CINXE.COM

<!DOCTYPE HTML> <html lang="en-SG">  <script type="text/javascript" src="https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js"></script> <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="821060e3-3f9c-4a2f-8613-8e0db4841f79"></script> <script type="text/javascript">function OptanonWrapper() { }</script>  <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script type="text/javascript"> if (typeof Granite !== "undefined" && Granite.I18n){ Granite.I18n.setLocale("en_sg" || "en"); } </script> <head> <meta charset="UTF-8"/> <meta name="viewport" content="width=device-width, initial-scale=1"/> <meta name="description" content="Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. "/> <meta name="robots" content="index,follow"/> <meta name="keywords"/> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/> <meta name="template" content="article1withouthero"/> <meta property="article:published_time" content="2025-03-25"/> <meta property="article:tag" content="exploits & vulnerabilities"/> <meta property="article:section" content="research"/> <link rel="icon" type="image/ico" href="/content/dam/trendmicro/favicon.ico"/> <link rel="canonical" href="https://www.trendmicro.com/en_sg/research/25/c/cve-2025-26633-water-gamayun.html"/> <title>CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin | Trend Micro (SG)</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600" rel="stylesheet"/> <link href="//customer.cludo.com/css/296/1798/cludo-search.min.css" type="text/css" rel="stylesheet"/> <link rel="stylesheet" href="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css" type="text/css"> <link rel="stylesheet" href="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css" type="text/css"> <script src="//tags.tiqcdn.com/utag/trendmicro/apaccms/prod/utag.sync.js"></script> <meta property="og:url" content="https://www.trendmicro.com/en_sg/research/25/c/cve-2025-26633-water-gamayun.html"/> <meta property="og:title" content="CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin"/> <meta property="og:description" content="Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. "/> <meta property="og:site_name" content="Trend Micro"/> <meta property="og:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/25/Earth-Gamayun-1-thumbnail.png"/> <meta property="og:locale" content="en_SG"/> <meta name="twitter:card" content="summary_large_image"/> <meta name="twitter:site" content="@TrendMicro"/> <meta name="twitter:title" content="CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin"/> <meta name="twitter:description" content="Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. "/> <meta name="twitter:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/25/Earth-Gamayun-1-thumbnail.png"/> </head> <body class="articlepage page basicpage context-business">  <a id="page-scroll" title="VerticalPageScroll" href="javascript:jumpScroll($(this).scrollTop());"> <span class="icon-chevron-up"></span> </a>  <script type="text/javascript"> var utag_data = {"customer_cookie_type":"business","language_code":"en_sg","page_name":"research/25/c/cve-2025-26633-water-gamayun/en_sg","category_id":"en_sg/research/25/c/cve-2025-26633-water-gamayun","page_type":"unknown","site_section":"research","post_author":"Aliakbar Zahravi|Staff Researcher","post_date":"2025-03-25"}; </script> <script type="text/javascript"> window.adobeDigitalData = typeof(window.adobeDigitalData) != "undefined" ? window.adobeDigitalData : []; window.adobeDigitalData.push( {"pageID":"db83bdba4535","articleTitle":"CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin","description":"Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. ","thumbnailUrl":"/content/dam/trendmicro/global/en/research/thumbnails/25/Earth-Gamayun-1-thumbnail.png","pageUrl":"https://www.trendmicro.com/en_sg/research/25/c/cve-2025-26633-water-gamayun.html","publishedDate":"2025-03-25","pageTag":"exploits & vulnerabilities","pageSection":"research","pageMedium":"articles, news, reports"} ); </script> <script type="text/javascript">(function(a,b,c,d){a='//tags.tiqcdn.com/utag/trendmicro/apaccms/prod/utag.js';b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);})();</script> <div class="businessHeaderV1"> <div class="headerAssemblyV1"> <header class="page-header"> <nav> <div class="header-bar"> <div class="logo"> <a id="header-logo" href="/en_sg/business.html"> <img src="/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg"/> <p>Business</p> </a> </div> <div class="inner-nav-wrapper"> <span class="material-symbols-outlined search-icon">search</span> <span class="material-symbols-outlined close-search-icon">close</span> <input type="checkbox" id="checkbox" class="hamburger-menu"/> <div aria-label="Menu" class="hamburger"></div> </div> </div> <div class="hamburger-wrapper"> <div class="mainNavMenuV1"><div class="mainNavMenu mainNavMenuV1"> <div class="list-wrapper inital-list-wrapper"> <ul class="menu nav-level-0"> <li>  <div class="label">Solutions</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/solutions/challenges.html">By Challenge</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges.html">By Challenge</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Challenge</div> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/cyber-risk.html">Understand, Prioritise & Mitigate Risks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Understand, Prioritise & Mitigate Risks</div> <p class="copy">Improve your risk posture with attack surface management</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/cyber-risk.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/cloud-native-applications.html">Protect Cloud-Native Apps</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Cloud-Native Apps</div> <p class="copy">Security that enables business outcomes</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/cloud-native-applications.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/hybrid-cloud.html">Protect Your Hybrid World</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Your Hybrid, Multi-Cloud World</div> <p class="copy">Gain visibility and meet business needs with security</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/hybrid-cloud.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/infrastructure-security.html">Securing Your Borderless Workforce</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Securing Your Borderless Workforce</div> <p class="copy">Connect with confidence from anywhere, on any device</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/infrastructure-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/network-security.html">Eliminate Network Blind Spots</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Eliminate Network Blind Spots</div> <p class="copy">Secure users and key operations throughout your environment</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/network-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/detection-response.html">See More. Respond Faster.</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">See More. Respond Faster.</div> <p class="copy">Move faster than your adversaries with powerful purpose-built XDR, cyber risk exposure management, and zero trust capabilities</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/detection-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/managed-services.html">Extend Your Team</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Extend Your Team. Respond to Threats Agilely</div> <p class="copy">Maximise effectiveness with proactive risk reduction and managed services</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/managed-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/challenges/zero-trust.html">Operationalising Zero Trust</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Operationalising Zero Trust</div> <p class="copy">Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/challenges/zero-trust.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/solutions/role.html">By Role</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role.html">By Role</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Role</div> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role/ciso.html">CISO</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">CISO</div> <p class="copy">Drive business value with measurable cybersecurity outcomes</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role/ciso.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role/soc.html">SOC Manager</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">SOC Manager</div> <p class="copy">See more, act faster</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role/soc.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role/it-infrastructure-operations.html">Infrastructure Manager</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Infrastructure Manager</div> <p class="copy">Evolve your security to mitigate threats quickly and effectively</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role/it-infrastructure-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role/cloud-developer.html">Cloud Builder and Developer</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Builder and Developer</div> <p class="copy">Ensure code runs only as intended</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role/cloud-developer.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/role/cloud-operations.html">Cloud Security Ops</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Security Ops</div> <p class="copy">Gain visibility and control with security designed for cloud environments</p> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/role/cloud-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Industry</div> <a class="leaf-button color-d71920" href="/en_sg/business/capabilities/solutions-for.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/capabilities/solutions-for/healthcare.html">Healthcare</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Healthcare</div> <p class="copy">Protect patient data, devices, and networks while meeting regulations</p> <a class="leaf-button color-d71920" href="/en_sg/business/capabilities/solutions-for/healthcare.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Automotive</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Automotive</div> <a class="leaf-button color-d71920" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/iot/enterprise-5g-iot.html">5G Networks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Networks</div> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/iot/enterprise-5g-iot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/small-business/platform.html">Small & Midsized Business Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Small & Midsized Business Security</div> <p class="copy">Stop threats with easy-to-use solutions designed for your growing business</p> <a class="leaf-button color-d71920" href="/en_sg/small-business/platform.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Platform</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/products/one-platform.html" id="b-nav-platform-1">Trend Vision One Platform</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/one-platform.html" id="b-nav-platform-2">Trend Vision One Platform</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One</div> <div class="title">Our Unified Platform</div> <p class="copy">Bridge threat protection and cyber risk management</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/one-platform.html" id="b-nav-platform-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/technologies/ai-companion.html">AI Companion</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Vision One Companion</div> <p class="copy">Your generative AI cybersecurity assistant</p> <a class="leaf-button color-d71920" href="/en_sg/business/technologies/ai-companion.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/cyber-risk-exposure-management.html" id="b-nav-attack-surface-mgmnt-1">Cyber Risk Exposure Management</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cyber Risk Exposure Management</div> <p class="copy">Stop breaches before they happen</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/cyber-risk-exposure-management.html" id="b-nav-attack-surface-mgmnt-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/detection-response/xdr.html">XDR (Extended Detection & Response)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR (Extended Detection & Response)</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/detection-response/xdr.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/products/hybrid-cloud.html">Cloud Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/hybrid-cloud.html">Cloud Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Cloud Security Overview</div> <p class="copy">The most trusted cloud security platform for developers, security teams, and businesses</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/hybrid-cloud.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/hybrid-cloud/cloud-one-container-image-security.html">Container Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Container Security</div> <p class="copy">Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/hybrid-cloud/cloud-one-container-image-security.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/hybrid-cloud/cloud-one-file-storage-security.html">File Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">File Security</div> <p class="copy">Protect application workflow and cloud storage against advanced threats</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/hybrid-cloud/cloud-one-file-storage-security.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/cyber-risk-exposure-management.html" id="b-nav-sub-asrm-cloud-2">Cyber Risk Exposure Management for Cloud</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cyber Risk Exposure Management for Cloud</div> <p class="copy">Cloud asset discovery, vulnerability prioritisation, Cloud Security Posture Management, and Attack Surface Management all in one</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/cyber-risk-exposure-management.html" id="b-nav-sub-asrm-cloud-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/detection-response/xdr.html">XDR for Cloud</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Cloud</div> <p class="copy">Extend visibility to the cloud and streamline SOC investigations</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/detection-response/xdr.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/products/endpoint-security.html" id="b-nav-endpoint-security-1">Endpoint Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/endpoint-security.html" id="b-nav-endpoint-security-2">Endpoint Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Endpoint Security Overview</div> <p class="copy">Defend the endpoint through every stage of an attack</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/endpoint-security.html" id="b-nav-endpoint-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/endpoint-security/workload-security.html">Workload Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Workload Security</div> <p class="copy">Optimised prevention, detection, and response for endpoints, servers, and cloud workloads</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/endpoint-security/workload-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/detection-response/xdr.html">XDR for Endpoint</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Endpoint</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/detection-response/xdr.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/products/network.html">Network Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/network.html">Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Security Overview</div> <p class="copy">Expand the power of XDR with network detection and response</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/network.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/detection-response/xdr.html">XDR for Network</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Network</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/detection-response/xdr.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/network/intrusion-prevention.html">Network Intrusion Prevention (IPS)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Intrusion Prevention (IPS)</div> <p class="copy">Protect against known, unknown, and undisclosed vulnerabilities in your network</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/network/intrusion-prevention.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/network/zero-trust-secure-access.html">Secure Service Edge (SSE)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Secure Service Edge (SSE)</div> <p class="copy">Redefine trust and secure digital transformation with continuous risk assessments</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/network/zero-trust-secure-access.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/iot/industrial-network-security.html">Industrial Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Network Security</div> <a class="leaf-button color-d71920" href="/en_sg/business/products/iot/industrial-network-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/solutions/iot/enterprise-5g-iot.html">5G Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Network Security</div> <a class="leaf-button color-d71920" href="/en_sg/business/solutions/iot/enterprise-5g-iot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/products/email-security.html">Email Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/email-security.html">Email Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Email Security</div> <p class="copy">Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/email-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/user-protection/sps/email-and-collaboration.html">Email and Collaboration Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Email and Collaboration Security</div> <p class="copy">Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/user-protection/sps/email-and-collaboration.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/one-platform/threat-insights.html">Threat Insights</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Threat Insights</div> <p class="copy">See threats coming from miles away</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/one-platform/threat-insights.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/identity.html">Identity Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Identity Security</div> <p class="copy">End-to-end identity security from identity posture management to detection and response</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/identity.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products/sovereign-private-cloud.html">On-Premises Data Sovereignty</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">On-Premises Data Sovereignty</div> <p class="copy">Prevent, detect, respond and protect without compromising data sovereignty</p> <a class="leaf-button color-d71920" href="/en_sg/business/products/sovereign-private-cloud.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/products.html">All Products, Services, and Trials</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">All Products, Services, and Trials</div> <a class="leaf-button color-d71920" href="/en_sg/business/products.html">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Research</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/about/threat-research.html">Research</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/threat-research.html">Research</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research</div> <a class="leaf-button color-d71920" href="/en_sg/about/threat-research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/research.html">Research, News, and Perspectives</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research, News, and Perspectives</div> <a class="leaf-button color-d71920" href="/en_sg/research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/sg/security/research-and-analysis/">Research and Analysis</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research and Analysis</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/sg/security/research-and-analysis/">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/sg/security/news/" target="_blank" rel="noopener noreferrer">Security News</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security News</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/sg/security/news/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/zero-day-initiative/about.html">Zero Day Initiatives (ZDI)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Zero Day Initiatives (ZDI)</div> <a class="leaf-button color-d71920" href="/en_sg/zero-day-initiative/about.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li>  <div class="label">Services</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/services/service-one.html">Our Services</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/service-one.html">Our Services</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Our Services</div> <a class="leaf-button color-d71920" href="/en_sg/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/service-one.html">Service Packages</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Service Packages</div> <p class="copy">Augment security teams with 24/7/365 managed detection, response, and support</p> <a class="leaf-button color-d71920" href="/en_sg/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/managed-xdr.html">Managed XDR</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed XDR</div> <p class="copy">Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks</p> <a class="leaf-button color-d71920" href="/en_sg/business/services/managed-xdr.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/business/services/incident-response.html">Incident Response</a> </div> <ul class="branch nav-item-3">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/incident-response.html">Incident Response</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Incident Response</div> <p class="copy">Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans</p> <a class="leaf-button color-d71920" href="/en_sg/business/services/incident-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/incident-response/insurance-law.html">Insurance Carriers and Law Firms</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Insurance Carriers and Law Firms</div> <p class="copy">Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs</p> <a class="leaf-button color-d71920" href="/en_sg/business/services/incident-response/insurance-law.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/services/support-services.html">Support Services</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Support Services</div> <a class="leaf-button color-d71920" href="/en_sg/business/services/support-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li>  <div class="label">Partners</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/partners/program.html">Partner Program</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/program.html">Partner Program</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Program Overview</div> <p class="copy">Grow your business and protect your customers with the best-in-class complete, multilayered security</p> <a class="leaf-button color-d71920" href="/en_sg/partners/program.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/competencies.html">Partner Competencies</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Competencies</div> <p class="copy">Stand out to customers with competency endorsements that showcase your expertise</p> <a class="leaf-button color-d71920" href="/en_sg/partners/competencies.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/partner-stories.html">Partner Successes</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Successes</div> <a class="leaf-button color-d71920" href="/en_sg/partners/partner-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/program/managed-security-service-provider.html">Managed Security Service Provider</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Security Service Provider</div> <p class="copy">Deliver modern security operations services with our industry-leading XDR</p> <a class="leaf-button color-d71920" href="/en_sg/partners/program/managed-security-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/program/managed-service-provider.html">Managed Service Provider</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Service Provider</div> <p class="copy">Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs</p> <a class="leaf-button color-d71920" href="/en_sg/partners/program/managed-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Alliance Partners</div> <p class="copy">We work with the best to help you optimise performance and value</p> <a class="leaf-button color-d71920" href="/en_sg/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/alliance-partners/technology.html">Technology Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Technology Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_sg/partners/alliance-partners/technology.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/alliance-partners/explore-alliance-partners.html">Find Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_sg/partners/alliance-partners/explore-alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/partners/resources.html">Partner Resources</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/resources.html">Partner Resources</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Resources</div> <p class="copy">Discover resources designed to accelerate your business’s growth and enhance your capabilities as a Trend Micro partner</p> <a class="leaf-button color-d71920" href="/en_sg/partners/resources.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/" target="_blank" rel="noopener noreferrer">Partner Portal Login</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Portal Login</div> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/" target="_blank" rel="noopener noreferrer">Login</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/campus.html">Trend Campus</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Campus</div> <p class="copy">Accelerate your learning with Trend Campus, an easy-to-use education platform that offers personalised technical guidance</p> <a class="leaf-button color-d71920" href="/en_sg/partners/campus.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/co-selling.html">Co-Selling</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Co-Selling</div> <p class="copy">Access collaborative services designed to help you showcase the value of Trend Vision One™ and grow your business</p> <a class="leaf-button color-d71920" href="/en_sg/partners/co-selling.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/pr-register-home/" target="_blank" rel="noopener noreferrer">Become a Partner</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Become a Partner</div> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/pr-register-home/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/distributors.html">Distributors</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Distributors</div> <a class="leaf-button color-d71920" href="/en_sg/partners/distributors.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Find Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Partners</div> <p class="copy">Locate a partner from whom you can purchase Trend Micro solutions</p> <a class="leaf-button color-d71920" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Company</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Why Trend Micro</div> <a class="leaf-button color-d71920" href="/en_sg/about/why-trend-micro.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/customer-stories.html">Customer Success Stories</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Customer Success Stories</div> <a class="leaf-button color-d71920" href="/en_sg/about/customer-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/human-connections.html">The Human Connection</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">The Human Connection</div> <a class="leaf-button color-d71920" href="/en_sg/about/human-connections.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/industry-recognition.html">Industry Accolades</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industry Accolades</div> <a class="leaf-button color-d71920" href="/en_sg/about/industry-recognition.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/partners/alliance-partners.html">Strategic Alliances</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Strategic Alliances</div> <a class="leaf-button color-d71920" href="/en_sg/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/about/compare.html">Compare Trend Micro</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/compare.html">Compare Trend Micro</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Compare Trend Micro</div> <p class="copy">See how Trend outperforms the competition</p> <a class="leaf-button color-d71920" href="/en_sg/about/compare.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/compare/trend-vs-crowdstrike.html">vs. Crowdstrike</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Crowdstrike</div> <p class="copy">Crowdstrike provides effective cybersecurity through its cloud-native platform, but its pricing may stretch budgets, especially for organisations seeking cost-effective scalability through a true single platform</p> <a class="leaf-button color-d71920" href="/en_sg/about/compare/trend-vs-crowdstrike.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/compare/trend-vs-microsoft.html">vs. Microsoft</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Microsoft</div> <p class="copy">Microsoft offers a foundational layer of protection, yet it often requires supplemental solutions to fully address customers' security problems</p> <a class="leaf-button color-d71920" href="/en_sg/about/compare/trend-vs-microsoft.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/compare/trend-vs-palo-alto-networks.html">vs. Palo Alto Networks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Palo Alto Networks</div> <p class="copy">Palo Alto Networks delivers advanced cybersecurity solutions, but navigating its comprehensive suite can be complex and unlocking all capabilities requires significant investment</p> <a class="leaf-button color-d71920" href="/en_sg/about/compare/trend-vs-palo-alto-networks.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_sg/about.html">About Us</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about.html">About Us</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">About Us</div> <a class="leaf-button color-d71920" href="/en_sg/about.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/trust-center.html">Trust Centre</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trust Centre</div> <a class="leaf-button color-d71920" href="/en_sg/about/trust-center.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/history-vision-values.html">History</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">History</div> <a class="leaf-button color-d71920" href="/en_sg/about/history-vision-values.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/diversity-inclusion.html">Diversity, Equity and Inclusion</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Diversity, Equity and Inclusion</div> <a class="leaf-button color-d71920" href="/en_sg/about/diversity-inclusion.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/corporate-social-responsibility.html">Corporate Social Responsibility</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Corporate Social Responsibility</div> <a class="leaf-button color-d71920" href="/en_sg/about/corporate-social-responsibility.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/leaders.html">Leadership</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Leadership</div> <a class="leaf-button color-d71920" href="/en_sg/about/leaders.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/leading-experts.html">Security Experts</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security Experts</div> <a class="leaf-button color-d71920" href="/en_sg/about/leading-experts.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="http://www.trendmicro.com/internet-safety">Internet Safety and Cybersecurity Education</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Internet Safety and Cybersecurity Education</div> <a class="leaf-button color-d71920" href="http://www.trendmicro.com/internet-safety">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/legal.html">Legal</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Legal</div> <a class="leaf-button color-d71920" href="/en_sg/about/legal.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Investors</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Investors</div> <a class="leaf-button color-d71920" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/business/campaigns/formula-e.html">Formula E Racing</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Formula E Racing</div> <a class="leaf-button color-d71920" href="/en_sg/business/campaigns/formula-e.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Connect With Us</div> <a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/newsroom.html">Newsroom</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Newsroom</div> <a class="leaf-button color-d71920" href="/en_sg/about/newsroom.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/events.html">Events</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Events</div> <a class="leaf-button color-d71920" href="/en_sg/about/events.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/careers.html">Careers</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Careers</div> <a class="leaf-button color-d71920" href="/en_sg/about/careers.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_sg/about/webinars.html">Webinars</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Webinars</div> <a class="leaf-button color-d71920" href="/en_sg/about/webinars.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> </ul> </div> <div class="list-wrapper drop-down-menu-2"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-3"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-4"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-5"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="buttonArrayV1"> <ul class="button-array small left-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button secondary color-ffffff normal" id="rsg-nav-free-trial-e371be" href="/en_sg/business/products/trials.html"> Free Trials </a> </li> <li class="button-array-list"> <a class="button primary color-d71920 normal" id="rsh-nav-contact-us-3758fe" href="/en_sg/business/get-info-form.html"> Contact Us </a> </li> </ul> </div> </div> </div> <div class="consumerLink"> <a href="/en_sg/forHome.html">Looking for home solutions?</a> </div> <a href="https://resources.trendmicro.com/GLB-Under-Attack-Form.html" class="under-attack-link">Under Attack?</a> <div class="alerts"> <div class="alertUtilityMenu"> <div class="utility-wrapper alert-top-menu"> <div class="dropDownMenuV1"> <div class="label"><span class="counter">6</span> Alerts</div> <div class="menu"></div> </div> </div> <div class="utility-wrapper alert-sub-menu"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-wrapper-content"> <div class="alerts-wrapper"> <div class="alert-buttons"> <div class="alerts-unread-button is-active">Unread</div> <div class="alerts-all-button">All</div> </div> <div class="sub-alerts-wrapper"></div> </div> <ul class="alerts-list"> <li id="alert-efd60d" class="unread"> <div class="copy-wrapper">  <a href="https://www.zerodayinitiative.com/blog/2025/2/24/announcing-pwn2own-berlin-2025" target="_blank" rel="noopener noreferrer"> <p class="copy">Pwn2Own Berlin offers $1,000,000+ in prizes as researchers tackle AI, Tesla, and more</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="https://www.zerodayinitiative.com/blog/2025/2/24/announcing-pwn2own-berlin-2025" target="_blank" rel="noopener noreferrer"> <p class="ctaText">Learn more ></p> </a> </li> <li id="alert-6ed79e" class="unread"> <div class="copy-wrapper">  <a href="https://resources.trendmicro.com/future-is-proactive-event.html"> <p class="copy">The Future Is Proactive Security. Don’t miss the virtual event of the year for exclusive cybersecurity insights.</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="https://resources.trendmicro.com/future-is-proactive-event.html"> <p class="ctaText">Save your spot ></p> </a> </li> <li id="alert-1c44a6" class="unread"> <div class="copy-wrapper">  <a href="/en_sg/research/25/c/windows-shortcut-zero-day-exploit.html"> <p class="copy">Windows Shortcut zero-day exploited in targeted attacks</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="/en_sg/research/25/c/windows-shortcut-zero-day-exploit.html"> <p class="ctaText">Read more ></p> </a> </li> <li id="alert-e42acc" class="unread"> <div class="copy-wrapper">  <a href="/en_sg/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html"> <p class="copy">How SocGholish intrusion techniques spread ransomware campaigns</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="/en_sg/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html"> <p class="ctaText">Learn more ></p> </a> </li> <li id="alert-c54dd4" class="unread"> <div class="copy-wrapper">  <a href="https://www.trendmicro.com/vinfo/sg/security/news/cybercrime-and-digital-threats/the-future-of-social-engineering"> <p class="copy">How AI is shaping the future of social engineering attacks</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="https://www.trendmicro.com/vinfo/sg/security/news/cybercrime-and-digital-threats/the-future-of-social-engineering"> <p class="ctaText">Learn how ></p> </a> </li> <li id="alert-dd46e5" class="unread"> <div class="copy-wrapper">  <a href="https://www.trendmicro.com/vinfo/sg/security/news/ransomware-spotlight/ransomware-spotlight-water-ouroboros"> <p class="copy">Water Ouroboros ransomware means new, tougher challenges</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="https://www.trendmicro.com/vinfo/sg/security/news/ransomware-spotlight/ransomware-spotlight-water-ouroboros"> <p class="ctaText">Read more ></p> </a> </li> </ul> </div> </div> </div> </div> <div class="utilityMenuV1"><div class="utilityMenu utilityMenuV1"> <div class="utility-wrapper standard-utility-wrapper"> <div class="dropDownMenuV1"> <div class="label">Support</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Business Support Portal </a> </li> <li> <a href="/en_sg/business/services/support-services/education.html"> Education and Certification </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/contactus/" target="_blank"> Contact Support </a> </li> <li> <a rel="noopener noreferrer" href="https://partner.trendmicro.com/partner-locator-home/" target="_blank"> Find a Support Partner </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Resources</div> <div class="menu"> <ul> <li> <a href="/en_sg/business/ai.html"> AI Security </a> </li> <li> <a href="/en_sg/about/compare.html"> Trend Micro vs. Competition </a> </li> <li> <a href="https://resources.trendmicro.com/security-assessment-service-us.html?_ga=2.66788462.1559035223.1729522833-1050444116.1727452407"> Cyber Risk Assessments </a> </li> <li> <a href="/en_sg/what-is.html"> What Is? </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/sg/threat-encyclopedia/"> Threat Encyclopedia </a> </li> <li> <a href="/en_sg/business/cyber-insurance.html"> Cyber Insurance </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/sg/security/definition/a"> Glossary of Terms </a> </li> <li> <a href="/en_sg/about/webinars.html"> Webinars </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Log In</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://signin.v1.trendmicro.com/" target="_blank"> Trend Vision One </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Support </a> </li> <li> <a rel="noopener noreferrer" href="https://partner.trendmicro.com/" target="_blank"> Partner Portal </a> </li> <li> <a rel="noopener noreferrer" href="https://cloudone.trendmicro.com/" target="_blank"> Cloud One </a> </li> <li> <a rel="noopener noreferrer" href="https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php" target="_blank"> Product Activation and Management </a> </li> <li> <a rel="noopener noreferrer" href="https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t" target="_blank"> Referral Affiliate </a> </li> </ul> </div> </div> </div> <div class="utility-wrapper active-utility-wrapper"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-utility-wrapper"></div> </div> </div> </div> </div> </nav> </header> <div class="search"> <script type="text/javascript" src="//customer.cludo.com/scripts/bundles/search-script.js"></script> <script type="text/javascript"> var cludoSettings = {}; if( undefined === window.utag_data ) { cludoSettings.cludo_language = 'en'; } else { switch (window.utag_data.language_code) { // Cludo dropped the ball on this one case 'ja_jp': cludoSettings.cludo_language = 'jp'; break; case 'in_id': cludoSettings.cludo_language = 'id'; break; default: cludoSettings.cludo_language = window.utag_data.language_code.substring(0, 2); // First two letters are the language break; } } cludoSettings.settingsObject = { customerId: 296, engineId: 2200, searchUrl: "/en_sg/common/cse.html", searchInputs: ["cludo-search-form","cludo-search-form-mobile","cludo-search-content-form"], initSearchBoxText: "", language: cludoSettings.cludo_language, //endlessScroll: {stopAfterPage:3, resultsPerPage:10, bottomOffset: 145}, //translateSearchTemplates: true, loading: "<div class='loader'></div>" }; </script> <span class="material-symbols-outlined search-back-arrow">arrow_back</span> <div class="inner-search-wrap"> <span class="material-symbols-outlined search-icon">search</span> <form class="main-menu-search" aria-label="Search Trend Micro"> <div class="main-menu-search__field-wrapper" id="cludo-search-form"> <table class="gsc-search-box"> <tbody> <tr> <td class="gsc-input"> <input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search"/> </td> </tr> </tbody> </table> </div> </form> <span class="material-symbols-outlined search-clear-button">close</span> </div> </div> </div> <section class="folder-indicators slider"> <div class="folder-indicators__wrapper"> <p class="folder-indicators__title">Content has been added to your Folio</p> <div class="folder-indicators__button-wrapper"> <button class="folder-indicators__button counter" id="counter-folder"> Go to Folio (<span>0</span>) </button> <button class="folder-indicators__button close"><span class="material-symbols-outlined close-folio-message">close</span></button> </div> </div> </section></div> <div class="root responsivegrid"> <div class="aem-Grid aem-Grid--12 aem-Grid--default--12 "> <div class="articleBodyNoHero aem-GridColumn aem-GridColumn--default--12"><div class="research-layout article container" role="contentinfo"> <article class="research-layout--wrapper row" data-article-pageID="1380836151"> <div class="col-xs-12 col-md-12 one-column"> <div class="col-xs-12 col-md-12"> <div class="article-details" role="heading"> <span class="article-details__bar" role="img"></span> <p class="article-details__display-tag">Exploits & Vulnerabilities</p> <h1 class="article-details__title">CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin</h1> <p class="article-details__description">Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data. </p> <p class="article-details__author-by">By: Aliakbar Zahravi <time class="article-details__date">March 25, 2025</time> <span>Read time: </span><span class="eta"></span> (<span class="words"></span> words) </p> <div class="article-details__icons">  <div class="a2a_kit a2a_default_style" data-a2a-icon-color="#717172"> <a class="a2a_dd addthis_link" href="https://www.addtoany.com/share"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg" class="svg-icon" alt="Share"/> </a> <a class="a2a_button_print addthis_link"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg" class="svg-icon" alt="Print"/> </a> </div>  <div class="add-to-folio tooltip"> <span class="icon-folio-thin"></span> <div class="right"> <p>Save to Folio</p> <i></i> </div> </div>  <div class="subscribe"> </div> </div> </div> </div> </div> <hr class="research-layout-divider"/> <main class="main--content col-xs-12 col-lg-8 col-lg-push-2"> <div> </div> <div class="richText"> <div> <p><span class="body-subhead-title">Summary</span></p> <ul> <li><span class="rte-red-bullet" style="font-weight: normal;">Trend Research uncovered a campaign by the Russian threat actor Water Gamayun that exploits a zero-day vulnerability in the Microsoft Management Console framework to execute malicious code, named MSC EvilTwin (CVE-2025-26633).</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">In this attack the threat actor manipulates.msc files and the Multilingual User Interface Path (MUIPath) to download and execute malicious payload, maintain persistence and steal sensitive data from infected systems.</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">Enterprises can be significantly impacted by such threats, as they can lead to data breaches and substantial financial loss. Various businesses, particularly those that use Microsoft's administrative tools heavily, may be at risk of falling victim to this campaign.</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">Microsoft and Trend Zero Day Initiative’s™ (ZDI) bug bounty programme worked together to disclose this vulnerability and quickly release a patch addressing it. Trend Vision One™ - Network Security has TippingPoint Intrusion Prevention Filters for Trend Micro customers to protect them against this threat.</span></li> </ul> <p>Trend Research uncovered a campaign by suspected Russian threat actor Water Gamayun, also known as <a href="https://www.bleepingcomputer.com/news/security/encrypthub-breaches-618-orgs-to-deploy-infostealers-ransomware/" target="_blank">EncryptHub</a> and Larva-208, that abused a zero-day vulnerability in the Microsoft Management Console (mmc.exe) framework to execute malicious code on infected machines. We’ve named this technique MSC EvilTwin (CVE-2025-26633), which we track as ZDI-CAN-26371 (also known as <a href="https://www.zerodayinitiative.com/advisories/ZDI-25-150/" target="_blank">ZDI-25-150</a>).</p> <p>This is the first part of a two-part blog series about this campaign. This post focuses on the MSC EvilTwin technique and the Trojan loader that exploits this vulnerability, explaining how it works to download and execute malicious files on victim systems using Microsoft Console (.msc) files. The next post will dive into the different modules and payloads that this threat actor uses.</p> <p>This campaign is under active development; it employs multiple delivery methods and custom payloads designed to maintain persistence and steal sensitive data, then exfiltrate it to the attackers' command-and-control (C&C) servers.</p> <p>The following modules are the identified arsenal associated with the Water Gamayun, the details of which will be covered in the second blog post:</p> <ul> <li><span class="rte-red-bullet" style="font-weight: normal;">EncryptHub stealer</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">DarkWisp backdoor</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">SilentPrism backdoor</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">MSC EvilTwin loader</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">Stealc</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">Rhadamanthys stealer</span></li> </ul> <p>In cooperation with Microsoft, the bug bounty programme of <a href="https://www.zerodayinitiative.com/" target="_blank">Trend Zero Day Initiative™ (ZDI)</a> worked to disclose this zero-day attack and release <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633" target="_blank">a patch for this vulnerability</a> on March 11. Trend also provides protection to enterprises from threat actors that exploit CVE-2025-26633 via the security solutions that can be found at end of this blog entry.</p> <p><span class="body-subhead-title">Microsoft Management Console and the Microsoft Console File</span></p> <p>The Microsoft Management Console (MMC) is an application that provides a graphical user interface (GUI) and a programming framework used to create, save, and access collections of administrative tools – referred to as consoles – for managing various Windows hardware, software, and network components. These administrative tools, called snap-ins, are COM objects linked to Microsoft console files. The Windows Firewall (wf.msc) is an example of such a tool, shown in Figure 2.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/CVE-2025-26633-Timeline.png" alt="Figure 1. Microsoft Windows MSC File Insufficient UI Warning Remote Code Execution Vulnerability (CVE-2025-26633) timeline"/> <div class="caption-image-container "> <figcaption>Figure 1. Microsoft Windows MSC File Insufficient UI Warning Remote Code Execution Vulnerability (CVE-2025-26633) timeline</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/CVE-2025-26633-Timeline.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-01.png" alt="Figure 2. Windows Firewall file (wf.msc)"/> <div class="caption-image-container "> <figcaption>Figure 2. Windows Firewall file (wf.msc)</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-01.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>A single.msc file can include references to multiple snap-ins (Figure 3). These files are scriptable, allowing users to create, modify, and use them to open MMC with a predefined set of tools and configurations.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-02.png" alt="Microsoft Management Console - Snap-ins listed in the management console"/> <div class="caption-image-container "> <figcaption>Figure 3. Microsoft Management Console - Snap-ins listed in the management console</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-02.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p><span class="body-subhead-title">Techniques used by Water Gamayun</span></p> <p>In their attack, Water Gamayun abuse three techniques to execute malicious payload on an infected system via Windows MSC files:</p> <p><b>MSC EvilTwin (CVE-2025-26633)</b></p> <p>This technique involves executing malicious.msc files through a legitimate one. In this kind of attack, two.msc files with the same name are created on the system by the trojan loader: One file is clean and appears legitimate with no suspicious elements; the other is a malicious version that is dropped in the same location but within a directory named <i>en-US</i>. When the clean.msc file is run, mmc.exe loads the malicious file instead of the original file and executed. </p> <p>In this scenario, the adversary abuses the mmc.exe's Multilingual User Interface Path (MUIPath) feature. The default system language – English (United States) – has a MUIPath that is typically configured to include MUI files (.mui), which are designed to store language-specific resources for applications. These resources include localised text, dialogues, and user interface elements tailored for different languages.</p> <p>By abusing the way that mmc.exe uses MUIPath, the attacker can equip MUIPath en-US with a malicious.msc file, which cause the mmc.exe load this malicious file instead of the original file and executed without the victim’s knowledge.</p> <p>The following code snippet demonstrates how this technique is abused in mmc.exe (SHA256: 80055590cf6573c6ef381c9b834c35c1a5e7463aedbcf4b5427a903f1e588c50):</p> <p><span class="blockquote">10.0.26100.2033 (WinBuild.160101.0800) file.</span></p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-03.png" alt="mmc.exe MUI file handling"/> <div class="caption-image-container "> <figcaption>Figure 4. mmc.exe MUI file handling</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-03.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>When executing an.msc file through mmc.exe, the <i>ScOnOpenDocument</i> function calls the <i>scGetMuiPath</i> function, which uses the <i>GetFileMUIPath</i> Windows API to retrieve the MUI file if it exists.</p> <p>If MUIPath en-US exists, mmc.exe loads the XML content from the.msc file in the en-US directory rather than from the original MSC file, and executes it. If the en-US directory does not exist, the selected.msc file content is loaded and executed.</p> <p><b>Execute shell command over the MSC file web rendering</b></p> <p>The second technique enables command shell execution through the <i>ExecuteShellCommand</i> method of the MMC from a View object on the victim's machine. This can be done by leveraging specially crafted.msc files and a Shockwave Flash Object within an ActiveX control, which opens a web browser by default (Figure 5).</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-04.png" alt="mmc.exe with ActiveX control snap-in open Given URL within StringTable by default with High priority"/> <div class="caption-image-container "> <figcaption>Figure 5. mmc.exe with ActiveX control snap-in open Given URL within StringTable by default with High priority</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-04.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>The <i>ExecuteShellCommand</i> method is part of the MMC’s View Object, which runs a command in a window (Figure 6).</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-05.png" alt="The ExecuteShellCommand method is part of the MMC View Object"/> <div class="caption-image-container "> <figcaption>Figure 6. The ExecuteShellCommand method is part of the MMC View Object</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-05.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>In this context, View Object acts as an external object when an MMC snap-in hosts the Microsoft Internet Explorer browser component. This means that it is possible to access the MMC’s view object method remotely from an HTML page displayed in MMC by embedding a script tag, such as:</p> <p><span class="blockquote"><script>external.ExecuteShellCommand(...)</script></span></p> <p>In this case, the attacker hosts the following command to download and execute a next-stage payload on the victim's machine (Figure 7). This technique has been previously <a href="https://www.outflank.nl/blog/2024/08/13/will-the-real-grimresource-please-stand-up-abusing-the-msc-file-format/" target="_blank">discussed by security practitioners</a> and has a <a href="https://github.com/hfiref0x/UACME/blob/master/Source/Kamikaze/Kamikaze.msc" target="_blank">proof-of-concept</a>.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-06.png" alt="MMC's ExecuteShellCommnad method used by thread actor to download and execute payload"/> <div class="caption-image-container "> <figcaption>Figure 7. MMC's ExecuteShellCommnad method used by thread actor to download and execute payload</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-06.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p><b>Mock trusted directories method</b></p> <p>The third approach involves creating mock directories that appear similar to standard system paths by adding trailing spaces or special characters in the name. For example, creating "C:\Windows \System32" (note the space before \System32) instead of the standard "C:\Windows\System32". When an application's path validation logic doesn't properly handle whitespace during string comparisons, it may interpret the modified directory as equivalent to the genuine system path. This can result in files being loaded from the alternate location rather than the intended system directory. This technique becomes relevant when working with applications that load libraries or executables with elevated access levels. MSC EvilTwin loader uses this method to drop WmiMgmt.msc (Figure 8).</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-07.png" alt="MSC EvilTwin loader uses the mock trusted directories method to drop WmiMgmt.msc"/> <div class="caption-image-container "> <figcaption>Figure 8. MSC EvilTwin loader uses the mock trusted directories method to drop WmiMgmt.msc</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-07.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p><b><span class="body-subhead-title">MSC EvilTwin trojan loader</span></b></p> <p>The MSC EvilTwin loader is a trojan loader, written in PowerShell, weaponised all the techniques explained above to download and execute malicious payloads on compromised systems (Figure 9). Our analysis indicates that the attack begins with a digitally-signed MSI file masquerading as popular Chinese software like DingTalk or QQTalk (SHA256: 5588d1c5901d61bb09cd2fc86d523e2ccbc35a0565fd63c73b62757ac2ee51f5). These files are designed to fetch the MSC EvilTwin loader from the attacker's C&C server and execute it on the victim's machine.</p> <p>During our investigation, we discovered an early version of this technique being used in April 2024.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-08.png" alt="MSC EvilTwin Loader main logic"/> <div class="caption-image-container "> <figcaption>Figure 9. MSC EvilTwin Loader main logic</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-08.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>The loader contains two Base64-encoded blobs called <i>$originalConsole</i> and <i>$hackedConsole</i>. These are.msc files. The <i>originalConsole</i> variable stores a legitimate non-malicious.msc file, while <i>hackedConsole</i> contains maliciously crafted.msc files with the attacker’s C&C server address.</p> <p>Initially, the loader creates two directories: <i>C:\Windows \System32</i> and <i>C:\Windows \System32\en-US</i>, which look similar to the legitimate WmiMgmt.msc paths on a Windows system (Figure 10). The loader then decodes and writes the contents of the.msc file. For the file WmiMgmt.msc in the en-US directory, it replaces the placeholder <i>{htmlLoaderUrl}</i> with the attacker's C&C server URL, <i>hxxps://82[.]115.223.182/encrypthub/ram/</i>.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-09.png" alt="Legit and preexisting WmiMgmt.msc on Windows system (note the lack of whitespace in the system paths)"/> <div class="caption-image-container "> <figcaption>Figure 10. Legit and preexisting WmiMgmt.msc on Windows system (note the lack of whitespace in the system paths)</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-09.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>The malware then executes the non-malicious WmiMgmt.msc located at <i>C:\Windows\System32\WmiMgmt.msc</i>. This triggers the EvilTwin technique, causing mmc.exe to load and execute WmiMgmt.msc from the MUI path en-US instead. This file contains the attacker’s C&C server URL in the <i>StringTable</i> section. </p> <p>This causes the mmc.exe, which has the ActiveX Control snap-in, to load Microsoft’s Internet Explorer browser components and load the URL’s HTML content within the mmc.exe to render and display. In this case, the attacker embedded the <i>external.ExecuteShellCommand</i> method within script tag in the malicious HTML page (Figure 11), which causes the MMC to execute the given command in the victim’s machine. In this example, the loader downloads and executes <i>ram.ps1</i>, the Rhadamanthys stealer downloader, on an infected system.</p> </div> </div> <div class="image"> <figure class="image-figure"> <img src="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-10.png" alt="The EvilTwin technique to execute a PowerShell"/> <div class="caption-image-container "> <figcaption>Figure 11. The EvilTwin technique to execute a PowerShell</figcaption> <div class="download-anchor-wrapper"> <a href="/content/dam/trendmicro/global/en/research/25/c/cve-2025-26633-how-earth-gamayun-weaponizes-muipath-in-msc-eviltwin-attacks/EarthGamayunPart1-10.png" class="download-anchor" download> <span class="material-symbols-outlined">download</span> </a> </div> </div> </figure> </div> <div class="richText"> <div> <p>Water Gamayun not only uses these techniques in this loader, but also extensively applies them in other modules to download and execute next-stage payloads or plugins from the server. By leveraging these techniques, attackers can proxy the execution of malicious payload through legitimate Windows binaries by running non-malicious files.</p> <p><span class="body-subhead-title">Conclusion</span></p> <p>Trend Research’s investigation into this campaign demonstrates Water Gamayun’s approach to exploiting vulnerabilities within the MMC framework. By abusing a vulnerability in the MMC framework, which we have designated as MSC EvilTwin (CVE-2025-26633), this threat actor has effectively devised a method to execute malicious code on infected machines. In this instalment of our two-part series, we focused on the technical aspects of the MSC EvilTwin technique and the Trojan loader used to exploit this vulnerability. This attack employs multiple innovative techniques to maintain persistence and exfiltrate sensitive data, leveraging the manipulation of.msc files and Microsoft's MUIPath.</p> <p>Our findings revealed that this campaign is actively developing, utilising various delivery methods and custom payloads, as detailed in the modules deployed by Water Gamayun, including EncryptHub stealer, DarkWisp backdoor, SilentPrism backdoor, and Rhadamanthys stealer.</p> <p>Through the collaboration between Microsoft and the Trend ZDI, this zero-day attack has been disclosed and a patch has quickly been issued to address it. Enterprises need comprehensive cybersecurity solutions to combat the evolving threats exemplified by campaigns such as those conducted by Water Gamayun. With techniques that exploit vulnerabilities like MSC EvilTwin, a layered approach and advanced cybersecurity solutions are vital for safeguarding digital assets in a landscape where threat actors are continuously refining their tactics.</p> <p><span class="body-subhead-title">Proactive security with Trend Vision One™ </span></p> <p>Organisations can protect themselves from attacks such as those employed by Water Gamayun with <a href="/en_sg/business/products/one-platform.html" title="https://www.trendmicro.com/en_us/business/products/one-platform.html">Trend Vision One</a><a href="https://www.trendmicro.com/en_us/business/products/network.html">™</a> – the only AI-powered enterprise cybersecurity platform that centralises cyber risk exposure management, security operations, and robust layered protection. This comprehensive approach helps you predict and prevent threats, accelerating proactive security outcomes across your entire digital estate. Backed by decades of cybersecurity leadership and Trend Cybertron, the industry's first proactive cybersecurity AI, it delivers proven results: a 92% reduction in ransomware risk and a 99% reduction in detection time. Security leaders can benchmark their posture and showcase continuous improvement to stakeholders. With Trend Vision One, you’re enabled to eliminate security blind spots, focus on what matters most, and elevate security into a strategic partner for innovation.</p> <p><span class="body-subhead-title">Trend protections for CVE-2025-26633</span></p> <p>The following protections have been available to Trend Micro customers: </p> <p><b>Trend Vision One™ - Network Security<br /> <br /> </b>TippingPoint Intrusion Prevention Filters</p> <ul> <li><span class="rte-red-bullet" style="font-weight: normal;">45359: TCP: Backdoor.Shell.DarkWisp.A Runtime Detection</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">45360: HTTP: Trojan.Shell.EncryptHubStealer.B Runtime Detection</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">45361: HTTP: Backdoor.Shell.SilentPrism.A Runtime Detection</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">45594: HTTP: Trojan.Shell.EncryptHubStealer.B Runtime Detection (Notification Request)</span></li> <li><span class="rte-red-bullet" style="font-weight: normal;">45595: HTTP: Trojan.Shell.MSCEvilTwin.A Runtime Detection (Payload - Server Response)</span></li> </ul> <p><span class="body-subhead-title">Trend Vision One Threat Intelligence</span></p> <p>To stay ahead of evolving threats, Trend customers can access a range of Intelligence Reports and Threat Insights. Threat Insights helps customers stay ahead of cyber threats before they happen and better prepared for emerging threats. It offers comprehensive information on threat actors, their malicious activities, and the techniques they use. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and respond effectively to threats..</p> <p><b>Trend Vision One Intelligence Reports App [IOC Sweeping]</b></p> <ul> <li><span class="rte-red-bullet"><i>ZDI-CAN-26371 (CVE-2025-26633): Water Gamayun exploit MSC EvilTwin Zero-Day</i></span></li> </ul> <p><b>Trend Vision One Threat Insights App</b></p> <ul> <li><span class="rte-red-bullet"><b>Threat Actors: </b><a href="https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence_insights?name=Water%20Gamayun" target="_blank">Water Gamayun</a></span></li> <li><span class="rte-red-bullet"><b>Emerging Threats: </b> <a href="https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence_insights?name=CVE-2025-26633%3A%20How%20Water%20Gamayun%20Weaponizes%20MUIPath%20using%20MSC%20EvilTwin%20%E2%80%93%20A%20Deep%20Dive%20into%20Their%20Arsenal%20and%20Infrastructure" target="_blank">CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin – A Deep Dive into Their Arsenal and Infrastructure</a></span></li> <li><span class="rte-red-bullet"><b>Vulnerability: </b> <a href="https://portal.xdr.trendmicro.com/#/app/sase?cveId=CVE-2025-26633" target="_blank">CVE-2025-26633</a></span></li> </ul> <h2><span class="body-subhead-title">Hunting Queries </span></h2> <p><b>Trend Vision One Search App</b></p> <p>Trend Vision One customers can use the Search App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.</p> <p><b>Monitor for network connections to suspicious C&C IPs</b></p> <p><span class="code"><span class="blockquote">eventId:3 AND eventSubId:204 AND (dst:"82.115.223.182")</span></span></p> <p><b>Look for processes (mmc.exe) executing.msc files from unusual paths</b></p> <p><span class="code"><span class="blockquote">eventSubId:2 AND processFilePath:"*\mmc.exe" AND processFilePath:"*\powershell.exe" AND objectFilePath:"C:\\Windows \System32\*.msc"</span></span></p> <p>More hunting queries are available for Trend Vision One customers with<a href="https://www.trendmicro.com/en_us/business/products/one-platform/threat-insights.html" target="_blank">Threat Insights Entitlement enabled</a>.</p> <p><span class="body-subhead-title">Indicators of Compromise (IOCs)</span></p> <p>The indicators of compromise for this entry can be found <a href="https://documents.trendmicro.com/assets/txt/IOCs_MSCEvilTwin_42J5iaVT.txt" target="_blank">here</a>.</p> </div> </div> </div> <section class="tag--list"> <div class="tag--list-title">Tags</div> <div class="tag--list-tags"> <a href="/en_sg/research.html?category=trend-micro-research:environments/endpoints" class="tag--list-anchor">Endpoints</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_sg/research.html?category=trend-micro-research:threats/exploits-and-vulnerabilities" class="tag--list-anchor">Exploits & Vulnerabilities</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_sg/research.html?category=trend-micro-research:article-type/research" class="tag--list-anchor">Research</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_sg/research.html?category=trend-micro-research:medium/article" class="tag--list-anchor">Articles, News, Reports</a> </div> </section> </main> <sidebar class="sidebar--left col-xs-12 col-lg-2 col-lg-pull-8"> <h3 class="article-authors__title"> Authors </h3>  <ul class="article-authors__list"> <li class="article-authors__list-items"> <div class="article-authors__wrapper" role="contentinfo authors profile"> <p class="article-authors__list-items__name">Aliakbar Zahravi</p> <p class="article-authors__list-items__position">Staff Researcher</p> </div> </li> </ul> <div class="article-authors__btn-wrapper" role="button"> <a class="article-authors__button " href="mailto:tm_research@trendmicro.com" target="target" id="article-authors-contact-us-button"> Contact Us </a> </div> </sidebar> <sidebar class="sidebar--right col-xs-12 col-lg-2"> <div class="sidebar--wrapper" role="contentinfo sidebar"> <div class="row-1" role="contentinfo related articles"> <div class="related--articles" role="contentinfo related articles"> <h3 class="related--articles-title">Related Articles</h3> <ul class="related--articles-items"> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_sg/research/25/c/deep-dive-into-water-gamayun.html"> A Deep Dive into Water Gamayun’s Arsenal and Infrastructure </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_sg/research/25/c/boost-mainframe-security.html"> Trend Micro & IBM Team Up To Boost Mainframe Security </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_sg/research/25/c/cybertron-ai-security.html"> Trend Cybertron: Full Platform or Open-Source? </a> </li> </ul> </div> <div class="archived--link"> <div class="archived--link-text"> <a href="/en_sg/research.html"> See all articles </a> </div> <div class="archived--link-icon"> <a href="/en_sg/research.html"> <span class="icon-chevron-right"></span> </a> </div> </div> </div> </div> </sidebar> </article> </div></div> </div> </div> <div class="footer"> <div class="containerV1"><div class="footer_wrapper footer-wrapper"><div class="containerV1"> <div class="container-content"> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 { display: grid; gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 { gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnMobile { display: block; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 { gap: 0px 10px; grid-template-columns: 6fr 6fr 6fr 6fr; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnMobile { display: block; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 3fr; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnMobile { display: block; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 4fr; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnMobile { display: block; } #grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-1ea6d954-a057-4e19-95f6-b4b9eae9c568"> <div class="grid-resources-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Resources</h3> <ul> <li><a href="/en_sg/research.html" target="_self" rel="noopener noreferrer">Blog</a></li> <li><a href="/en_sg/about/newsroom.html" target="_self" rel="noopener noreferrer">Newsroom</a></li> <li><a href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports" target="_self" rel="noopener noreferrer">Threat Reports</a></li> <li><a href="https://partner.trendmicro.com/partner-locator-home/" target="_blank" rel="noopener noreferrer">Find a Partner</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-support-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Support</h3> <ul> <li><a href="https://success.trendmicro.com/en-US/" target="_blank" rel="noopener noreferrer">Business Support Portal</a></li> <li><a href="/en_sg/business/get-info-form.html" target="_self" rel="noopener noreferrer">Contact Us</a></li> <li><a href="/en_sg/business/products/downloads.html" target="_self" rel="noopener noreferrer">Downloads</a></li> <li><a href="/en_sg/business/products/trials.html" target="_self" rel="noopener noreferrer">Free Trials</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-about-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>About Trend</h3> <ul> <li><a href="/en_sg/about.html" target="_self" rel="noopener noreferrer">About Us</a></li> <li><a href="/en_sg/about/careers.html" target="_self" rel="noopener noreferrer">Careers</a></li> <li><a href="/en_sg/contact.html#tabs-e95d36-3" target="_self" rel="noopener noreferrer">Locations</a></li> <li><a href="/en_sg/about/events.html" target="_self" rel="noopener noreferrer">Upcoming Events</a></li> <li><a href="/en_sg/about/trust-center.html" target="_self" rel="noopener noreferrer">Trust Center</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-address-tab1 "><div class="reference parbase section"><div class="cq-dd-paragraph"><div class="footer"> <script type="application/ld+json"> {"@context":"https://schema.org","@type":"Organization","name":"Trend Micro - Singapore (SG)","telephone":"+65 6379 2060","address":{"addressLocality":"","addressRegion":"Singapore","postalCode":"038986","streetAddress":"6 Temasek Boulevard #16-01 to 05 Suntec Tower Four"}} </script> <div class="organization footerMenu footer-address-menu"> <h3 class="title">Country Headquarters</h3> <ul class="footer-address-wrapper"> <li class="name">Trend Micro - Singapore (SG)</li> <li class="address"> 6 Temasek Boulevard<br/> #16-01 to 05 Suntec Tower Four<br/> Singapore 038986 </li> <li class="phone">Phone:: +65 6379 2060</li> </ul> </div> </div> </div> </div> </div> </div> </div> <div class="horizontalSeparatorV1 section"> <style> .horizontalSeparator-c8bf3905-aa64-4f1b-9622-8c4a17d10119.border { border-bottom: 1px solid #bcbdc0; } </style> <div id="horizontalV1-c8bf3905-aa64-4f1b-9622-8c4a17d10119" class="global-margin-top- global-margin-bottom-medium global-padding-top-small global-padding-bottom- border horizontalSeparator-c8bf3905-aa64-4f1b-9622-8c4a17d10119"> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnMobile { display: block; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 { gap: 0px 0px; grid-template-columns: 3fr 3fr 6fr; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnMobile { display: block; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 { gap: 0px 0px; grid-template-columns: 1fr 2fr 2fr; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnMobile { display: block; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 { gap: 0px 0px; grid-template-columns: 1fr 2fr 2fr; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnMobile { display: block; } #grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-f3c1506e-3c76-4418-b5fb-55c78adf09c8"> <div class="grid-footer-locale1 "><div class="footer section"> <ul class="social-media-links"> <li> <a href="https://www.linkedin.com/company/trend-micro/" class="social-icon linkedin" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="LinkedIn" d="M8.8,10.3a1.5,1.5,0,0,1,1.5-1.5H25.295A1.5,1.5,0,0,1,26.8,10.3V25.294A1.5,1.5,0,0,1,25.3,26.8H10.3a1.5,1.5,0,0,1-1.5-1.5Zm7.125,5.359h2.437v1.224a2.793,2.793,0,0,1,2.6-1.337c2.593,0,3.207,1.4,3.207,3.973v4.763H21.55V20.109c0-1.465-.352-2.291-1.245-2.291-1.24,0-1.755.891-1.755,2.291v4.178H15.925Zm-4.5,8.512H14.05V15.55H11.425v8.624Zm3-11.437a1.688,1.688,0,1,1-.507-1.17A1.689,1.689,0,0,1,14.425,12.737Z" transform="translate(-8.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.facebook.com/TrendMicro/" class="social-icon facebook" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Facebook" d="M56.087,8.8A3.28,3.28,0,0,0,52.8,12.087V23.513A3.28,3.28,0,0,0,56.087,26.8H62.28V19.763H60.419V17.229H62.28V15.065c0-1.7,1.1-3.262,3.632-3.262a15.371,15.371,0,0,1,1.784.1l-.06,2.366s-.773-.007-1.617-.007c-.913,0-1.06.421-1.06,1.119v1.85h2.75l-.12,2.533h-2.63V26.8h2.554A3.28,3.28,0,0,0,70.8,23.513V12.087A3.28,3.28,0,0,0,67.513,8.8H56.087Z" transform="translate(-52.8 -8.8)" fill="#020607"/> </svg> </a> </li> <li> <a href="https://x.com/trendmicro" class="social-icon twitter" target="_blank" rel="noopener noreferrer">  <svg xmlns="http://www.w3.org/2000/svg" width="19.57" height="20" viewBox="0 0 19.57 20"> <path id="x-logo" d="M11.647,8.469,18.932,0H17.206L10.88,7.353,5.827,0H0L7.64,11.119,0,20H1.726l6.68-7.765L13.743,20H19.57L11.646,8.469ZM9.282,11.217,8.508,10.11,2.349,1.3H5L9.971,8.41l.774,1.107,6.461,9.242H14.555L9.282,11.218Z"/> </svg>     </a> </li> <li> <a href="https://www.instagram.com/trendmicro/" class="social-icon instagram" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Instagram" d="M146.09,8.854c.959-.044,1.265-.054,3.71-.054s2.751.011,3.71.054a6.631,6.631,0,0,1,2.186.418,4.607,4.607,0,0,1,2.631,2.632,6.641,6.641,0,0,1,.419,2.184c.044.961.054,1.267.054,3.711s-.011,2.751-.054,3.711a6.61,6.61,0,0,1-.419,2.184,4.6,4.6,0,0,1-2.631,2.632,6.626,6.626,0,0,1-2.185.419c-.96.044-1.266.054-3.711.054s-2.751-.011-3.71-.054a6.6,6.6,0,0,1-2.185-.419,4.595,4.595,0,0,1-2.633-2.631,6.643,6.643,0,0,1-.419-2.185c-.044-.961-.054-1.267-.054-3.711s.01-2.751.054-3.71a6.611,6.611,0,0,1,.419-2.186A4.611,4.611,0,0,1,143.9,9.272a6.65,6.65,0,0,1,2.185-.418Zm7.346,1.62c-.949-.043-1.234-.052-3.636-.052s-2.687.009-3.636.052a4.976,4.976,0,0,0-1.673.31,2.972,2.972,0,0,0-1.708,1.708,4.968,4.968,0,0,0-.31,1.671c-.044.949-.053,1.234-.053,3.637s.009,2.688.053,3.637a4.968,4.968,0,0,0,.31,1.671,2.972,2.972,0,0,0,1.708,1.708,4.976,4.976,0,0,0,1.673.31c.949.043,1.232.052,3.636.052s2.688-.009,3.636-.052a4.976,4.976,0,0,0,1.673-.31,2.972,2.972,0,0,0,1.708-1.708,4.968,4.968,0,0,0,.31-1.671c.043-.949.053-1.234.053-3.637s-.01-2.688-.053-3.637a4.968,4.968,0,0,0-.31-1.671,2.972,2.972,0,0,0-1.708-1.708A4.976,4.976,0,0,0,153.436,10.474Zm-4.786,10.1a3,3,0,1,0-1.075-.758A3,3,0,0,0,148.65,20.574Zm-2.121-6.046a4.626,4.626,0,1,1-1.355,3.271A4.634,4.634,0,0,1,146.529,14.529Zm8.924-.666a1.091,1.091,0,0,0,.25-.355,1.1,1.1,0,0,0,.093-.425,1.093,1.093,0,1,0-.343.78Z" transform="translate(-140.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.youtube.com/user/TrendMicroInc" class="social-icon youtube" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="24.003" height="16.01" viewBox="0 0 24.003 16.01"> <path id="YouTube" d="M205.9,12.112a2.78,2.78,0,0,0-.765-1.27A3.052,3.052,0,0,0,203.8,10.1c-1.877-.495-9.4-.495-9.4-.495a76.616,76.616,0,0,0-9.39.47,3.156,3.156,0,0,0-1.339.76,2.9,2.9,0,0,0-.777,1.276A29.133,29.133,0,0,0,182.4,17.6a29.058,29.058,0,0,0,.489,5.494,2.818,2.818,0,0,0,.775,1.269,3.094,3.094,0,0,0,1.341.743c1.9.494,9.39.494,9.39.494a76.8,76.8,0,0,0,9.4-.47,3.051,3.051,0,0,0,1.339-.742,2.785,2.785,0,0,0,.765-1.27,28.339,28.339,0,0,0,.5-5.495,26.534,26.534,0,0,0-.5-5.517ZM192,21.029V14.182l6.26,3.424Z" transform="translate(-182.4 -9.6)" fill="#020607"/> </svg> </a> </li> </ul> </div> <div class="footer section"> <div class="country-selection"> <p>Select a country / region</p> <div class="dropup position-unset"> <button class="btn btn-default dropdown-toggle" type="button" id="countryMenu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <span class="stateSelect"></span> <span class="material-symbols-outlined"> expand_more</span> </button> <div class="row dropdown-menu" aria-labelledby="countryMenu"> <span class="material-symbols-outlined icon-close">close</span> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>The Americas</h4> <ul> <li> <a href="/en_us.html">United States</a> </li> <li> <a href="/pt_br.html">Brasil</a> </li> <li> <a href="/en_ca.html">Canada</a> </li> <li> <a href="/es_mx.html">México</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>Middle East & Africa</h4> <ul> <li> <a href="/en_za.html">South Africa</a> </li> <li> <a href="/en_ae.html">Middle East and North Africa</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Europe</h4> <ul> <li> <a href="/en_be.html">België (Belgium)</a> </li> <li> <a href="http://www.trendmicro.cz/">Česká Republika</a> </li> <li> <a href="/en_dk.html">Danmark</a> </li> <li> <a href="/de_de.html">Deutschland, Österreich Schweiz</a> </li> <li> <a href="/es_es.html">España</a> </li> <li> <a href="/fr_fr.html">France</a> </li> <li> <a href="/en_ie.html">Ireland</a> </li> <li> <a href="/it_it.html">Italia</a> </li> <li> <a href="/en_nl.html">Nederland</a> </li> <li> <a href="/en_no.html">Norge (Norway)</a> </li> <li> <a href="/pl_pl.html">Polska (Poland)</a> </li> <li> <a href="/en_fi.html">Suomi (Finland)</a> </li> <li> <a href="/en_se.html">Sverige (Sweden)</a> </li> <li> <a href="/tr_tr.html">Türkiye (Turkey)</a> </li> <li> <a href="/en_gb.html">United Kingdom</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Asia & Pacific</h4> <ul> <li> <a href="/en_au.html">Australia</a> </li> <li> <a href="/ru_ru.html">Центральная Азия (Central Asia)</a> </li> <li> <a href="/en_hk.html">Hong Kong (English)</a> </li> <li> <a href="/zh_hk.html">香港 (中文) (Hong Kong) </a> </li> <li> <a href="/en_in.html">भारत गणराज्य (India)</a> </li> <li> <a href="/in_id.html">Indonesia</a> </li> <li> <a href="/ja_jp.html">日本 (Japan)</a> </li> <li> <a href="/ko_kr/business.html">대한민국 (South Korea)</a> </li> <li> <a href="/en_my.html">Malaysia</a> </li> <li> <a href="/en_us.html">Монголия (Mongolia) and рузия (Georgia)</a> </li> <li> <a href="/en_nz.html">New Zealand</a> </li> <li> <a href="/en_ph.html">Philippines</a> </li> <li> <a href="/en_sg.html">Singapore</a> </li> <li> <a href="/zh_tw.html">台灣 (Taiwan)</a> </li> <li> <a href="/th_th.html"> ประเทศไทย (Thailand)</a> </li> <li> <a href="/vi_vn.html">Việt Nam</a> </li> </ul> </div> </div> </div> </div> </div> </div> <div class="grid-footer-spacer1 hideOnTablet hideOnMobile"> </div> <div class="grid-footer-callout "><div class="footer section"> <div class="createAccount"> <div class="containerV1 section"> <style> @media ( min-width: 1024px ){ #container5bb49fab-a091-41b3-84a3-f1a2a33745ed, .container5bb49fab-a091-41b3-84a3-f1a2a33745ed { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 1023px ) and ( min-width: 768px ){ #container5bb49fab-a091-41b3-84a3-f1a2a33745ed, .container5bb49fab-a091-41b3-84a3-f1a2a33745ed { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 767px ){ #container5bb49fab-a091-41b3-84a3-f1a2a33745ed, .container5bb49fab-a091-41b3-84a3-f1a2a33745ed { height: auto; background-repeat: no-repeat; background-size: cover; } } </style> <div id="container5bb49fab-a091-41b3-84a3-f1a2a33745ed" class="container5bb49fab-a091-41b3-84a3-f1a2a33745ed container-wrap gray-border global-margin-top-none global-margin-bottom-large global-padding-top-none global-padding-bottom-none rounded-corners-all-20 inner-container-width"> <section> <div class="container-content"> <div class="prod-content"><div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnMobile { display: block; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnMobile { display: block; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnMobile { display: block; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f { gap: 0px 0px; grid-template-columns: 1fr 10fr 1fr; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnMobile { display: block; } #grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-9964406b-b56b-485e-8ff2-a6b8923c012f"> <div class="grid-spacing-footer-lft hideOnDesktop hideOnTablet"> </div> <div class="grid-footer-callout "><div class="text primary-color-white section"> <div id="text-c7563d9fc0" class="cmp-text"> <p>Experience our unified platform for free</p> </div> </div> </div> <div class="grid-spacing-footer-rht hideOnDesktop hideOnTablet"> </div> </div> </div> <div class="buttonArrayV1 section"> <ul class="button-array small center-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button primary color-ffffff normal" id="footer-free-trial-558e56" href="/en_sg/business/products/trials.html"> Claim your 30-day trial </a> </li> </ul> </div> </div> </div> </section> </div> </div> </div> </div> </div> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnMobile { display: block; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnMobile { display: block; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnMobile { display: block; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db { gap: 0px 0px; grid-template-columns: 6fr 6fr; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnMobile { display: block; } #grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-2cb3e840-c068-4ed6-8fcf-71d184da31db"> <div class="grid-footer-legal0 "><div class="footer section"> <div class="horizontalFooterMenu"> <ul> <li> <a href="/en_sg/about/trust-center/privacy.html">Privacy</a> </li> <li> <a href="/en_sg/about/legal.html">Legal</a> </li> <li> <a href="/en_sg/about/legal/accessibility-policy.html">Accessibility</a> </li> <li> <a href="/en_sg/about/legal/terms-of-use.html">Terms of Use</a> </li> <li> <a href="/en_sg/business/sitemap.html">Sitemap</a> </li> </ul> </div> </div> </div> <div class="grid-footer-copyright "><div class="footer section"> <div class="copyright">Copyright ©2025 Trend Micro Incorporated. All rights reserved.</div> </div> </div> </div> </div> </div> </div> <script src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/jquery/granite.min.js"></script> <script src="/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js"></script> </div> </div></div>  <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js"></script> <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js"></script> <script type="text/javascript" src="https://www.youtube.com/iframe_api"></script> <script src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js"></script> <script src="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js"></script>  <div class="modal-wrap"></div> <div class="jwPlayerString hidden"> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk</span> </div>  </body> </html>