CINXE.COM
Reflective Loading Runs Netwalker Fileless Ransomware | Trend Micro (US)
<!DOCTYPE HTML> <html lang="en-US"> <!-- OneTrust Cookies Consent Notice start for trendmicro.com --> <script type="text/javascript" src="https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js"></script> <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="821060e3-3f9c-4a2f-8613-8e0db4841f79"></script> <script type="text/javascript">function OptanonWrapper() { }</script> <!-- OneTrust Cookies Consent Notice end for trendmicro.com --> <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script type="text/javascript"> if (typeof Granite !== "undefined" && Granite.I18n){ Granite.I18n.setLocale("en_us" || "en"); } </script> <head> <meta charset="UTF-8"/> <meta name="viewport" content="width=device-width, initial-scale=1"/> <meta name="description" content="Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection. We discuss how Netwalker ransomware is deployed filelessly through reflective DLL injection."/> <meta name="robots" content="index,follow"/> <meta name="keywords"/> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/> <meta name="template" content="article1withouthero"/> <meta property="article:published_time" content="2020-05-18"/> <meta property="article:tag" content="ransomware"/> <meta property="article:section" content="research"/> <link rel="icon" type="image/ico" href="/content/dam/trendmicro/favicon.ico"/> <link rel="canonical" href="https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html"/> <title>Reflective Loading Runs Netwalker Fileless Ransomware | Trend Micro (US)</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600" rel="stylesheet"/> <link href="//customer.cludo.com/css/296/1798/cludo-search.min.css" type="text/css" rel="stylesheet"/> <link rel="stylesheet" href="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css" type="text/css"> <link rel="stylesheet" href="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css" type="text/css"> <script src="//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js"></script> <meta property="og:url" content="https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html"/> <meta property="og:title" content="Reflective Loading Runs Netwalker Fileless Ransomware"/> <meta property="og:description" content="Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection. We discuss how Netwalker ransomware is deployed filelessly through reflective DLL injection."/> <meta property="og:site_name" content="Trend Micro"/> <meta property="og:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/20/e/reflective-loading-runs-netwalker-fileless-ransomware/Reflective-Loading-Runs-Netwalker-Fileless-Ransomware-641.jpg"/> <meta property="og:locale" content="en_US"/> <meta name="twitter:card" content="summary_large_image"/> <meta name="twitter:site" content="@TrendMicro"/> <meta name="twitter:title" content="Reflective Loading Runs Netwalker Fileless Ransomware"/> <meta name="twitter:description" content="Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection. We discuss how Netwalker ransomware is deployed filelessly through reflective DLL injection."/> <meta name="twitter:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/20/e/reflective-loading-runs-netwalker-fileless-ransomware/Reflective-Loading-Runs-Netwalker-Fileless-Ransomware-641.jpg"/> </head> <body class="articlepage page basicpage context-business"> <!-- Page Scroll: Back to Top --> <a id="page-scroll" title="VerticalPageScroll" href="javascript:jumpScroll($(this).scrollTop());"> <span class="icon-chevron-up"></span> </a> <!-- /* Data Layers */ --> <script type="text/javascript"> var utag_data = {"customer_cookie_type":"business","language_code":"en_us","page_name":"research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading/en_us","category_id":"en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading","page_type":"unknown","site_section":"research","post_author":"Karen Victor|Threats Analyst","post_date":"2020-05-18"}; </script> <script type="text/javascript"> window.adobeDigitalData = typeof(window.adobeDigitalData) != "undefined" ? window.adobeDigitalData : []; window.adobeDigitalData.push( {"pageID":"6599c0f5a961","articleTitle":"Reflective Loading Runs Netwalker Fileless Ransomware","description":"Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection. We discuss how Netwalker ransomware is deployed filelessly through reflective DLL injection.","thumbnailUrl":"/content/dam/trendmicro/global/en/research/20/e/reflective-loading-runs-netwalker-fileless-ransomware/Reflective-Loading-Runs-Netwalker-Fileless-Ransomware-641.jpg","pageUrl":"https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html","publishedDate":"2020-05-18","pageTag":"ransomware","pageSection":"research"} ); </script> <script type="text/javascript">(function(a,b,c,d){a='//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js';b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);})();</script> <div class="businessHeaderV1"> <div class="headerAssemblyV1"> <header class="page-header"> <nav> <div class="header-bar"> <div class="logo"> <a id="header-logo" href="/en_us/business.html"> <img src="/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg"/> <p>Business</p> </a> </div> <div class="inner-nav-wrapper"> <span class="material-symbols-outlined search-icon">search</span> <span class="material-symbols-outlined close-search-icon">close</span> <input type="checkbox" id="checkbox" class="hamburger-menu"/> <div aria-label="Menu" class="hamburger"></div> </div> </div> <div class="hamburger-wrapper"> <div class="mainNavMenuV1"><div class="mainNavMenu mainNavMenuV1"> <div class="list-wrapper inital-list-wrapper"> <ul class="menu nav-level-0"> <li> <!-- Level 0, top menu --> <div class="label">Solutions</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Challenge</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/cyber-risk.html">Understand, Prioritize & Mitigate Risks</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Understand, Prioritize & Mitigate Risks</div> <p class="copy">Improve your risk posture with attack surface management</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cyber-risk.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Protect Cloud-Native Apps</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Cloud-Native Apps</div> <p class="copy">Security that enables business outcomes</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Protect Your Hybrid World</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Your Hybrid, Multi-Cloud World</div> <p class="copy">Gain visibility and meet business needs with security</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/infrastructure-security.html">Securing Your Borderless Workforce</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Securing Your Borderless Workforce</div> <p class="copy">Connect with confidence from anywhere, on any device</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/infrastructure-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/network-security.html">Eliminate Network Blind Spots</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Eliminate Network Blind Spots</div> <p class="copy">Secure users and key operations throughout your environment</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/network-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/detection-response.html">See More. Respond Faster.</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">See More. Respond Faster.</div> <p class="copy">Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/detection-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/managed-services.html">Extend Your Team</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Extend Your Team. Respond to Threats Agilely</div> <p class="copy">Maximize effectiveness with proactive risk reduction and managed services</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/managed-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/zero-trust.html">Operationalizing Zero Trust</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Operationalizing Zero Trust</div> <p class="copy">Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/zero-trust.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Role</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/ciso.html">CISO</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">CISO</div> <p class="copy">Drive business value with measurable cybersecurity outcomes</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/ciso.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/soc.html">SOC Manager</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">SOC Manager</div> <p class="copy">See more, act faster</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/soc.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Infrastructure Manager</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Infrastructure Manager</div> <p class="copy">Evolve your security to mitigate threats quickly and effectively</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/cloud-developer.html">Cloud Builder and Developer</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Builder and Developer</div> <p class="copy">Ensure code runs only as intended</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-developer.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/cloud-operations.html">Cloud Security Ops</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Security Ops</div> <p class="copy">Gain visibility and control with security designed for cloud environments</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Industry</div> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for/healthcare.html">Healthcare</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Healthcare</div> <p class="copy">Protect patient data, devices, and networks while meeting regulations</p> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/healthcare.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Manufacturing</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Manufacturing</div> <p class="copy">Protecting your factory environments – from traditional devices to state-of-the-art infrastructures</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Oil & Gas</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Oil & Gas</div> <p class="copy">ICS/OT Security for the oil and gas utility industry</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Electric Utility</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Electric Utility</div> <p class="copy">ICS/OT Security for the electric utility</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for/federal-government.html">Federal</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Federal</div> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/federal-government.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Automotive</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Automotive</div> <a class="leaf-button color-d71920" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">5G Networks</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Networks</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/small-business/platform.html">Small & Midsized Business Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Small & Midsized Business Security</div> <p class="copy">Stop threats with easy-to-use solutions designed for your growing business</p> <a class="leaf-button color-d71920" href="/en_us/small-business/platform.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <!-- Level 0, top menu --> <div class="label">Platform</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/one-platform.html" id="b-nav-platform-1">Vision One Platform</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/one-platform.html" id="b-nav-platform-2">Vision One Platform</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One</div> <div class="title">Our Unified Platform</div> <p class="copy">Bridge threat protection and cyber risk management</p> <a class="leaf-button color-d71920" href="/en_us/business/products/one-platform.html" id="b-nav-platform-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/technologies/ai-companion.html" id="b-nav-companion-2">AI Companion</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Vision One Companion</div> <p class="copy">Your generative AI cybersecurity assistant</p> <a class="leaf-button color-d71920" href="/en_us/business/technologies/ai-companion.html" id="b-nav-companion-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/attack-surface-management.html" id="b-nav-attack-surface-mgmnt-1">Attack Surface Management</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Attack Surface Management</div> <p class="copy">Stop breaches before they happen</p> <a class="leaf-button color-d71920" href="/en_us/business/products/attack-surface-management.html" id="b-nav-attack-surface-mgmnt-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-xdr-1">XDR (Extended Detection & Response)</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR (Extended Detection & Response)</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-xdr-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-1">Cloud Security</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-2">Cloud Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Cloud Security Overview</div> <p class="copy">The most trusted cloud security platform for developers, security teams, and businesses</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/attack-surface-management.html" id="b-nav-sub-asrm-cloud-2">Attack Surface Risk Management for Cloud</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Attack Surface Risk Management for Cloud</div> <p class="copy">Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one</p> <a class="leaf-button color-d71920" href="/en_us/business/products/attack-surface-management.html" id="b-nav-sub-asrm-cloud-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-cloud-2">XDR for Cloud</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Cloud</div> <p class="copy">Extend visibility to the cloud and streamline SOC investigations</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-cloud-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2">Workload Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Workload Security</div> <p class="copy">Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html" id="b-nav-sub-container-sec-2">Container Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Container Security</div> <p class="copy">Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html" id="b-nav-sub-container-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html" id="b-nav-sub-file-sec-2">File Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">File Security</div> <p class="copy">Protect application workflow and cloud storage against advanced threats</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html" id="b-nav-sub-file-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-1">Endpoint Security</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-2">Endpoint Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Endpoint Security Overview</div> <p class="copy">Defend the endpoint through every stage of an attack</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-endpoint-2">XDR for Endpoint</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Endpoint</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-endpoint-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2">Workload Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Workload Security</div> <p class="copy">Optimized prevention, detection, and response for endpoints, servers, and cloud workloads</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-endpoint-security.html" id="b-nav-sub-industrial-endpoint-sec-2">Industrial Endpoint Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Endpoint Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-endpoint-security.html" id="b-nav-sub-industrial-endpoint-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html" id="b-nav-sub-mobile-sec-2">Mobile Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Mobile Security</div> <p class="copy">On-premises and cloud protection against malware, malicious applications, and other mobile threats</p> <a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html" id="b-nav-sub-mobile-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/network.html" id="b-nav-network-security-1">Network Security</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network.html" id="b-nav-network-security-2">Network Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Security Overview</div> <p class="copy">Expand the power of XDR with network detection and response</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network.html" id="b-nav-network-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-network-2">XDR for Network</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Network</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-network-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/intrusion-prevention.html" id="b-nav-sub-intrusion-prevention-2">Network Intrusion Prevention (IPS)</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Intrusion Prevention (IPS)</div> <p class="copy">Protect against known, unknown, and undisclosed vulnerabilities in your network</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention.html" id="b-nav-sub-intrusion-prevention-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/advanced-threat-protection.html" id="b-nav-sub-breach-detection-2">Breach Detection System (BDS)</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Breach Detection System (BDS)</div> <p class="copy">Detect and respond to targeted attacks moving inbound, outbound, and laterally</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/advanced-threat-protection.html" id="b-nav-sub-breach-detection-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/zero-trust-secure-access.html" id="b-nav-sub-secure-service-edge-2">Secure Service Edge (SSE)</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Secure Service Edge (SSE)</div> <p class="copy">Redefine trust and secure digital transformation with continuous risk assessments</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/zero-trust-secure-access.html" id="b-nav-sub-secure-service-edge-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html" id="b-nav-sub-5g-network-sec-2">5G Network Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html" id="b-nav-sub-5g-network-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2">Industrial Network Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/email-security.html" id="b-nav-email-security-1">Email Security</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/email-security.html" id="b-nav-email-security-2">Email Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Email Security</div> <p class="copy">Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise</p> <a class="leaf-button color-d71920" href="/en_us/business/products/email-security.html" id="b-nav-email-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html" id="b-nav-sub-email-collaboration-2">Email and Collaboration Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Email and Collaboration Security</div> <p class="copy">Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace</p> <a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html" id="b-nav-sub-email-collaboration-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-1">OT Security</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-2">OT Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">OT Security</div> <p class="copy">Learn about solutions for ICS / OT security.</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-ot-2">XDR for OT</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for OT</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-ot-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2">Industrial Network Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2-cta">Industrial Network Security</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security" id="b-nav-sub-industrial-endpoint-sec-2">Industrial Endpoint Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Endpoint Security</div> <a class="leaf-button color-d71920" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security" id="b-nav-sub-industrial-endpoint-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/one-platform/threat-insights.html" id="b-nav-threat-insights-1">Threat Insights</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Threat Insights</div> <p class="copy">See threats coming from miles away</p> <a class="leaf-button color-d71920" href="/en_us/business/products/one-platform/threat-insights.html" id="b-nav-threat-insights-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/identity.html" id="b-nav-identity-security-1">Identity Security</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Identity Security</div> <p class="copy">End-to-end identity security from identity posture management to detection and response</p> <a class="leaf-button color-d71920" href="/en_us/business/products/identity.html" id="b-nav-identity-security-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/sovereign-private-cloud.html" id="b-nav-on-prem-1">On-Premises Data Sovereignty</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">On-Premises Data Sovereignty</div> <p class="copy">Prevent, detect, respond and protect without compromising data sovereignty</p> <a class="leaf-button color-d71920" href="/en_us/business/products/sovereign-private-cloud.html" id="b-nav-on-prem-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products.html" id="b-nav-all-products-1">All Products, Services, and Trials</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">All Products, Services, and Trials</div> <a class="leaf-button color-d71920" href="/en_us/business/products.html" id="b-nav-all-products-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <!-- Level 0, top menu --> <div class="label">Research</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/threat-research.html">Research</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/threat-research.html">Research</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research</div> <a class="leaf-button color-d71920" href="/en_us/about/threat-research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/research.html">Research, News, and Perspectives</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research, News, and Perspectives</div> <a class="leaf-button color-d71920" href="/en_us/research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Research and Analysis</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research and Analysis</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Security News</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security News</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/zero-day-initiative/about.html">Zero Day Initiatives (ZDI)</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Zero Day Initiatives (ZDI)</div> <a class="leaf-button color-d71920" href="/en_us/zero-day-initiative/about.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li> <!-- Level 0, top menu --> <div class="label">Services</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Our Services</div> <a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/service-one.html">Service Packages</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Service Packages</div> <p class="copy">Augment security teams with 24/7/365 managed detection, response, and support</p> <a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/managed-xdr.html">Managed XDR</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed XDR</div> <p class="copy">Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks</p> <a class="leaf-button color-d71920" href="/en_us/business/services/managed-xdr.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a> </div> <ul class="branch nav-item-3"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Incident Response</div> <p class="copy">Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans</p> <a class="leaf-button color-d71920" href="/en_us/business/services/incident-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/incident-response/insurance-law.html">Insurance Carriers and Law Firms</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Insurance Carriers and Law Firms</div> <p class="copy">Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs</p> <a class="leaf-button color-d71920" href="/en_us/business/services/incident-response/insurance-law.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/support-services.html">Support Services</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Support Services</div> <a class="leaf-button color-d71920" href="/en_us/business/services/support-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li> <!-- Level 0, top menu --> <div class="label">Partners</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/program.html">Partner Program</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program.html">Partner Program</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Program Overview</div> <p class="copy">Grow your business and protect your customers with the best-in-class complete, multilayered security</p> <a class="leaf-button color-d71920" href="/en_us/partners/program.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/competencies.html">Partner Competencies</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Competencies</div> <p class="copy">Stand out to customers with competency endorsements that showcase your expertise</p> <a class="leaf-button color-d71920" href="/en_us/partners/competencies.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/partner-stories.html">Partner Successes</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Successes</div> <a class="leaf-button color-d71920" href="/en_us/partners/partner-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program/managed-security-service-provider.html">Managed Security Service Provider</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Security Service Provider</div> <p class="copy">Deliver modern security operations services with our industry-leading XDR</p> <a class="leaf-button color-d71920" href="/en_us/partners/program/managed-security-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program/managed-service-provider.html">Managed Service Provider</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Service Provider</div> <p class="copy">Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs</p> <a class="leaf-button color-d71920" href="/en_us/partners/program/managed-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Alliance Partners</div> <p class="copy">We work with the best to help you optimize performance and value</p> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners/technology.html">Technology Alliance Partners</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Technology Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/technology.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Find Alliance Partners</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/resources.html">Partner Resources</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/resources.html">Partner Resources</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Resources</div> <p class="copy">Discover resources designed to accelerate your business’s growth and enhance your capabilities as a Trend Micro partner</p> <a class="leaf-button color-d71920" href="/en_us/partners/resources.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/" target="_blank" rel="noopener noreferrer">Partner Portal Login</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Portal Login</div> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/" target="_blank" rel="noopener noreferrer">Login</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/campus.html">Trend Campus</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Campus</div> <p class="copy">Accelerate your learning with Trend Campus, an easy-to-use education platform that offers personalized technical guidance</p> <a class="leaf-button color-d71920" href="/en_us/partners/campus.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/co-selling.html">Co-Selling</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Co-Selling</div> <p class="copy">Access collaborative services designed to help you showcase the value of Trend Vision One™ and grow your business</p> <a class="leaf-button color-d71920" href="/en_us/partners/co-selling.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/pr-register-home/" target="_blank" rel="noopener noreferrer">Become a Partner</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Become a Partner</div> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/pr-register-home/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/distributors.html">Distributors</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Distributors</div> <a class="leaf-button color-d71920" href="/en_us/partners/distributors.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Find Partners</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Partners</div> <p class="copy">Locate a partner from whom you can purchase Trend Micro solutions</p> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <!-- Level 0, top menu --> <div class="label">Company</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Why Trend Micro</div> <a class="leaf-button color-d71920" href="/en_us/about/why-trend-micro.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/customer-stories.html">Customer Success Stories</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Customer Success Stories</div> <a class="leaf-button color-d71920" href="/en_us/about/customer-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/content/trendmicro/en_us/about/human-connections">The Human Connection</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">The Human Connection</div> <a class="leaf-button color-d71920" href="/content/trendmicro/en_us/about/human-connections">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/industry-recognition.html">Industry Accolades</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industry Accolades</div> <a class="leaf-button color-d71920" href="/en_us/about/industry-recognition.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Strategic Alliances</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Strategic Alliances</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/compare.html">Compare Trend Micro</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare.html">Compare Trend Micro</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Compare Trend Micro</div> <p class="copy">See how Trend outperforms the competition</p> <a class="leaf-button color-d71920" href="/en_us/about/compare.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-crowdstrike.html">vs. Crowdstrike</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Crowdstrike</div> <p class="copy">Crowdstrike provides effective cybersecurity through its cloud-native platform, but its pricing may stretch budgets, especially for organizations seeking cost-effective scalability through a true single platform</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-crowdstrike.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-microsoft.html">vs. Microsoft</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Microsoft</div> <p class="copy">Microsoft offers a foundational layer of protection, yet it often requires supplemental solutions to fully address customers' security problems</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-microsoft.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-palo-alto-networks.html">vs. Palo Alto Networks</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Palo Alto Networks</div> <p class="copy">Palo Alto Networks delivers advanced cybersecurity solutions, but navigating its comprehensive suite can be complex and unlocking all capabilities requires significant investment</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-palo-alto-networks.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about.html">About Us</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about.html">About Us</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">About Us</div> <a class="leaf-button color-d71920" href="/en_us/about.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/trust-center.html">Trust Center</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trust Center</div> <a class="leaf-button color-d71920" href="/en_us/about/trust-center.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/history-vision-values.html">History</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">History</div> <a class="leaf-button color-d71920" href="/en_us/about/history-vision-values.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/diversity-inclusion.html">Diversity, Equity and Inclusion</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Diversity, Equity and Inclusion</div> <a class="leaf-button color-d71920" href="/en_us/about/diversity-inclusion.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/corporate-social-responsibility.html">Corporate Social Responsibility</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Corporate Social Responsibility</div> <a class="leaf-button color-d71920" href="/en_us/about/corporate-social-responsibility.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/leaders.html">Leadership</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Leadership</div> <a class="leaf-button color-d71920" href="/en_us/about/leaders.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/leading-experts.html">Security Experts</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security Experts</div> <a class="leaf-button color-d71920" href="/en_us/about/leading-experts.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/initiative-education.html">Internet Safety and Cybersecurity Education</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Internet Safety and Cybersecurity Education</div> <a class="leaf-button color-d71920" href="/en_us/initiative-education.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/legal.html">Legal</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Legal</div> <a class="leaf-button color-d71920" href="/en_us/about/legal.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Investors</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Investors</div> <a class="leaf-button color-d71920" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/campaigns/formula-e.html">Formula E Racing</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Formula E Racing</div> <a class="leaf-button color-d71920" href="/en_us/business/campaigns/formula-e.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="branch nav-item-2"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li> <div class="label leaf"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Connect With Us</div> <a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://newsroom.trendmicro.com/">Newsroom</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Newsroom</div> <a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/events.html">Events</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Events</div> <a class="leaf-button color-d71920" href="/en_us/about/events.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/careers.html">Careers</a> </div> <ul class="leaf nav-item-leaf"> <!-- This fake child menu should be a desktop enhancement only. Mobile never uses it --> <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Careers</div> <a class="leaf-button color-d71920" href="/en_us/about/careers.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> </ul> </div> <div class="list-wrapper drop-down-menu-2"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-3"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-4"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-5"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="buttonArrayV1"> <ul class="button-array small left-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button secondary color-ffffff normal" id="rsg-nav-free-trial-a34d5e" href="/en_us/business/products/trials.html"> Free Trials </a> </li> <li class="button-array-list"> <a class="button primary color-d71920 normal" id="rsh-nav-contact-us-b93ab0" href="/en_us/business/get-info-form.html"> Contact Us </a> </li> </ul> </div> </div> </div> <div class="consumerLink"> <a href="/en_us/forHome.html">Looking for home solutions?</a> </div> <a href="https://resources.trendmicro.com/GLB-Under-Attack-Form.html" class="under-attack-link">Under Attack?</a> <div class="alerts"> <div class="alertUtilityMenu"> <div class="utility-wrapper alert-top-menu"> <div class="dropDownMenuV1"> <div class="label"><span class="counter">4</span> Alerts</div> <div class="menu"><!--Intentionally left blank--></div> </div> </div> <div class="utility-wrapper alert-sub-menu"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-wrapper-content"> <div class="alerts-wrapper"> <div class="alert-buttons"> <div class="alerts-unread-button is-active">Unread</div> <div class="alerts-all-button">All</div> </div> <div class="sub-alerts-wrapper"></div> </div> <ul class="alerts-list"> <li id="alert-30a753" class="unread"> <div class="copy-wrapper"> <!-- TEXT - now clickable --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/understanding-hacktivists-the-overlap-of-ideology-and-cybercrime"> <p class="copy">The rise of hacktivism and cybercrime: how ideological motives drive cyberattacks</p> </a> <span class="material-symbols-outlined">close</span> </div> <!-- CTA TEXT --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/understanding-hacktivists-the-overlap-of-ideology-and-cybercrime"> <p class="ctaText">Read more ></p> </a> </li> <li id="alert-b69ba5" class="unread"> <div class="copy-wrapper"> <!-- TEXT - now clickable --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/metaverse-or-metaworse-how-the-apple-vision-pro-stacks-up-against-predictions"> <p class="copy">The future of the Metaverse: analyzing security risks in virtual spaces</p> </a> <span class="material-symbols-outlined">close</span> </div> <!-- CTA TEXT --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/metaverse-or-metaworse-how-the-apple-vision-pro-stacks-up-against-predictions"> <p class="ctaText">Learn more ></p> </a> </li> <li id="alert-d20ee9" class="unread"> <div class="copy-wrapper"> <!-- TEXT - now clickable --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/across-the-span-of-the-spanish-cybercriminal-underground-current-activities-and-trends"> <p class="copy">Exploring the latest trends in the Spanish cybercriminal underground</p> </a> <span class="material-symbols-outlined">close</span> </div> <!-- CTA TEXT --> <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/across-the-span-of-the-spanish-cybercriminal-underground-current-activities-and-trends"> <p class="ctaText">Learn more > </p> </a> </li> <li id="alert-2a8d64" class="unread"> <div class="copy-wrapper"> <!-- TEXT - now clickable --> <a href="/en_us/research/25/a/cve-2025-0411-ukrainian-organizations-targeted.html"> <p class="copy">CVE-2025-0411 exploited in attacks on Ukraine</p> </a> <span class="material-symbols-outlined">close</span> </div> <!-- CTA TEXT --> <a href="/en_us/research/25/a/cve-2025-0411-ukrainian-organizations-targeted.html"> <p class="ctaText">Read the report > </p> </a> </li> </ul> </div> </div> </div> </div> <div class="utilityMenuV1"><div class="utilityMenu utilityMenuV1"> <div class="utility-wrapper standard-utility-wrapper"> <div class="dropDownMenuV1"> <div class="label">Support</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Business Support Portal </a> </li> <li> <a href="/en_us/business/services/support-services/education.html"> Education and Certification </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/contactus/" target="_blank"> Contact Support </a> </li> <li> <a rel="noopener noreferrer" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank"> Find a Support Partner </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Resources</div> <div class="menu"> <ul> <li> <a href="/en_us/business/ai.html"> AI Security </a> </li> <li> <a href="/en_us/about/compare.html"> Trend Micro vs. Competition </a> </li> <li> <a href="https://resources.trendmicro.com/security-assessment-service-us.html?_ga=2.66788462.1559035223.1729522833-1050444116.1727452407"> Cyber Risk Assessments </a> </li> <li> <a href="/en_us/what-is.html"> What Is? </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/"> Threat Encyclopedia </a> </li> <li> <a href="/en_us/business/cyber-insurance.html"> Cyber Insurance </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/us/security/definition/a"> Glossary of Terms </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Log In</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://signin.v1.trendmicro.com/" target="_blank"> Vision One </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Support </a> </li> <li> <a rel="noopener noreferrer" href="https://partner.trendmicro.com/" target="_blank"> Partner Portal </a> </li> <li> <a rel="noopener noreferrer" href="https://cloudone.trendmicro.com/" target="_blank"> Cloud One </a> </li> <li> <a rel="noopener noreferrer" href="https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php" target="_blank"> Product Activation and Management </a> </li> <li> <a rel="noopener noreferrer" href="https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t" target="_blank"> Referral Affiliate </a> </li> </ul> </div> </div> </div> <div class="utility-wrapper active-utility-wrapper"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-utility-wrapper"></div> </div> </div> </div> </div> </nav> </header> <div class="search"> <script type="text/javascript" src="//customer.cludo.com/scripts/bundles/search-script.js"></script> <script type="text/javascript"> var cludoSettings = {}; if( undefined === window.utag_data ) { cludoSettings.cludo_language = 'en'; } else { switch (window.utag_data.language_code) { // Cludo dropped the ball on this one case 'ja_jp': cludoSettings.cludo_language = 'jp'; break; case 'in_id': cludoSettings.cludo_language = 'id'; break; default: cludoSettings.cludo_language = window.utag_data.language_code.substring(0, 2); // First two letters are the language break; } } cludoSettings.settingsObject = { customerId: 296, engineId: 1798, searchUrl: "/en_us/common/cse.html", searchInputs: ["cludo-search-form","cludo-search-form-mobile","cludo-search-content-form"], initSearchBoxText: "", language: cludoSettings.cludo_language, //endlessScroll: {stopAfterPage:3, resultsPerPage:10, bottomOffset: 145}, //translateSearchTemplates: true, loading: "<div class='loader'></div>" }; </script> <span class="material-symbols-outlined search-back-arrow">arrow_back</span> <div class="inner-search-wrap"> <span class="material-symbols-outlined search-icon">search</span> <form class="main-menu-search" aria-label="Search Trend Micro"> <div class="main-menu-search__field-wrapper" id="cludo-search-form"> <table class="gsc-search-box"> <tbody> <tr> <td class="gsc-input"> <input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search"/> </td> </tr> </tbody> </table> </div> </form> <span class="material-symbols-outlined search-clear-button">close</span> </div> </div> </div> <section class="folder-indicators slider"> <div class="folder-indicators__wrapper"> <p class="folder-indicators__title">Content has been added to your Folio</p> <div class="folder-indicators__button-wrapper"> <button class="folder-indicators__button counter" id="counter-folder"> Go to Folio (<span>0</span>) </button> <button class="folder-indicators__button close"><span class="material-symbols-outlined close-folio-message">close</span></button> </div> </div> </section></div> <div class="root responsivegrid"> <div class="aem-Grid aem-Grid--12 aem-Grid--default--12 "> <div class="articleBodyNoHero aem-GridColumn aem-GridColumn--default--12"><div class="research-layout article container" role="contentinfo"> <article class="research-layout--wrapper row" data-article-pageID="508752805"> <div class="col-xs-12 col-md-12 one-column"> <div class="col-xs-12 col-md-12"> <div class="article-details" role="heading"> <span class="article-details__bar" role="img"></span> <p class="article-details__display-tag">Ransomware</p> <h1 class="article-details__title">Reflective Loading Runs Netwalker Fileless Ransomware</h1> <p class="article-details__description">Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection. We discuss how Netwalker ransomware is deployed filelessly through reflective DLL injection.</p> <p class="article-details__author-by">By: Karen Victor <time class="article-details__date">May 18, 2020</time> <span>Read time: </span><span class="eta"></span> (<span class="words"></span> words) </p> <div class="article-details__icons"> <!--Add This--> <div class="a2a_kit a2a_default_style" data-a2a-icon-color="#717172"> <a class="a2a_dd addthis_link" href="https://www.addtoany.com/share"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg" class="svg-icon" alt="Share"/> </a> <a class="a2a_button_print addthis_link"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg" class="svg-icon" alt="Print"/> </a> </div> <!--Add to Folio--> <div class="add-to-folio tooltip"> <span class="icon-folio-thin"></span> <div class="right"> <p>Save to Folio</p> <i></i> </div> </div> <!--Subscribe--> <div class="subscribe"> </div> </div> </div> </div> </div> <hr class="research-layout-divider"/> <main class="main--content col-xs-12 col-lg-8 col-lg-push-2"> <div> </div> <div class="richText"> <div> <p>Threat actors are continuously creating more sophisticated ways for malware to evade defenses. We have observed Netwalker <a href="https://www.trendmicro.com/vinfo/tmr/?/us/security/definition/ransomware">ransomware</a> attacks that involve malware that is not compiled, but written in PowerShell and executed directly in memory and without storing the actual ransomware binary into the disk. This makes this ransomware variant a <a href="https://www.trendmicro.com/vinfo/tmr/?/us/security/news/cybercrime-and-digital-threats/security-101-how-fileless-attacks-work-and-persist-in-systems">fileless threat</a>, enabling it to maintain persistence and evade detection by abusing tools that are already in the system to initiate attacks.</p> <p>This type of threat leverages a technique called reflective dynamic-link library (DLL) injection, also referred to as reflective DLL loading. The technique allows the injection of a DLL from memory rather than from disk. This technique is stealthier than regular DLL injection because aside from not needing the actual DLL file on disk, it also does not need any windows loader for it to be injected. This eliminates the need for registering the DLL as a loaded module of a process, and allowing evasion from DLL load monitoring tools. Recently, we have witnessed threat actors using this technique to deploy <a href="/en_us/research/20/e/targeted-ransomware-attack-hits-taiwanese-organizations.html">ColdLock</a> ransomware. Now, we have seen the same attack using a filelessly executed Netwalker ransomware. The payload begins with a PowerShell script detected as <a href="https://www.trendmicro.com/vinfo/tmr/?/us/threat-encyclopedia/malware/Ransom.PS1.NETWALKER.B">Ransom.PS1.NETWALKER.B</a>.</p> <h3><span class="body-subhead-title">Analysis of the PowerShell Script</span></h3> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-1-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-1-Netwalker.jpg"/></a></p> <p style="text-align: center;">Figure 1. Overview of the PowerShell script’s behavior</p> <p>The script hides under multiple layers of encryption, obfuscation, and encoding techniques. For this sample, we were able to reveal three layers of code. The top-most layer executes a base64-encoded command.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-2-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-2-Netwalker.jpg"/></a>Figure 2. Code snippet of top-most layer of code (base64 encoded command)</p> <p style="margin: 0.0in;">Decoding this will expose the next layer of code, which is hexadecimal-encoded and XOR-encrypted.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-3-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-3-Netwalker.jpg"/></a>Figure 3. Second layer of code (hexadecimal-encoded and XOR-encrypted)</p> <p style="margin: 0.0in;">Decoding and decrypting will then reveal the main script, which is still quite obfuscated, making the content more difficult for analysts to decipher.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-4-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-4-Netwalker.jpg"/></a>Figure 4. Code snippet of the obfuscated main script</p> <p style="margin: 0.0in;">The file reflectively injects a ransomware DLL into the memory of the legitimate running process explorer.exe. The ransomware is embedded in the script in hex format.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-5-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-5-Netwalker.jpg"/></a>Figure 5. Ransomware binaries embedded in the script in hex format</p> <p style="margin: 0.0in;">Taking the binaries out of the script and decoding them will result in two DLLs; one is an x86 version (for 32 bit OS) of the ransomware, while the other is the x64 version (for 64 bit OS).</p> <p style="margin: 0.0in;">It uses the following part of the script to determine the environment it is running on so that it can set the DLL version to use:</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-6-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-6-Netwalker.jpg"/></a>Figure 6. Script that determines what environment the ransomware is running on</p> <p style="margin: 0.0in;">To successfully perform reflective injection, it first locates the API addresses of the functions it needs from kernell32.dll:</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-7-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-7-Netwalker.jpg"/></a>Figure 7. Ransomware collecting API Addresses from kernell32.dll</p> <p style="margin: 0.0in;">Then it uses the following functions to set up accurate memory address calculations:</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-8-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-8-Netwalker.jpg"/></a></p> <p style="text-align: center;">Figure 8. Functions for setting up memory calculations</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-9-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-9-Netwalker.jpg"/></a>Figure 9. Code snippet for computing the needed memory addresses</p> <p style="margin: 0.0in;">In this manner, the script itself acts as the DLL’s own custom loader. This eliminates the need for a traditional windows loader, which usually makes use of the LoadLibrary function. The script itself can compute and resolve its needed memory address and relocations to load the DLL correctly.</p> <p style="margin: 0.0in;"> </p> <p style="margin: 0.0in;">It then specifies the process it will inject into; in this case it searches for the running Windows Explorer process.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-10-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-10-Netwalker.jpg"/></a>Figure 10. Code snippet for searching running Windows Explorer process</p> <p style="margin: 0.0in;">Afterwards, it will write and execute the ransomware DLL into the memory space of explorer.exe through the following code:</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-11-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-11-Netwalker.jpg"/></a>Figure 11. Code snippet of writing the ransomware DLL code into memory</p> <p>Finally, it deletes Shadow Volume Copies and prevent the victim from using Shadow Volumes to recover their encrypted files.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-12-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-12-Netwalker.jpg"/></a>Figure 12. Code snippet for deleting Shadow Volume Copies</p> <p>This sample appears to have been derived from <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1" target="_blank">PowerSploit’s Invoke-Mimikatz</a> module, an open source program that was originally intended to reflectively load Mimikatz completely in memory for stealthy credential dumping.</p> <h3><span class="body-subhead-title">Analysis of the Fileless Ransomware</span></h3> <p>This variant of Netwalker is similar to its predecessors in terms of behavior. It renames encrypted files using 6 random characters as extension:</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-13-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-13-Netwalker.jpg"/></a></p> <p style="text-align: center;">Figure 13. Encrypted files renamed using 6 random characters as extension</p> <p style="margin: 0.0in;">It drops ransom notes at various folders in the system and opens one after it has encrypted the data and documents of the victim. As with usual ransomware, it does this to extort money from the victim in exchange for the decryption of their files.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-14-Netwalker.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-14-Netwalker.jpg"/></a>Figure 14. Netwalker ransom note</p> <p style="margin: 0.0in;">It adds the following registry entry. Adding this entry is a known behavior of Netwalker:</p> <p style=""><span class="blockquote">HKEY_CURRENT_USER\SOFTWARE\{8 random characters}</span></p> <p style=""><span class="blockquote">{8 random characters} = {Hex values}</span></p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-15.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig-15.jpg"/></a>Figure 15. Sample registry entry added by Netwalker</p> <p>The ransomware terminates some processes and services, some examples of which are related to backup software and data related applications. It is likely that it does this as an attempt to debilitate any efforts the victim may take in performing backup and recovery operations after the ransomware attack.</p> <p>Below are some examples of services terminated by the ransomware (for the full list of services, please see <a href="https://www.trendmicro.com/vinfo/tmr/?/us/threat-encyclopedia/malware/Ransom.PS1.NETWALKER.B">this report</a>):</p> <ul> <li><span class="rte-red-bullet">*backup*</span></li> <li><span class="rte-red-bullet">*sql*</span></li> <li><span class="rte-red-bullet">AcronisAgent</span></li> <li><span class="rte-red-bullet">ARSM</span></li> <li><span class="rte-red-bullet">server Administrator</span></li> <li><span class="rte-red-bullet">ShadowProtectSvc</span></li> <li><span class="rte-red-bullet">wbengine</span></li> </ul> <p>The ransomware also stops security software-related processes to evade detection and termination of its malicious activities.</p> <p>Additionally, it also terminates processes relating to user data and documents, as well as software for creating backups. Then it will proceed to encrypt files created through those applications.</p> <p>Example processes terminated by the ransomware (for the full list of processes, please see <a href="https://www.trendmicro.com/vinfo/tmr/?/us/threat-encyclopedia/malware/Ransom.PS1.NETWALKER.B">this report</a>):</p> <ul> <li><span class="rte-red-bullet">*sql*</span></li> <li><span class="rte-red-bullet">excel.exe</span></li> <li><span class="rte-red-bullet">ntrtscan.exe</span></li> <li><span class="rte-red-bullet">powerpnt.exe</span></li> <li><span class="rte-red-bullet">wbengine*</span></li> <li><span class="rte-red-bullet">winword.exe</span></li> <li><span class="rte-red-bullet">wrsa.exe</span></li> </ul> <p>Netwalker mainly targets common user files during its encryption routine, such as Office documents, PDFs, images, videos, audio, and text files, among others. Other than that, it apparently doesn’t want to render the system completely useless since it generally avoids encrypting any critical files, executables, Dynamic Link Libraries, registries, or other system-related files.</p> <h3><span class="body-subhead-title">Conclusions and Recommendations</span></h3> <p>It appears that attackers are now adding Reflective DLL injection into their ransomware arsenal in an attempt to make their attacks untraceable and more difficult to investigate by security analysts. Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection and maintain persistence. Blended threats such as this make use of multiple techniques, making it necessary for organizations to use various layers of security technologies to effectively protect their endpoints, such as security solutions that employ behavior monitoring and behavior-based detections.</p> <p>These types of attacks can affect victims tremendously, and they can be painstakingly difficult to recover from. Employing adequate preventive measures, such as applying best practices, will greatly minimize the risk of infection. Here are some of our recommendations to help avoid ransomware attacks:</p> <ul> <li><span class="rte-red-bullet">Regularly back up critical data to mitigate the effects of a ransomware attack</span></li> <li><span class="rte-red-bullet">Apply the latest software patches from OS and third-party vendors.</span></li> <li><span class="rte-red-bullet">Exercise good <a href="https://www.trendmicro.com/vinfo/tmr/?/us/security/news/cybercrime-and-digital-threats/infosec-guide-email-threats">email</a> and website safety practices</span></li> <li><span class="rte-red-bullet">For employees, alert the IT security team of potentially suspicious emails and files.</span></li> <li><span class="rte-red-bullet">Implement application whitelisting on your endpoints to block all unknown and unwanted applications.</span></li> <li><span class="rte-red-bullet">Regularly educate employees on the dangers of social engineering.</span></li> </ul> <p>Below are some of our recommendations to <a href="https://www.trendmicro.com/vinfo/tmr/?/us/security/news/security-technology/risks-under-the-radar-understanding-fileless-threats">protect systems from fileless threats</a>:</p> <ul> <li><span class="rte-red-bullet">Secure PowerShell use by taking advantage of its logging capability to monitor suspicious behavior.</span></li> <li><span class="rte-red-bullet">Use PowerShell commands such as ConstrainedLanguageMode to secure systems from malicious code.</span></li> <li><span class="rte-red-bullet">Configure system components and disable unused and outdated ones to block possible entry points.</span></li> <li><span class="rte-red-bullet">Never download and execute files from unfamiliar sources</span></li> </ul> <p>We also recommend security solutions that utilize behavior monitoring that can work against these types of threats:</p> <ul> <li><span class="rte-red-bullet"><a href="/en_us/business/products/user-protection/sps/endpoint.html">Trend Micro Apex One™</a> - Features behavioral analysis that protects against malicious scripts, injection, ransomware, and memory and browser attacks related to fileless threats.</span></li> </ul> <h3><span class="body-subhead-title">Indicator of Compromise</span></h3> <div class="responsive-table-wrap"><table border="1" width="100%"> <tbody><tr><td width="438"><b>SHA-256</b></td> <td width="186"><b>Trend Micro Pattern Detection</b></td> </tr><tr><td width="438">f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be</td> <td width="186"><a href="https://www.trendmicro.com/vinfo/tmr/?/us/threat-encyclopedia/malware/Ransom.PS1.NETWALKER.B">Ransom.PS1.NETWALKER.B</a></td> </tr></tbody></table> </div> <p> </p> </div> </div> <div class="image"> </div> <div> </div> <section class="tag--list"> <div class="tag--list-title">Tags</div> <div class="tag--list-tags"> <a href="/en_us/research.html?category=trend-micro-research:threats/malware" class="tag--list-anchor">Malware</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_us/research.html?category=trend-micro-research:environments/endpoints" class="tag--list-anchor">Endpoints</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_us/research.html?category=trend-micro-research:article-type/research" class="tag--list-anchor">Research</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_us/research.html?category=trend-micro-research:threats/ransomware" class="tag--list-anchor">Ransomware</a> </div> </section> </main> <sidebar class="sidebar--left col-xs-12 col-lg-2 col-lg-pull-8"> <h3 class="article-authors__title"> Authors </h3> <!-- /* Show Trend Micro if we don't have any authors for this article */ --> <ul class="article-authors__list"> <li class="article-authors__list-items"> <div class="article-authors__wrapper" role="contentinfo authors profile"> <p class="article-authors__list-items__name">Karen Victor</p> <p class="article-authors__list-items__position">Threats Analyst</p> </div> </li> </ul> <div class="article-authors__btn-wrapper" role="button"> <a class="article-authors__button " href="mailto:tm_research@trendmicro.com" target="target" id="article-authors-contact-us-button"> Contact Us </a> </div> </sidebar> <sidebar class="sidebar--right col-xs-12 col-lg-2"> <div class="sidebar--wrapper" role="contentinfo sidebar"> <div class="row-1" role="contentinfo related articles"> <div class="related--articles" role="contentinfo related articles"> <h3 class="related--articles-title">Related Articles</h3> <ul class="related--articles-items"> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/22/d/attack-surface-management.html"> Embracing a risk-based cybersecurity approach with ASRM </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/23/h/top-ai-risks.html"> Top 10 AI Security Risks According to OWASP </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/23/h/industry-zero-trust-frameworks.html"> The Journey to Zero Trust with Industry Frameworks </a> </li> </ul> </div> <div class="archived--link"> <div class="archived--link-text"> <a href="/en_us/research.html"> See all articles </a> </div> <div class="archived--link-icon"> <a href="/en_us/research.html"> <span class="icon-chevron-right"></span> </a> </div> </div> </div> </div> </sidebar> </article> </div></div> </div> </div> <div class="footer"> <div class="containerV1"><div class="footer_wrapper footer-wrapper"><div class="containerV1"> <div class="container-content"> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 { display: grid; gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 { gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnMobile { display: block; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 { gap: 0px 10px; grid-template-columns: 6fr 6fr 6fr 6fr; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnMobile { display: block; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 3fr; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnMobile { display: block; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 4fr; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnMobile { display: block; } #grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-95db7c35-6140-4636-b9e5-0bd6fa15ce92"> <div class="grid-resources-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Resources</h3> <ul> <li><a href="/en_us/research.html" target="_self" rel="noopener noreferrer">Blog</a></li> <li><a href="https://newsroom.trendmicro.com/" target="_self" rel="noopener noreferrer">Newsroom</a></li> <li><a href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports" target="_self" rel="noopener noreferrer">Threat Reports</a></li> <li><a href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Find a Partner</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-support-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Support</h3> <ul> <li><a href="https://success.trendmicro.com/en-US/" target="_blank" rel="noopener noreferrer">Business Support Portal</a></li> <li><a href="/en_us/business/get-info-form.html" target="_self" rel="noopener noreferrer">Contact Us</a></li> <li><a href="/en_us/business/products/downloads.html" target="_self" rel="noopener noreferrer">Downloads</a></li> <li><a href="/en_us/business/products/trials.html" target="_self" rel="noopener noreferrer">Free Trials</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-about-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>About Trend</h3> <ul> <li><a href="/en_us/about.html" target="_self" rel="noopener noreferrer">About Us</a></li> <li><a href="/en_us/about/careers.html" target="_self" rel="noopener noreferrer">Careers</a></li> <li><a href="/en_us/contact.html" target="_self" rel="noopener noreferrer">Locations</a></li> <li><a href="/en_us/about/events.html" target="_self" rel="noopener noreferrer">Upcoming Events</a></li> <li><a href="/en_us/about/trust-center.html" target="_self" rel="noopener noreferrer">Trust Center</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-address-tab1 "><div class="reference parbase section"><div class="cq-dd-paragraph"><div class="footer"> <script type="application/ld+json"> {"@context":"https://schema.org","@type":"Organization","name":"Trend Micro - United States (US)","telephone":"+1 (817) 569-8900","address":{"addressLocality":"Irving","addressRegion":"Texas","postalCode":"75062","streetAddress":"225 East John Carpenter Freeway Suite 1500"}} </script> <div class="organization footerMenu footer-address-menu"> <h3 class="title">Country Headquarters</h3> <ul class="footer-address-wrapper"> <li class="name">Trend Micro - United States (US)</li> <li class="address"> 225 East John Carpenter Freeway<br/> Suite 1500<br/> Irving, Texas 75062 </li> <li class="phone">Phone:: +1 (817) 569-8900</li> </ul> </div> </div> </div> </div> </div> </div> </div> <div class="horizontalSeparatorV1 section"> <style> .horizontalSeparator-79dab49e-2a37-4901-bb94-d2976ad5d464.border { border-bottom: 1px solid #bcbdc0; } </style> <div id="horizontalV1-79dab49e-2a37-4901-bb94-d2976ad5d464" class="global-margin-top- global-margin-bottom-medium global-padding-top-small global-padding-bottom- border horizontalSeparator-79dab49e-2a37-4901-bb94-d2976ad5d464"> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnMobile { display: block; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f { gap: 0px 0px; grid-template-columns: 3fr 3fr 6fr; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnMobile { display: block; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f { gap: 0px 0px; grid-template-columns: 1fr 2fr 2fr; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnMobile { display: block; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f { gap: 0px 0px; grid-template-columns: 1fr 2fr 2fr; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnMobile { display: block; } #grid-areas-16315609-3eda-422e-933d-81a3745f3b1f .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-16315609-3eda-422e-933d-81a3745f3b1f"> <div class="grid-footer-locale1 "><div class="footer section"> <ul class="social-media-links"> <li> <a href="https://www.linkedin.com/company/trend-micro/" class="social-icon linkedin" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="LinkedIn" d="M8.8,10.3a1.5,1.5,0,0,1,1.5-1.5H25.295A1.5,1.5,0,0,1,26.8,10.3V25.294A1.5,1.5,0,0,1,25.3,26.8H10.3a1.5,1.5,0,0,1-1.5-1.5Zm7.125,5.359h2.437v1.224a2.793,2.793,0,0,1,2.6-1.337c2.593,0,3.207,1.4,3.207,3.973v4.763H21.55V20.109c0-1.465-.352-2.291-1.245-2.291-1.24,0-1.755.891-1.755,2.291v4.178H15.925Zm-4.5,8.512H14.05V15.55H11.425v8.624Zm3-11.437a1.688,1.688,0,1,1-.507-1.17A1.689,1.689,0,0,1,14.425,12.737Z" transform="translate(-8.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.facebook.com/TrendMicro/" class="social-icon facebook" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Facebook" d="M56.087,8.8A3.28,3.28,0,0,0,52.8,12.087V23.513A3.28,3.28,0,0,0,56.087,26.8H62.28V19.763H60.419V17.229H62.28V15.065c0-1.7,1.1-3.262,3.632-3.262a15.371,15.371,0,0,1,1.784.1l-.06,2.366s-.773-.007-1.617-.007c-.913,0-1.06.421-1.06,1.119v1.85h2.75l-.12,2.533h-2.63V26.8h2.554A3.28,3.28,0,0,0,70.8,23.513V12.087A3.28,3.28,0,0,0,67.513,8.8H56.087Z" transform="translate(-52.8 -8.8)" fill="#020607"/> </svg> </a> </li> <li> <a href="https://x.com/trendmicro" class="social-icon twitter" target="_blank" rel="noopener noreferrer"> <!--NEW X LOGO--> <svg xmlns="http://www.w3.org/2000/svg" width="19.57" height="20" viewBox="0 0 19.57 20"> <path id="x-logo" d="M11.647,8.469,18.932,0H17.206L10.88,7.353,5.827,0H0L7.64,11.119,0,20H1.726l6.68-7.765L13.743,20H19.57L11.646,8.469ZM9.282,11.217,8.508,10.11,2.349,1.3H5L9.971,8.41l.774,1.107,6.461,9.242H14.555L9.282,11.218Z"/> </svg> <!--OLD BIRD LOGO--> <!-- <svg xmlns="http://www.w3.org/2000/svg" width="20" height="16" viewBox="0 0 20 16">--> <!-- <path id="Twitter" d="M116,11.5a8.307,8.307,0,0,1-2.356.635,4.055,4.055,0,0,0,1.8-2.235,8.271,8.271,0,0,1-2.6.979,4.154,4.154,0,0,0-4.934-.8,4.064,4.064,0,0,0-1.8,1.9,3.981,3.981,0,0,0-.256,2.586,11.806,11.806,0,0,1-4.685-1.225,11.625,11.625,0,0,1-3.772-2.995,3.991,3.991,0,0,0-.071,3.936,4.063,4.063,0,0,0,1.341,1.456,4.142,4.142,0,0,1-1.858-.505v.052a4,4,0,0,0,.928,2.558,4.117,4.117,0,0,0,2.364,1.4,4.2,4.2,0,0,1-1.853.069,4.042,4.042,0,0,0,1.46,2.007,4.15,4.15,0,0,0,2.374.8,8.321,8.321,0,0,1-5.1,1.729A8.491,8.491,0,0,1,96,23.785a11.741,11.741,0,0,0,6.289,1.814,11.5,11.5,0,0,0,11.676-11.489c0-.173-.005-.349-.012-.522A8.284,8.284,0,0,0,116,11.5Z" transform="translate(-96 -9.6)" fill="#020607"></path>--> <!-- </svg>--> </a> </li> <li> <a href="https://www.instagram.com/trendmicro/" class="social-icon instagram" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Instagram" d="M146.09,8.854c.959-.044,1.265-.054,3.71-.054s2.751.011,3.71.054a6.631,6.631,0,0,1,2.186.418,4.607,4.607,0,0,1,2.631,2.632,6.641,6.641,0,0,1,.419,2.184c.044.961.054,1.267.054,3.711s-.011,2.751-.054,3.711a6.61,6.61,0,0,1-.419,2.184,4.6,4.6,0,0,1-2.631,2.632,6.626,6.626,0,0,1-2.185.419c-.96.044-1.266.054-3.711.054s-2.751-.011-3.71-.054a6.6,6.6,0,0,1-2.185-.419,4.595,4.595,0,0,1-2.633-2.631,6.643,6.643,0,0,1-.419-2.185c-.044-.961-.054-1.267-.054-3.711s.01-2.751.054-3.71a6.611,6.611,0,0,1,.419-2.186A4.611,4.611,0,0,1,143.9,9.272a6.65,6.65,0,0,1,2.185-.418Zm7.346,1.62c-.949-.043-1.234-.052-3.636-.052s-2.687.009-3.636.052a4.976,4.976,0,0,0-1.673.31,2.972,2.972,0,0,0-1.708,1.708,4.968,4.968,0,0,0-.31,1.671c-.044.949-.053,1.234-.053,3.637s.009,2.688.053,3.637a4.968,4.968,0,0,0,.31,1.671,2.972,2.972,0,0,0,1.708,1.708,4.976,4.976,0,0,0,1.673.31c.949.043,1.232.052,3.636.052s2.688-.009,3.636-.052a4.976,4.976,0,0,0,1.673-.31,2.972,2.972,0,0,0,1.708-1.708,4.968,4.968,0,0,0,.31-1.671c.043-.949.053-1.234.053-3.637s-.01-2.688-.053-3.637a4.968,4.968,0,0,0-.31-1.671,2.972,2.972,0,0,0-1.708-1.708A4.976,4.976,0,0,0,153.436,10.474Zm-4.786,10.1a3,3,0,1,0-1.075-.758A3,3,0,0,0,148.65,20.574Zm-2.121-6.046a4.626,4.626,0,1,1-1.355,3.271A4.634,4.634,0,0,1,146.529,14.529Zm8.924-.666a1.091,1.091,0,0,0,.25-.355,1.1,1.1,0,0,0,.093-.425,1.093,1.093,0,1,0-.343.78Z" transform="translate(-140.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.youtube.com/user/TrendMicroInc" class="social-icon youtube" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="24.003" height="16.01" viewBox="0 0 24.003 16.01"> <path id="YouTube" d="M205.9,12.112a2.78,2.78,0,0,0-.765-1.27A3.052,3.052,0,0,0,203.8,10.1c-1.877-.495-9.4-.495-9.4-.495a76.616,76.616,0,0,0-9.39.47,3.156,3.156,0,0,0-1.339.76,2.9,2.9,0,0,0-.777,1.276A29.133,29.133,0,0,0,182.4,17.6a29.058,29.058,0,0,0,.489,5.494,2.818,2.818,0,0,0,.775,1.269,3.094,3.094,0,0,0,1.341.743c1.9.494,9.39.494,9.39.494a76.8,76.8,0,0,0,9.4-.47,3.051,3.051,0,0,0,1.339-.742,2.785,2.785,0,0,0,.765-1.27,28.339,28.339,0,0,0,.5-5.495,26.534,26.534,0,0,0-.5-5.517ZM192,21.029V14.182l6.26,3.424Z" transform="translate(-182.4 -9.6)" fill="#020607"/> </svg> </a> </li> </ul> </div> <div class="footer section"> <div class="country-selection"> <p>Select a country / region</p> <div class="dropup position-unset"> <button class="btn btn-default dropdown-toggle" type="button" id="countryMenu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <span class="stateSelect"></span> <span class="material-symbols-outlined"> expand_more</span> </button> <div class="row dropdown-menu" aria-labelledby="countryMenu"> <span class="material-symbols-outlined icon-close">close</span> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>The Americas</h4> <ul> <li> <a href="/en_us.html">United States</a> </li> <li> <a href="/pt_br.html">Brasil</a> </li> <li> <a href="/en_ca.html">Canada</a> </li> <li> <a href="/es_mx.html">México</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>Middle East & Africa</h4> <ul> <li> <a href="/en_za.html">South Africa</a> </li> <li> <a href="/en_ae.html">Middle East and North Africa</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Europe</h4> <ul> <li> <a href="/en_be.html">België (Belgium)</a> </li> <li> <a href="http://www.trendmicro.cz/">Česká Republika</a> </li> <li> <a href="/en_dk.html">Danmark</a> </li> <li> <a href="/de_de.html">Deutschland, Österreich Schweiz</a> </li> <li> <a href="/es_es.html">España</a> </li> <li> <a href="/fr_fr.html">France</a> </li> <li> <a href="/en_ie.html">Ireland</a> </li> <li> <a href="/it_it.html">Italia</a> </li> <li> <a href="/en_nl.html">Nederland</a> </li> <li> <a href="/en_no.html">Norge (Norway)</a> </li> <li> <a href="/pl_pl.html">Polska (Poland)</a> </li> <li> <a href="/en_fi.html">Suomi (Finland)</a> </li> <li> <a href="/en_se.html">Sverige (Sweden)</a> </li> <li> <a href="/tr_tr.html">Türkiye (Turkey)</a> </li> <li> <a href="/en_gb.html">United Kingdom</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Asia & Pacific</h4> <ul> <li> <a href="/en_au.html">Australia</a> </li> <li> <a href="/ru_ru.html">Центральная Азия (Central Asia)</a> </li> <li> <a href="/en_hk.html">Hong Kong (English)</a> </li> <li> <a href="/zh_hk.html">香港 (中文) (Hong Kong) </a> </li> <li> <a href="/en_in.html">भारत गणराज्य (India)</a> </li> <li> <a href="/in_id.html">Indonesia</a> </li> <li> <a href="/ja_jp.html">日本 (Japan)</a> </li> <li> <a href="/ko_kr/business.html">대한민국 (South Korea)</a> </li> <li> <a href="/en_my.html">Malaysia</a> </li> <li> <a href="/en_us.html">Монголия (Mongolia) and рузия (Georgia)</a> </li> <li> <a href="/en_nz.html">New Zealand</a> </li> <li> <a href="/en_ph.html">Philippines</a> </li> <li> <a href="/en_sg.html">Singapore</a> </li> <li> <a href="/zh_tw.html">台灣 (Taiwan)</a> </li> <li> <a href="/th_th.html"> ประเทศไทย (Thailand)</a> </li> <li> <a href="/vi_vn.html">Việt Nam</a> </li> </ul> </div> </div> </div> </div> </div> </div> <div class="grid-footer-spacer1 hideOnTablet hideOnMobile"> </div> <div class="grid-footer-callout "><div class="footer section"> <div class="createAccount"> <div class="containerV1 section"> <style> @media ( min-width: 1024px ){ #container560ebcc1-1406-475a-8e32-f91c3b13ea6e, .container560ebcc1-1406-475a-8e32-f91c3b13ea6e { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 1023px ) and ( min-width: 768px ){ #container560ebcc1-1406-475a-8e32-f91c3b13ea6e, .container560ebcc1-1406-475a-8e32-f91c3b13ea6e { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 767px ){ #container560ebcc1-1406-475a-8e32-f91c3b13ea6e, .container560ebcc1-1406-475a-8e32-f91c3b13ea6e { height: auto; background-repeat: no-repeat; background-size: cover; } } </style> <div id="container560ebcc1-1406-475a-8e32-f91c3b13ea6e" class="container560ebcc1-1406-475a-8e32-f91c3b13ea6e container-wrap gray-border global-margin-top-none global-margin-bottom-large global-padding-top-none global-padding-bottom-none rounded-corners-all-20 inner-container-width"> <section> <div class="container-content"> <div class="prod-content"><div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnMobile { display: block; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnMobile { display: block; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnMobile { display: block; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 { gap: 0px 0px; grid-template-columns: 1fr 10fr 1fr; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnMobile { display: block; } #grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-867cc73e-07da-426f-a8cf-91ed568f1163"> <div class="grid-spacing-footer-lft hideOnDesktop hideOnTablet"> </div> <div class="grid-footer-callout "><div class="text primary-color-white section"> <div id="text-4228d4e57d" class="cmp-text"> <p>Experience our unified platform for free</p> </div> </div> </div> <div class="grid-spacing-footer-rht hideOnDesktop hideOnTablet"> </div> </div> </div> <div class="buttonArrayV1 section"> <ul class="button-array small center-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button primary color-ffffff normal" id="footer-free-trial-162736" href="/en_us/business/products/trials.html"> Claim your 30-day trial </a> </li> </ul> </div> </div> </div> </section> </div> </div> </div> </div> </div> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnMobile { display: block; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnMobile { display: block; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnMobile { display: block; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnMobile { display: block; } #grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-eefad618-91c9-4c0b-bf70-21590a93f846"> <div class="grid-footer-legal0 "><div class="footer section"> <div class="horizontalFooterMenu"> <ul> <li> <a href="/en_us/about/trust-center/privacy.html">Privacy</a> </li> <li> <a href="/en_us/about/legal.html">Legal</a> </li> <li> <a href="/en_us/about/legal/accessibility-policy.html">Accessibility</a> </li> <li> <a href="/en_us/about/legal/terms-of-use.html">Terms of Use</a> </li> <li> <a href="/en_us/business/sitemap.html">Sitemap</a> </li> </ul> </div> </div> </div> <div class="grid-footer-copyright "><div class="footer section"> <div class="copyright">Copyright ©2025 Trend Micro Incorporated. All rights reserved.</div> </div> </div> </div> </div> </div> </div> <script src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/jquery/granite.min.js"></script> <script src="/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js"></script> </div> </div></div> <!-- /* Core functionality javascripts, absolute URL to leverage Akamai CDN */ --> <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js"></script> <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js"></script> <script type="text/javascript" src="https://www.youtube.com/iframe_api"></script> <script src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js"></script> <script src="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js"></script> <!--For Modal-start--> <div class="modal-wrap"></div> <div class="jwPlayerString hidden"> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk</span> </div> <!--For Modal-end--> </body> </html>