Detecting Windows AMSI Bypass Techniques

We look into some of the implementations that cybercriminals use to bypass the Windows Antimalware Scan Interface AMSI and how security teams can detect threats attempting to abuse it for compromise with Trend Micro Vision One™...

Security Culture Matters when IT is Decentralized

Decentralization can make enterprises more agile but it also makes IT and network security more complex. Creating a strong security culture, deploying the right tools, and defining an incident response plan are key to keeping the business protected...

DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework

This report provides defenders and security operations center teams with the technical details they need to know should they encounter the DeimosC2 C&C framework...

Addressing Ransomware in Hospitals & Medical Devices

Ransomware attacks have been on the rise in recent years, and hospitals are increasingly becoming targets. In many cases, these attacks can have devastating consequences, disrupting vital services and putting patients' lives at risk...

How Will the Metaverse Affect Cloud Security?

The metaverse is an immersive digital world of augmented reality. While supporting a virtual universe relies on cloud storage, questions arise on how this will affect cloud security. Gain valuable insight on security concerns surrounding the metaverse now and in the near future...

Red Teaming to Reduce Cyber Risk

Discover how red teaming can help reduce cyber risk across your ever-expanding digital attack surface...

Top Five Patch Management & Process Best Practices

Explore the top patch management best practices to mitigate the growing threat of vulnerability exploits in your organization...

Oil and Gas Cybersecurity: Industry Overview Part 1

With geopolitical tensions running high, oil and gas companies may be more susceptible to cyberattacks...

Transport Layer Security (TLS): Issues & Protocol

Although Transport layer security TLS provides enhanced security, cybercriminals have become increasingly savvy, finding ways to circumvent many of these protections. Learn how malicious actors exploit vulnerabilities within TLS to introduce new forms of malware...

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Gootkit has been known to use fileless techniques to drop Cobalt Strike and other malicious payloads. Insights from a recent attack reveal updates in its tactics...

Analyzing Penetration-Testing Tools That Threat Actors Use to Breach Systems and Steal Data

We discovered the use of two Python penetration-testing tools, Impacket and Responder, that malicious actors used to compromise systems and exfiltrate data. We share our key findings in this report...

Top 5 Infrastructure as Code Security Challenges

Learn how to counteract the top five challenges of IaC and discover how these obstacles pose a threat to security and gain valuable insight in how to mitigate these risks...

Data Distribution Service: An Overview Part 1

In this three-part blog series, we’ll look into Data Distribution Service, why it is critical, and how you can mitigate risks associated with it...

How to Present Cloud Risk to the Board

Trend Micro Security Researcher, Erin Sindelar, breaks down three popular types of cloud risk assessments to help CISOs and security leaders better explain cyber risk to the board...

Cyber Risk Management Strategies from Arjo CIO

Andrea Berg, CIO of Arjo, explores the critical need for effective and inclusive communication around IT requirements to expand beyond the security team and improve cyber risk management...

Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys

We recently observed a number of apps on Google Play designed to perform malicious activities such as stealing user credentials and other sensitive user information, including private keys...

Trend Micro Partnering with Bit Discovery

We’re excited to partner with Bit Discovery, bringing attack surface discovery capabilities to the Trend Micro One platform, providing ongoing visibility to internal assets devices, identities, applications but also external, internet-facing assets...

Cyclops Blink Sets Sights on Asus Routers

This report discusses the technical capabilities of this Cyclops Blink malware variant that targets ASUS routers and includes a list of more than 150 current and historical command-and-control C&C servers of the Cyclops Blink botnet...

New Ransomware Spotted: White Rabbit and Its Evasion Tactics

We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer...

Trend Micro Cloud One Network Security-as-a-Service

Trend Micro, alongside Amazon Web Services, provides the latest in cloud-native deployment options. We have simplified network security, protecting customers across Virtual Private Clouds VPCs without needing agents to be installed on instances...

AWS re:Invent 2021 Guide: Checklist & Key Sessions

Welcome to your complete guide to AWS re:Invent 2021, where you will find tips on how to get the most out of your conference experience both in Las Vegas and virtually...

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Squirrelwaffle is known for using the tactic of sending malicious spam as replies to existing email chains. We look into how by investigating its exploit of Microsoft Exchange Server vulnerabilities, ProxyLogon and ProxyShell...

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

In this blog entry, we will take a look at the ProxyShell vulnerabilities that were being exploited in these events, and dive deeper into the notable post-exploitation routines that were used in four separate incidents involving these web shell attacks...

Ctrl+Alt+Truth. Welcome to the future of cybercrime

Welcome to 2030, to the nation of New San Joban, where a single keystroke can alter reality. Discover what a fully converged digital world means for the future of cybersecurity, and how you can stay ahead of the bad guys...

Security Risks with Private 5G in Manufacturing Companies Part. 2

We can see signs of increased activity in areas of business that use 5G around the world. 5G technology will usher in new personal services through smartphones, and it will also play a large part in industry. The option of Private 5G lets private companies and local governments have their own...

October Patch Tuesday: 3 Critical Bulletins Among 71

The October Patch Tuesday maintains the relatively peaceful streak from previous months with only 3 bulletins rated as Critical among 71 new vulnerabilities...

Manage Open Source Software Library Risks

Learn about the growing open source library trend, the pros and cons of using open source code, and how to mitigate associated risks...

#LetsTalkSecurity - Security at the Speed of Change

Let's Talk Security: Season 02 // Episode 05: Host, Rik Ferguson, interviews Vice President and Chief Information Security Officer for Carrier, Nicole Darden Ford. Together they discuss the changing cybersecurity landscape...

PurpleFox Using WPAD to Target Indonesian Users

The PurpleFox Exploit Kit is now being distributed via WPAD attacks targeting Indonesian users...

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Our telemetry showed three malware families taking advantage of the ProxyLogon vulnerability beginning in March: the coinminer LemonDuck was sighted first, quickly followed by the ransomware BlackKingdom, then the Prometei botnet...

Water Pamola Attacked Online Shops Via Malicious Orders

Since 2019, we have been tracking a threat campaign we dubbed as “Water Pamola.” The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments...

XCSSET Quickly Adapts to macOS 11 and M1-based Macs

This latest update details our new research on XCSSET, including the ways in which it has adapted itself to work on both ARM64 and x86x64 Macs...

How to Secure AWS Cloud Storage

Discover how to quickly install and integrate Trend Micro Cloud One with Amazon Web Services AWS...

Achieve Operational Excellence in Your Cloud Workload

Explore the Operational Excellence pillar of the AWS and Azure Well-Architected Framework and examine best practices and design principles for cloud-based security operations, including CI/CD and risk management...

Connected Security Solutions Helps City of Tyler’s CIO to Reduce Costs While Enabling Delivery of Enhanced Community & Public Safety Services

“We’re here to serve” is Benny Yazdanpanahi’s motto as CIO for City of Tyler located in Texas. Supporting a population of approximately 107,000, Yazdanpanahi’s vision for his city relies on the use of data to deliver exceptional services to citizens, today and into the future. Since joining the...

Perspectives Summary – What You Said

On Thursday, June 25, Trend Micro hosted our Perspectives 2-hour virtual event. As the session progressed, we asked our attendees, composed of +5000 global registrants, two key questions. This blog analyzes those answers. First, what is your current strategy for securing the cloud? Rely completel...

The Many Paths To A Cybersecurity Education

Ask a room full of cybersecurity professionals about their educational background and how they got started on their career path and you’re going to get a myriad of different answers. From one perspective, that’s frustrating. It’s hard to confidently recommend a path for people starting out when...

Phishing, Part 1: On the Lookout

Cybersecurity has gone mainstream, thanks in part to the hacking of the 2016 Presidential election. But how many of us know how the attackers in this case actually achieved their ends? The truth is, that one of the oldest, but most effective weapons in the cybercriminal’s arsenal, undoubtedly use...

Building a Profitable Security Services Offering Part 2 IT Security Features and Benefits Overview

Trend Micro is excited to partner with SPC International in this 5-part Blog, Webinar and Online Training Series; focused on Building a Profitable Security Services Offering for MSP Partners. Through the series, SPC will teach you a selling process of leading with security, steps in growing your...

This Week in Security News: Magic Quadrants & Global Threats

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Gartner released its Magic Quadrant Leaders, Data Privacy Day gave us a moment to reflect, and U.K. and U.S. governments alike acted to...

Applying Lean to Information Risk Management

Lean Manufacturing brings significant benefits to industry, including cost reduction, quality improvement, reduced cycle time, and greater customer satisfaction See “The Machine that Changed the World”, Womak, J., Jones, D., and Roos, D., Free, Press, 1990 for the groundbreaking analysis of...

Challenges with Critical Infrastructure: IoT, Smart Cities Under Attack

Internet of Things technology is now more widespread than many people realize. Systems that fall under the IoT umbrella are popping up in an array of settings, even outside consumer circles. Today, every group from enterprise businesses to city governments is utilizing intelligent, internet- and...

4 ways mobile devices still threaten your business

Mobile devices have been commonly used in corporate environments for decades - bulky portable telephones, heavy laptops and PDAs. Then along came Apple and the smartphone, and soon everyone either had personal smartphone or expected their employers to provide one. Since then, enterprise mobility...

U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026

The first quarter of 2026 has reinforced a hard truth: U.S. government agencies and educational institutions are operating in the most hostile cyber threat environment ever recorded...

Proactive Security and Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)

CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse...

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

This blog discusses the latest modifications observed in Earth Kasha’s TTPs from their latest campaign detected in March 2025 targeting Taiwan and Japan...

NVIDIA Riva Vulnerabilities Leave AI-Powered Speech and Translation Services at Risk

Trend Research uncovered misconfigurations in NVIDIA Riva deployments, with two vulnerabilities, CVE-2025-23242 and CVE-2025-23243, contributing to their exposure. These security flaws could lead to unauthorized access, resource abuse, and potential misuse or theft of AI-powered inference service...

Invisible Prompt Injection: A Threat to AI Security

This article explains the invisible prompt injection, including how it works, an attack scenario, and how users can protect themselves...

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Since 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations...

Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East

Trend Micro's investigation into the recent activity of Earth Simnavaz provides new insights into the APT group’s evolving tactics and the immediate threat it poses to sectors in the Middle East...