Daniel Lunghi
@thehellu.bsky.social
📤 159
📥 88
📝 10
Threat researcher at Trend Micro mostly focused on APT
pinned post!
We saw Earth Estries, an advanced
#APT
intrusion set, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups
www.trendmicro.com/en_us/resear...
7 months ago
2
20
15
We investigated a China-aligned
#APT
that targeted multiple governments and companies with government contracts in Asia. In half of the targets we found a second group with different malware toolkit but sharing the infection vector and some post-exploitation tools.
www.trendmicro.com/en_us/resear...
7 days ago
0
2
1
This is also our first edition of annual APT landscape report :)
add a skeleton here at some point
21 days ago
0
2
0
reposted by
Daniel Lunghi
Feike Hacquebord
3 months ago
TrendAI formalizes threat attribution as a structured, repeatable discipline by combining standardized evidence scoring, relationship mapping, and bias testing, with a temporary stage that separates clustering from final naming. Article on how we attribute:
www.trendmicro.com/vinfo/us/sec...
loading . . .
Threat Attribution Framework: How TrendAI™ Applies Structure Over Speculation
TrendAI™ brings structure and discipline to threat attribution, helping security leaders and teams make informed decisions about cyber risk, incident response, and overall defensive posture.
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/threat-attribution-framework-how-trendai-applies-structure-over-speculation
0
2
1
We investigated an
#APT
with links to Void Rabisu (Romcom) that used Trend Micro updates as a lure in a recent campaign involving vulnerability exploitation. There were at least 4 stages before the final payload, some of them being tailored to the targeted machine
www.trendmicro.com/en_us/resear...
5 months ago
0
1
1
We saw Earth Estries, an advanced
#APT
intrusion set, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups
www.trendmicro.com/en_us/resear...
7 months ago
2
20
15
We released a report on an updated version of
#Shadowpad
including anti-debugging features and new configuration structure, that in some cases deploy a custom ransomware family. We have mainly seen the manufacturing industry being targeted in Europe and Asia
www.trendmicro.com/fr_fr/resear...
#APT
about 1 year ago
1
6
3
Intelligence Online links the MOONSHINE framework that we discussed in our Earth Minotaur report (
www.trendmicro.com/en_us/resear...
) to a Chinese company
www.intelligenceonline.com/surveillance...
(article is free but needs registration to access it). Happy new year UPSEC ! 😘
loading . . .
China : Chinese firm behind hacking operations against Uyghurs and Tibetans unveiled
Intelligence Online has established a link between a Chinese public security ministry contractor and recent IT hacking operations carried out in China and abroad against the two minorities, reviled
https://www.intelligenceonline.com/surveillance--interception/2025/01/29/chinese-firm-behind-hacking-operations-against-uyghurs-and-tibetans-unveiled,110368855-evg
over 1 year ago
1
9
11
reposted by
Daniel Lunghi
Feike Hacquebord
over 1 year ago
Since Aug 2024 Earth Koshchei (APT29, Midnight Blizzard) used 193 RDP relays and 34 rogue backends against military, MFAs and others. The campaign peak was likely preceded by barely audible campaigns that ended with a bang in Oct 2024. Details and indicators here:
www.trendmicro.com/en_us/resear...
loading . . .
Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks
https://www.trendmicro.com/en_us/research/24/l/earth-koshchei.html
0
8
7
Our latest report presents Earth Minotaur, a threat actor targeting Tibetans and Uyghurs using Moonshine, an exploitation framework for Android apps described in 2019 by
@citizenlab.ca
leveraging vulnerabilities in applications embedding old versions of Chromium
trendmicro.com/en_us/resear...
over 1 year ago
0
12
9
you reached the end!!
feeds!
log in