where adversaries can pivot from compromised endpoints to cloud infrastructure, leveraging stolen credentials and tokens to establish persistence,…

EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks

By Jeffrey Francis Bonaobra, Joshua Aquino, Emmanuel Panopio, Emmanuel Roll, Joshua Lijandro Tsang, Armando Nathaniel Pedragoza, Melvin Singwa, Mohammed Malubay, Marco Dela Vega ( words) Key takeaways EvilAI disguises itself as productivity or AI-enhanced…

trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt

No excerpt available.

State-sponsored

Research, News, and Perspectives

Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting…

Examining a Sodinokibi Attack

Sodinokibi was first detected in April 2019 and linked to the retired GandCrab. From that point on, Sodinokibi launched several high-profile attacks that continued throughout 2020, thus making a name for itself as one of the ransomware families that should be…

Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News Links

By Elliot Cao, Joseph C. Chen, William Gamazo Sanchez, Lilang Wu, and Ecular Xu Contents 1 Attack Chain 1.1 Watering hole attack tactic 1.2 Infection chain 2 Exploits Analyses 2.1 The JavaScriptCore exploit 2.1.1 Bug triggering 2.1.2 The addrof/fakeobj…

MalwareVulnerabilitiesMobile