www.trendmicro.com
Open in
urlscan Pro
23.56.204.250
Public Scan
URL:
https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html
Submission: On May 16 via api from TR — Scanned from DE
Submission: On May 16 via api from TR — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___hqsp3">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* Platform
* Trend One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Products
* Cloud Security
* Cloud Security
* Trend Cloud One
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Endpoint Security
* Endpoint Security
Defend your endpoints at every stage
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* OT & ICS Security
* OT & ICS Security
Learn more
* Endpoint & Email Security
* Endpoint & Email Security
* Endpoint & Email Security Overview
Protect your users on any device, any application, anywhere with Trend
Micro Workforce One
Learn more
* Endpoint Protection
* Endpoint Protection
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Security Operations
* Security Operations
* Trend Vision One
Security Operations Overview
A cloud-native security operations platform built to empower security
teams
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Channel Partners
* Channel Partners
* Channel Partner Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* About
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Company
* Company
* Company
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Resources
* Resources
* Resources
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Investors
* Investors
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Endpoints
WATER ORTHRUS'S NEW CAMPAIGNS DELIVER ROOTKIT AND PHISHING MODULES
Water Orthrus has been active recently with two new campaigns. CopperStealth
uses a rootkit to install malware on infected systems, while CopperPhish steals
credit card information. This blog will provide the structure of the campaign
and how they work.
By: Jaromir Horejsi, Joseph C Chen May 15, 2023 Read time: 9 min (2421 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
Since 2021, we have been tracking the activities of a threat actor we called
Water Orthrus, which distributed CopperStealer malware via pay-per-install (PPI)
networks. The threat actor has upgraded and modified the malware multiple times
for different purposes, such as injecting network advertisements, acquiring
personal information, and stealing cryptocurrency. We believe that they are
associated with the threat campaign reported as “Scranos” in 2019.
Figure 1. CopperStealth infection chain
In March 2023, we observed two campaigns delivering new malware that we named
CopperStealth and CopperPhish. Both malware have characteristics that are
similar to those of CopperStealer and are likely developed by the same author,
leading us to believe that these campaigns are likely Water Orthrus’ new
activities.
Figure 2. CopperPhish infection chain
This blog post discusses our analysis of CopperStealth’s and CopperPhish’s
infection chains, and how they are similar to Water Orthrus.
CopperStealth campaign
The first campaign distributed CopperStealth on March 8, 2023, delivering the
malware via installers provided on a popular Chinese software sharing website.
It disguised the malware as free software and targeted the country’s users.
CopperStealth’s infection chain involves dropping and loading a rootkit, which
later injects its payload into explorer.exe and another system process. These
payloads are responsible for downloading and running additional tasks. The
rootkit also blocks access to blocklisted registry keys and prevents certain
executables and drivers from running.
A sample of the installer (SHA-256:
8a21eae144a23fffd35f8714964ff316caaa37fe464e8bbc143f4485119b5575) was
distributed via a popular Chinese software download website. It was previously
reported to provide malicious installers for infecting malware. The installer
contains numerous encoded URLs; when the installer is run these URLs will be
decoded and the files located at the said URLs will be downloaded and run on the
affected system. One of these files was a dropper that we identified as
CopperStealth.
CopperStealth (after decrypting the custom crypter) contains an export function
called “HelloWorld,” which has been around since earlier versions of
CopperStealer. The dropper then checks if the system architecture is 32-bit or
64-bit, which it uses as a basis to read the corresponding driver from its
resources.
Figure 3. CopperStealth’s code for selecting 32-bit or 64-bit drivers
Figure 4. CopperStealth’s resources contain two versions of the driver
It then creates and starts a new driver service, which begins when the system
starts.
Figure 5. The new driver service created by CopperStealth
Rootkit
The rootkit is registered as a file system filter driver. In the main entry
point (DriverEntry function), the driver has specific handlers for
IRP_MJ_CREATE, IRP_MJ_READ, and IRP_MJ_SHUTDOWN.
When a shutdown request is received, the rootkit driver copies itself to a newly
generated random driver. This is done with a few registry modifications, such as
changing the driver name in the HKLM\SYSTEM\CurrentControlSet\Services registry
and inserting a “PendingFileRenameOperations” registry value in
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager to automatically move the
file upon reboot.
As for IRP_MJ_READ, this monitors any attempts to read the files on filesystem.
If any attempt to read the current rootkit’s SYS file or executable file in
\windows\temp folder by one of the blocklisted processes (such as \360saf\,
\kingsoft antivirus\, \360SD\, \Windows Defender\) is detected, the driver will
result in a STATUS_ACCESS_DENIED error message, preventing access to those
files.
The rootkit then registers a registry callback routine, which is called every
time a thread performs an operation in the registry. In this case, the routine
monitors attempts to access rootkit’s registry path in
HKLM\SYSTEM\CurrentControlSet\Services\<drivername>. Any attempt to delete the
registry key (such as RegNtDeleteKey OR RegNtDeleteValueKey) will result in
STATUS_ACCESS_DENIED, blocking the operation.
An attempt to query the registry key (RegNtQueryKey OR RegNtQueryValueKey) while
any of the blocklisted processes (360safe.exe, 360sd.exe, QQPCTray.exe, and
kxetray.exe) is running will also result in a STATUS_ACCESS_DENIED message.
Figure 6. Rootkit’s code to block querying it’s (rootkit’s) own registry key, if
any of the blocklisted processes is running
The rootkit also sets an image load notification routine, which is called
whenever a new image (i.e., an executable/binary file, like .EXE, .DLL, and .SYS
files) is loaded into memory. If an “image” name corresponds to the hardcoded
filename (\Fix\fixMBR.exe), then a DLL library (embedded inside the driver) is
mapped and run into the newly created process. The 64-bit version of the rootkit
contains a 32-bit and a 64-bit version of the DLL library.
Figure 7. Rootkit’s code that terminates newly executed processes by injected
DLL
In either version, the injected DLL library calls ExitProcess after attaching to
the newly created process, which immediately terminates it.
Figure 8. Termination DLL exits process
If the newly loaded process is a driver, then the rootkit searches for a few
blocklisted byte sequences. If any of those are found, then the driver’s entry
point is patched to return STATUS_ACCESS_DENIED.
Figure 9. Rootkit replaces blocklisted drivers‘ entrypoints to return error code
The blocklisted drivers contain one of the following byte sequences:
* Beijing Huorong Network Technology Co., Ltd.
* Beijing Kingsoft Security Software Co., Ltd.
* Beijing Qihu Technology Co., Ltd.
* HuoRongBoRui (Beijing) Technology Co., Ltd.
* Qihoo 360 Software (Beijing) Co., Ltd.
Lastly, the rootkit starts a payload injection thread. In the samples we
analyzed, we saw two types of payloads: statistics module and task module. This
thread enumerates all running processes (SystemProcessInformation) and looks for
explorer.exe and another process with SYSTEM integrity having “assign primary
token privilege” and “increase quota privilege.” It also increments the
HKLM\SOFTWARE\Microsoft\recount registry value, which holds the number of system
restarts since the machine became infected. If the restart recount value is
greater than three, the rootkit decrypts (AES cipher) and unpacks (7-Zip)
embedded statistics in the DLL module, then it patches its statistics URL
address inside the binary (placeholder starting with “cnzz_url”), and finally
injects the patched module into explorer.exe.
Figure 10. Placeholder inside the statistics module, which the rootkit replaces
with its statistics URL
After successful injection into explorer.exe, it makes a GET request to the task
URL to get the task command to be performed. Once the GET request is done by the
driver, then the response to the GET request is then inserted (a place holder
starting with “searching_magic_url”) into the task module, which, like the
statistics module, is embedded in rootkit. It must be AES-encrypted, and then
7-Zip unpacked.And then the task module is injected into the previously found
process with system integrity.
Figure 11. Placeholder inside the task module, which the rootkit replaces with a
response to the task URL
Statistics module
The statistics module is called cnzz (the largest Chinese internet statistics
analysis service), though it has nothing to do with this organization. Each time
it is run it increases the counter in HKCU\Software\Microsoft\count_a0b1c2d3. It
checks the internet connection by trying to access
hxxp://www.msftconnecttest.com/connecttest.txt, and once verified it will get
the computer’s unique machine ID and report the statistics to
hxxp://cnzz_url&m=<machine ID> then exits the module.
In some cases, cnzz_url contains keyword “tongji” (tǒng jì, 統計), which
translates to “statistics.”
Task module
The task module is called curl, even though it has nothing to do with curl
(command line tool for transferring data with URLs). The module then proceeds
with base64 decoding and DES decrypting (key=”taskhost”, IV=”winlogon”, which is
the same encryption as described in previous blog posts) of the task command.
The decrypted task is in JSON format and has the following keys:
Name Type Explanation name string File name created in TEMP directory onlyone
bool Run only once exclude360 bool Exclude machines where 360tray is running
reboot_count int The task should be run every n-th reboot of the system url
string URL with the file to download and execute
Table 1. List of implemented key names and value types in task query response
(in JSON format)
If payload is expected to run only once (with onlyone [sic] key has value =
true), then the hash of the URL is stored in HKLM\Software\Microsoft\<hash>. The
actual count of runs is taken from
HKEY_USERS\<SID>\Software\Microsoft\count_a0b1c2d3, which is set by the
statistics module.
CopperPhish campaign
In April 2023, we noticed another campaign distributing CopperPhish. This
campaign was not geofenced and delivered the malware via PPI networks behind
free anonymous file sharing websites. CopperPhish is an interesting phishing
kit, which uses two different processes for persistence: credential verification
and confirmation code to ensure that valid credentials are phished before the
phishing kits considers its job successful and exits.
CopperPhish’s infection chain starts with downloaders like PrivateLoader
(SHA-256: 48211c6f957c2ad024441be3fc32aecd7c317dfc92523b0a675c0cfec86ffdd9).
Visitors will be redirected to a download page designed by the PPI network after
clicking on its advertisements, which pretended to be a download link. The
downloaded file is PrivateLoader, which downloads and runs many different
malware.
Figure 12. The download page of the pay-per-install network redirected from file
sharing websites.
The downloader downloads and starts a new dropper we identified as CopperPhish.
It decrypts and loads the second stage. This stage is responsible for dropping
and starting the main payload. The main payload is again obfuscated with the
same crypter used by CopperStealer, and then the second stage of the main
payload drops a few files (PNG image with logo, PNG image with QR code, and HTML
page with phishing URL) into %APPDATA%\Roaming\Microsoft.
Figure 13. Dropped phishing files by CopperPhish
These files are stored in the main payload’s second stage’s resources. These
HTML pages are localized to fifty different languages. Each language has its own
HTML file, but since PNG images do not contain any text, they remain the same
for all language versions.
Figure 14. Phishing webpages in different language variants, stored in resources
The main malware then starts the two threads — the persistence thread is
responsible for starting a rundll32 process and injecting a simple program with
a browser window (written in Visual Basic) in it.
Figure 15. The thread responsible for starting processes with a web browser
window
The exit message thread connects to a named pipe and waits for a message
containing a magic string to be received. If the message is received, then the
main program uninstalls itself (and deletes all the dropped phishing files) and
exits. This indicates that the confirmation code (more on this code later)
entered by the victim was correct, which means that the phishing was successful
and it can uninstall itself.
Figure 16. Opened pipe that waits for a message to close and uninstall
CopperPhish
Figure 17. Code that uninstalls the phishing tool after receiving magic values
The web browser program loads an instance of an Internet Explorer object and
uses the web browser control class (SHDocVwCtl) to control the behavior of the
web browser object. It reads the value written by the victim of the input text
field called “checkcode” (which will be explained later). If correct, it then
sends the exit message to the main payload via the pipes mentioned earlier.
Figure 18. Exit message sent to the main payload via pipe
The phishing webpage displayed by the web browser shows the content of the
dropped page with the Microsoft logo and QR code. The window has no controls
that can be used to minimize or close it. The victim could close the browser’s
process in Task Manager or Process Explorer, but they would also need to
terminate the main payload process, otherwise the browser process will happen
again due to the persistence thread. Thus, to proceed, a confirmation code will
be asked (which was stated after Figure 15), and this code will act as proof
that the victim provided the correct details.
Figure 19. Initial phishing webpage displayed by CopperPhish
After scanning and opening the phishing URL, the victim is presented with a
webpage asking to confirm the identity.
Figure 20. Phishing webpage asking to confirm the user’s identity
A follow-up webpage asks for various sensitive details, such as the user’s
credit card number, its expiration date, and the CVV code.
Figure 21. Phishing website asking for sensitive banking details
And after entering the sensitive details and passing checks (such as a credit
card number validity check), the phishing kit displays a success message and
shows the confirmation code, which closes the browser and uninstalls the
phishing kit from the system. This is the “checkcode” mentioned previously.
Figure 22. Confirmation code displayed after credentials were successfully
phished
Figure 23. Code in the phishing webpage to validate the user’s credit card
number, expiration date, and CVV
This is a simple but interesting approach. If the phishing page is displayed in
a standard browser window or tab, the user can simply close the window or tab
and continue working. In this case, two processes are used — one for
persistence, and another for displaying the phishing window. This sort of
persistence, though simple and easy to remove, can remain and display longer,
which could annoy victims enough to force them to enter the credentials just to
get rid of the phishing window.
The credential verification and confirmation code are two useful features that
make this phishing kit more successful, as the victim cannot simply close the
window or enter fake information just to get rid of the window.
Attribution
We classify both previously mentioned campaigns to be related to previously
analyzed campaigns because of the following similarities:
1. The use of the same crypter, which encrypts the dropper stage (described in
our previous blog posts).
2. The use of Data Encryption Standard (DES) with the same key (“taskhost”) and
initialization vector (“winlogon”).
3. The use of the same name of the DLL export function (for later versions of
CopperStealer).
4. The use of similar mutex naming conventions (previously: exist_sign_cps,
exist_sign_task_Hello001, exist_sign__install_r3 now: exist_sign_redns,
dl_exist_sign_cnzz, dl_exist_sign_sys).
Conclusion
We uncovered two new campaigns conducted by the Water Orthrus threat actor. The
actor has not only refined their malware but has also tailored their attacks for
different targets. The CopperStealth campaign, distributed to machines in China,
focuses in installing the rootkit, which later delivers additional malware.
Meanwhile, CopperPhish aims to phish credit card information and is distributed
globally. It is likely that the actor has multiple objectives at the same time.
Our findings also highlight the shift of Water Orthrus’s interests, from
personal information to cryptocurrency, and now targeting credit card
information.
A proactive approach on security can help organizations protect their devices
against these types of threats. Trend Micro Apex One™ employs a variety of
threat detection capabilities, notably behavioral analysis that protects against
malicious scripts, injection, ransomware, and memory and browser attacks related
to fileless threats. Additionally, the Apex One Endpoint Sensor provides
context-aware endpoint detection and response (EDR) that monitors events and
quickly examines what processes or events are triggering malicious activity.
IOCs
The full list of IOCs can be found here.
Tags
Malware | Endpoints | Research | Phishing | Articles, News, Reports
AUTHORS
* Jaromir Horejsi
Threat Researcher
* Joseph C Chen
Threat Researcher
Contact Us
Subscribe
RELATED ARTICLES
* Codex Exposed: Helping Hackers in Training?
* Codex Exposed: Task Automation and Response Consistency
* Codex Exposed: How Low Is Too Low When We Generate Code?
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo