We look into a recent attack orchestrated by the Black Basta ransomware ransomware group that used the banking trojan QakBot as a means of entry and movement and took advantage of the PrintNightmare vulnerability to perform privileged file operations.
Tag: Trend Micro Research : Ransomware
Security Vendor News
Conti vs. LockBit: A Comparative Analysis of Ransomware Groups
by Shingo Matsugaya •
We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022.
Security Vendor News
Cuba Ransomware Group’s New Variant Found Using Optimized Infection Techniques
by Don Ovid Ladores •
Trend Micro Research observed the resurgence of the Cuba ransomware group that launched a new malware variant using different infection techniques compared to past iterations. We discuss our initial findings in this report.
Security Vendor News
Why It’s Time to Map the Digital Attack Surface
by Bharat Mistry •
Trend Micro research reveals struggle to control cyber risks against mounting digital attack surfaces.
Security Vendor News
Closing the Door: DeadBolt Ransomware Locks Out Vendors With Multitiered Extortion Scheme
by Trend Micro Research, News, Perspectives •
In this report, we investigate the reasons that the DeadBolt ransomware family is more problematic for its victims than other ransomware families that previously targeted NAS devices.
Security Vendor News
YourCyanide: A CMD-Based Ransomware With Multiple Layers of Obfuscation
by Ieriz Nicolle Gonzalez •
The Trend Micro Threat Hunting team recently analyzed a series of CMD-based ransomware variants with a number capabilities such as stealing user information, bypassing remote desktop connections, and propagating through email and physical drives.
Security Vendor News
YourCyanide: A CMD-based Ransomware With Multiple Layers of Obfuscation
by Ieriz Nicolle Gonzalez •
The Trend Micro Threat Hunting team recently analyzed a series of CMD-based ransomware variants with a number capabilities such as stealing user information, bypassing remote desktop connections, and propagating through email and physical drives.
Security Vendor News
New Linux-Based Ransomware ‘Cheerscrypt’ Targets EXSi Devices
by Arianne Dela Cruz •
Trend Micro Research detected “Cheerscrypt”, a new Linux-based ransomware variant that compromises EXSi servers. We discuss our initial findings on in this report.
Security Vendor News
New Linux-Based Ransomware Cheerscrypt Targets ESXi Devices
by Arianne Dela Cruz •
Trend Micro Research detected “Cheerscrypt”, a new Linux-based ransomware variant that compromises ESXi servers. We discuss our initial findings on in this report.
Security Vendor News
New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code
by Arianne Dela Cruz •
New findings showed that Cheerscrypt, a new Linux-based ransomware variant that compromises ESXi servers, was derived from the leaked Babuk source code. We discuss our analysis in this report.
Security Vendor News
Trend Micro’s One Vision, One Platform
by Trend Micro Research, News, Perspectives •
Why Trend Micro is evolving its approach to enterprise protection
Security Vendor News
Examining the Black Basta Ransomware’s Infection Routine
by Ieriz Nicolle Gonzalez •
We analyze the Black Basta ransomware and examine the malicious actor’s familiar infection tactics.
Security Vendor News
AvosLocker Ransomware Variant Abuses Driver File to Disable Antivirus, Scans for Log4shell
by Christoper Ordonez •
We found an AvosLocker ransomware variant using a legitimate antivirus component to disable detection and blocking solutions.
Security Vendor News
AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell
by Christoper Ordonez •
We found an AvosLocker ransomware variant using a legitimate anti-virus component to disable detection and blocking solutions.
Security Vendor News
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
by Lucas Silva •
We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in…
Security Vendor News
An In-Depth Look at ICS Vulnerabilities Part 3
by Trend Micro Research, News, Perspectives •
In our series wrap-up, we look into CVEs that affect critical manufacturing based on MITRE’s matrix. We also explore common ICS-affecting vulnerabilities identified in 2021.
Security Vendor News
Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload
by Earle Maui Earnshaw •
Both BLISTER and SocGholish are loaders known for their evasion tactics. Our report details what these loaders are capable of and our investigation into a campaign that uses both to deliver the LockBit ransomware.
Security Vendor News
An In-Depth Look at ICS Vulnerabilities Part 2
by Trend Micro Research, News, Perspectives •
In part two of our three-part series, we continue to analyze vulnerabilities using MITRE ATT&CK. We also look into the sectors affected and their risk levels.
Security Vendor News
This Week in Security News – March 18, 2022
by Jon Clay •
Global Cyberattacks: Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report, and US Has ‘Significant’ Cyber Vulnerabilities, But A Sweeping Russian Cyberattack Is Unlikely
Security Vendor News
Oil/Gas Cybersecurity: Halt Critical Operation Attacks
by Kazuhisa Tagaya •
Trend Micro has released a technical report on how the oil and gas industry can gain situational awareness across OT, IT and CT.
Security Vendor News
Utility Cybersecurity: Situational Awareness Cuts Risk
by Kazuhisa Tagaya •
Trend Micro has released a technical report on how the electric utility industry can gain situational awareness across entire network.
Security Vendor News
New Nokoyawa Ransomware Possibly Related to Hive
by Don Ovid Ladores •
In March 2022, we came across evidence that another, relatively unknown, ransomware known as Nokoyawa is likely connected with Hive, as the two families share some striking similarities in their attack chain, from the tools used to the order in which t…
Security Vendor News
Cyberattacks are Prominent in the Russia-Ukraine Conflict
by Trend Micro Research •
Alongside the physical conflict happening between Russia and Ukraine, there have also been an increasing number of alleged cyberattacks perpetrated by different groups.
Our research teams have verified and validated internal data and external reports t…
Security Vendor News
This Week in Security News – February 25, 2022
by Jon Clay •
Recent cyberattacks increasingly target open-source web servers, and US officials tell businesses to watch for potential ransomware attacks after Biden announces Russia sanctions
Security Vendor News
Ukraine Cyberattack 2022: Geopolitical Cybersecurity
by Trend Micro Research, News, Perspectives •
As geopolitical tensions rise, so does pressure to enhance corporate cyber-resilience
Security Vendor News
This Week in Security News – February 18, 2022
by Jon Clay •
SMS PVA services’ use of infected Android phones reveals flaws in SMS verification, and ‘Russian state-sponsored cyber actors’ cited in hacks of U.S. defense contractors
Security Vendor News
This Week in Security News – February 11, 2022
by Jon Clay •
Hidden scams in malicious scans, and feds arrest couple who allegedly laundered $1 Billion in stolen bitcoins
Security Vendor News
This Week in Security News – February 4, 2022
by Jon Clay •
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. Learn about the Samba vulnerability discovered by Trend Micro the White House’s warning of Russian hacks as te…
Security Vendor News
This Week in Security News – January 28th, 2022
by Jon Clay •
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, read the third installment of Trend Micro’s Codex series. Also, read about the White House’s latest…
Security Vendor News
Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant
by Junestherry Dela Cruz •
LockBit ransomware’s operators announced the release of its first Linux and ESXi variant in October. With samples also spotted in the wild, we discuss the impact and analysis of this variant.
Security Vendor News
This Week in Security News – January 21, 2022
by Jon Clay •
This week, read about various cybersecurity threats that affect industrial control and the Cybersecurity and Infrastructure Security Agency (CISA)’s latest cyberattack warnings.
Security Vendor News
Cybersecurity for Industrial Control Systems: Part 2
by Ericka Pingol •
To cap off the series, we’ll discuss malware detection and distribution in various countries. Our team also rounds up several insights to help strengthen ICS cybersecurity and mitigate malware attacks.
Security Vendor News
Defending Users’ NAS Devices From Evolving Threats
by Stephen Hilt •
In our latest research, we analyze the threats targeting well-known brands of network-attached storage (NAS) devices.
Security Vendor News
New Ransomware Spotted: White Rabbit and Its Evasion Tactics
by Arianne Dela Cruz •
We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer.
Security Vendor News
Cybersecurity for Industrial Control Systems: Part 1
by Trend Micro Research •
In this two-part series, we look into various cybersecurity threats that affected industrial control systems endpoints. We also discuss several insights and recommendations to mitigate such threats.
Security Vendor News
This Week in Security News – January 14, 2022
by Jon Clay •
This week, read about how crucial it is for security teams to adopt an integrated approach to threat detection, such as remote control, and Congress’s plan to update the Federal Information Security Management Act (FISMA) for the first time in eight ye…
Security Vendor News
This Week in Security News – January 7, 2022
by Jon Clay •
This week, read about Log4j vulnerabilities in connected cars and charging stations and how iOS malware can fake iPhone shutdowns to snoop on cameras and microphones.
Security Vendor News
This Week in Security News – December 17, 2021
by Jon Clay •
This week, read on Purple Fox’s infection chain observed by Trend Micro’s Managed XDR. Also, learn about the Log4j vulnerability that has the potential to cause ‘incalculable’ damage.
Security Vendor News
Staging a Quack: Reverse Analyzing a Fileless QAKBOT Stager
by Abraham Camba •
We analyzed a fileless QAKBOT stager possibly connected to the recently reported Squirrelwaffle campaign.
Security Vendor News
Volatile and Adaptable: Tracking the Movements of Modern Ransomware
by Trend Micro Research •
Trend Micro’s tracking of modern ransomware, as well as of older families, shows which attacks are gaining momentum and which families are particularly dangerous for enterprises and private users.