CINXE.COM

<!DOCTYPE HTML> <html lang="en-US">  <script type="text/javascript" src="https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js"></script> <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="821060e3-3f9c-4a2f-8613-8e0db4841f79"></script> <script type="text/javascript">function OptanonWrapper() { }</script>  <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script type="text/javascript"> if (typeof Granite !== "undefined" && Granite.I18n){ Granite.I18n.setLocale("en_us" || "en"); } </script> <head> <meta charset="UTF-8"/> <meta name="viewport" content="width=device-width, initial-scale=1"/> <meta name="description" content="We found an application sample in April called TinkaOTP, and our investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor discovered in December 2019."/> <meta name="robots" content="index,follow"/> <meta name="keywords" content="malware,endpoints,research"/> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/> <meta name="template" content="article1withouthero"/> <meta property="article:published_time" content="2020-05-11"/> <meta property="article:tag" content="malware"/> <meta property="article:section" content="research"/> <link rel="icon" type="image/ico" href="/content/dam/trendmicro/favicon.ico"/> <link rel="canonical" href="https://www.trendmicro.com/en_us/research/20/e/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability.html"/> <title>Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability | Trend Micro (US)</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600" rel="stylesheet"/> <link href="//customer.cludo.com/css/296/1798/cludo-search.min.css" type="text/css" rel="stylesheet"/> <link rel="stylesheet" href="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css" type="text/css"> <link rel="stylesheet" href="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css" type="text/css"> <script src="//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js"></script> <meta property="og:url" content="https://www.trendmicro.com/en_us/research/20/e/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability.html"/> <meta property="og:title" content="Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability"/> <meta property="og:description" content="We found an application sample in April called TinkaOTP, and our investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor discovered in December 2019."/> <meta property="og:site_name" content="Trend Micro"/> <meta property="og:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/20/e/lazarus-macos-dacls-rat-2/new-macos-dacls-rat-641.jpg"/> <meta property="og:locale" content="en_US"/> <meta name="twitter:card" content="summary_large_image"/> <meta name="twitter:site" content="@TrendMicro"/> <meta name="twitter:title" content="Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability"/> <meta name="twitter:description" content="We found an application sample in April called TinkaOTP, and our investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor discovered in December 2019."/> <meta name="twitter:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/20/e/lazarus-macos-dacls-rat-2/new-macos-dacls-rat-641.jpg"/> <script>(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"false","rua.upre":"false","rua.cpre":"false","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans":"","rua.cook":"false","rua.ims":"false","rua.ufprl":"false","rua.cfprl":"false","rua.isuxp":"false","rua.texp":"norulematch","rua.ceh":"false","rua.ueh":"false","rua.ieh.st":"0"}]);</script> <script>!function(e){var n="https://s.go-mpulse.net/boomerang/";if("False"=="True")e.BOOMR_config=e.BOOMR_config||{},e.BOOMR_config.PageParams=e.BOOMR_config.PageParams||{},e.BOOMR_config.PageParams.pci=!0,n="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="LJA84-589LU-SVNVV-WKPLQ-NBTC7",function(){function e(){if(!o){var e=document.createElement("script");e.id="boomr-scr-as",e.src=window.BOOMR.url,e.async=!0,i.parentNode.appendChild(e),o=!0}}function t(e){o=!0;var n,t,a,r,d=document,O=window;if(window.BOOMR.snippetMethod=e?"if":"i",t=function(e,n){var t=d.createElement("script");t.id=n||"boomr-if-as",t.src=window.BOOMR.url,BOOMR_lstart=(new Date).getTime(),e=e||d.body,e.appendChild(t)},!window.addEventListener&&window.attachEvent&&navigator.userAgent.match(/MSIE [67]\./))return window.BOOMR.snippetMethod="s",void t(i.parentNode,"boomr-async");a=document.createElement("IFRAME"),a.src="about:blank",a.title="",a.role="presentation",a.loading="eager",r=(a.frameElement||a).style,r.width=0,r.height=0,r.border=0,r.display="none",i.parentNode.appendChild(a);try{O=a.contentWindow,d=O.document.open()}catch(_){n=document.domain,a.src="javascript:var d=document.open();d.domain='"+n+"';void(0);",O=a.contentWindow,d=O.document.open()}if(n)d._boomrl=function(){this.domain=n,t()},d.write("<bo"+"dy onload='document._boomrl();'>");else if(O._boomrl=function(){t()},O.addEventListener)O.addEventListener("load",O._boomrl,!1);else if(O.attachEvent)O.attachEvent("onload",O._boomrl);d.close()}function a(e){window.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!window.BOOMR||!window.BOOMR.version&&!window.BOOMR.snippetExecuted){window.BOOMR=window.BOOMR||{},window.BOOMR.snippetStart=(new Date).getTime(),window.BOOMR.snippetExecuted=!0,window.BOOMR.snippetVersion=12,window.BOOMR.url=n+"LJA84-589LU-SVNVV-WKPLQ-NBTC7";var i=document.currentScript||document.getElementsByTagName("script")[0],o=!1,r=document.createElement("link");if(r.relList&&"function"==typeof r.relList.supports&&r.relList.supports("preload")&&"as"in r)window.BOOMR.snippetMethod="p",r.href=window.BOOMR.url,r.rel="preload",r.as="script",r.addEventListener("load",e),r.addEventListener("error",function(){t(!0)}),setTimeout(function(){if(!o)t(!0)},3e3),BOOMR_lstart=(new Date).getTime(),i.parentNode.appendChild(r);else t(!1);if(window.addEventListener)window.addEventListener("load",a,!1);else if(window.attachEvent)window.attachEvent("onload",a)}}(),"".length>0)if(e&&"performance"in e&&e.performance&&"function"==typeof e.performance.setResourceTimingBufferSize)e.performance.setResourceTimingBufferSize();!function(){if(BOOMR=e.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var n=""=="true"?1:0,t="",a="bdpnbeqxgy4iaz2mkmcq-f-1ae2f1c3b-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,o={"ak.v":"39","ak.cp":"1340666","ak.ai":parseInt("807181",10),"ak.ol":"0","ak.cr":3,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"24659404","ak.r":37669,"ak.a2":n,"ak.m":"a","ak.n":"essl","ak.bpcip":"8.222.208.0","ak.cport":58352,"ak.gh":"23.53.33.228","ak.quicv":"","ak.tlsv":"tls1.2","ak.0rtt":"","ak.0rtt.ed":"","ak.csrc":"-","ak.acc":"reno","ak.t":"1733055237","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==+KFfsHTiFxfcNOH7B69mZ+WTYJGrLXsP7oFlGf2JkCSEji1QD5ZyoZ0w+LmIfOI6xsurD5FQxDOBhCVxjM52FvRdDfs/Ns8mK6+1khZdpkeWC96uQ1lMHCepL2WfL5eof+GydKKM/DwsYpeHVAzCuXrtDucAzgMnjjG3XDrikg/aNfKOSAxKjBXQZiaos3xCFELHwk1dbMLkWZeeYarTRpOpniIDz8/rvrOEPxx35lpXftgDB6B84zBNSj0BmotdTQmW18vy826D57D8dM7GnovWNMbcq0th8F5Sfh7/fyiEm5mM7kpKxFISxHYclCUX2Pdh6Lcu+egIEiZtjQVfaUV2ECdMA+t1GIVrkHCYrehODAXuDq3o0mQVp+SBHNkSHfan1NRTEjRvVz/SHCTDFAkQ21vwXXdJo86curxC/DI=","ak.pv":"34","ak.dpoabenc":"","ak.tf":i};if(""!==t)o["ak.ruds"]=t;var r={i:!1,av:function(n){var t="http.initiator";if(n&&(!n[t]||"spa_hard"===n[t]))o["ak.feo"]=void 0!==e.aFeoApplied?1:0,BOOMR.addVar(o)},rv:function(){var e=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.0rtt.ed","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(e)}};BOOMR.plugins.AK={akVars:o,akDNSPreFetchDomain:a,init:function(){if(!r.i){var e=BOOMR.subscribe;e("before_beacon",r.av,null,null),e("onbeacon",r.rv,null,null),r.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head> <body class="articlepage page basicpage context-business">  <a id="page-scroll" title="VerticalPageScroll" href="javascript:jumpScroll($(this).scrollTop());"> <span class="icon-chevron-up"></span> </a>  <script type="text/javascript"> var utag_data = {"customer_cookie_type":"business","language_code":"en_us","page_name":"research/20/e/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/en_us","category_id":"en_us/research/20/e/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability","page_type":"unknown","site_section":"research","post_author":"Gabrielle Joyce Mabutas|Threats Analyst,Fujisawa Kazuki|Sr. Security Specialist","post_date":"2020-05-11"}; </script> <script type="text/javascript"> window.adobeDigitalData = typeof(window.adobeDigitalData) != "undefined" ? window.adobeDigitalData : []; window.adobeDigitalData.push( {"pageID":"fa08d6008335","articleTitle":"Lazarus\u2019 MacOS Dacls RAT Shows Multi-Platform Ability","description":"We found an application sample in April called TinkaOTP, and our investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor discovered in December 2019.","thumbnailUrl":"/content/dam/trendmicro/global/en/research/20/e/lazarus-macos-dacls-rat-2/new-macos-dacls-rat-641.jpg","pageUrl":"https://www.trendmicro.com/en_us/research/20/e/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability.html","publishedDate":"2020-05-11","pageTag":"malware","pageSection":"research"} ); </script> <script type="text/javascript">(function(a,b,c,d){a='//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js';b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);})();</script> <div class="businessHeaderV1"> <div class="headerAssemblyV1"> <header class="page-header"> <nav> <div class="header-bar"> <div class="logo"> <a id="header-logo" href="/en_us/business.html"> <img src="/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg"/> <p>Business</p> </a> </div> <div class="inner-nav-wrapper"> <span class="material-symbols-outlined search-icon">search</span> <span class="material-symbols-outlined close-search-icon">close</span> <input type="checkbox" id="checkbox" class="hamburger-menu"/> <div aria-label="Menu" class="hamburger"></div> </div> </div> <div class="hamburger-wrapper"> <div class="mainNavMenuV1"><div class="mainNavMenu mainNavMenuV1"> <div class="list-wrapper inital-list-wrapper"> <ul class="menu nav-level-0"> <li>  <div class="label">Solutions</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Challenge</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/cyber-risk.html">Understand, Prioritize & Mitigate Risks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Understand, Prioritize & Mitigate Risks</div> <p class="copy">Improve your risk posture with attack surface management</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cyber-risk.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Protect Cloud-Native Apps</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Cloud-Native Apps</div> <p class="copy">Security that enables business outcomes</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Protect Your Hybrid World</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Protect Your Hybrid, Multi-Cloud World</div> <p class="copy">Gain visibility and meet business needs with security</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/infrastructure-security.html">Securing Your Borderless Workforce</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Securing Your Borderless Workforce</div> <p class="copy">Connect with confidence from anywhere, on any device</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/infrastructure-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/network-security.html">Eliminate Network Blind Spots</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Eliminate Network Blind Spots</div> <p class="copy">Secure users and key operations throughout your environment</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/network-security.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/detection-response.html">See More. Respond Faster.</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">See More. Respond Faster.</div> <p class="copy">Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/detection-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/managed-services.html">Extend Your Team</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Extend Your Team. Respond to Threats Agilely</div> <p class="copy">Maximize effectiveness with proactive risk reduction and managed services</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/managed-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/challenges/zero-trust.html">Operationalizing Zero Trust</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Operationalizing Zero Trust</div> <p class="copy">Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/zero-trust.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Role</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/ciso.html">CISO</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">CISO</div> <p class="copy">Drive business value with measurable cybersecurity outcomes</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/ciso.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/soc.html">SOC Manager</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">SOC Manager</div> <p class="copy">See more, act faster</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/soc.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Infrastructure Manager</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Infrastructure Manager</div> <p class="copy">Evolve your security to mitigate threats quickly and effectively</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/cloud-developer.html">Cloud Builder and Developer</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Builder and Developer</div> <p class="copy">Ensure code runs only as intended</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-developer.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/role/cloud-operations.html">Cloud Security Ops</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Cloud Security Ops</div> <p class="copy">Gain visibility and control with security designed for cloud environments</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-operations.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">By Industry</div> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for/healthcare.html">Healthcare</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Healthcare</div> <p class="copy">Protect patient data, devices, and networks while meeting regulations</p> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/healthcare.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Manufacturing</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Manufacturing</div> <p class="copy">Protecting your factory environments – from traditional devices to state-of-the-art infrastructures</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Oil & Gas</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Oil & Gas</div> <p class="copy">ICS/OT Security for the oil and gas utility industry</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Electric Utility</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Electric Utility</div> <p class="copy">ICS/OT Security for the electric utility</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/capabilities/solutions-for/federal-government.html">Federal</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Federal</div> <a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/federal-government.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Automotive</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Automotive</div> <a class="leaf-button color-d71920" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">5G Networks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Networks</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/small-business/platform.html">Small & Midsized Business Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Small & Midsized Business Security</div> <p class="copy">Stop threats with easy-to-use solutions designed for your growing business</p> <a class="leaf-button color-d71920" href="/en_us/small-business/platform.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Platform</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/one-platform.html" id="b-nav-platform-1">Vision One Platform</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/one-platform.html" id="b-nav-platform-2">Vision One Platform</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One</div> <div class="title">Our Unified Platform</div> <p class="copy">Bridge threat protection and cyber risk management</p> <a class="leaf-button color-d71920" href="/en_us/business/products/one-platform.html" id="b-nav-platform-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/technologies/ai-companion.html" id="b-nav-companion-2">AI Companion</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Vision One Companion</div> <p class="copy">Your generative AI cybersecurity assistant</p> <a class="leaf-button color-d71920" href="/en_us/business/technologies/ai-companion.html" id="b-nav-companion-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/attack-surface-management.html" id="b-nav-attack-surface-mgmnt-1">Attack Surface Management</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Attack Surface Management</div> <p class="copy">Stop breaches before they happen</p> <a class="leaf-button color-d71920" href="/en_us/business/products/attack-surface-management.html" id="b-nav-attack-surface-mgmnt-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-xdr-1">XDR (Extended Detection & Response)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR (Extended Detection & Response)</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-xdr-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-1">Cloud Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-2">Cloud Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Cloud Security Overview</div> <p class="copy">The most trusted cloud security platform for developers, security teams, and businesses</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud.html" id="b-nav-cloud-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/attack-surface-management.html" id="b-nav-sub-asrm-cloud-2">Attack Surface Risk Management for Cloud</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Attack Surface Risk Management for Cloud</div> <p class="copy">Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one</p> <a class="leaf-button color-d71920" href="/en_us/business/products/attack-surface-management.html" id="b-nav-sub-asrm-cloud-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-cloud-2">XDR for Cloud</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Cloud</div> <p class="copy">Extend visibility to the cloud and streamline SOC investigations</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-cloud-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2">Workload Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Workload Security</div> <p class="copy">Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html" id="b-nav-sub-container-sec-2">Container Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Container Security</div> <p class="copy">Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html" id="b-nav-sub-container-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html" id="b-nav-sub-file-sec-2">File Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">File Security</div> <p class="copy">Protect application workflow and cloud storage against advanced threats</p> <a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html" id="b-nav-sub-file-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-1">Endpoint Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-2">Endpoint Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Endpoint Security Overview</div> <p class="copy">Defend the endpoint through every stage of an attack</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security.html" id="b-nav-endpoint-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-endpoint-2">XDR for Endpoint</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Endpoint</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-endpoint-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2">Workload Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Workload Security</div> <p class="copy">Optimized prevention, detection, and response for endpoints, servers, and cloud workloads</p> <a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html" id="b-nav-sub-workload-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-endpoint-security.html" id="b-nav-sub-industrial-endpoint-sec-2">Industrial Endpoint Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Endpoint Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-endpoint-security.html" id="b-nav-sub-industrial-endpoint-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html" id="b-nav-sub-mobile-sec-2">Mobile Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Mobile Security</div> <p class="copy">On-premises and cloud protection against malware, malicious applications, and other mobile threats</p> <a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html" id="b-nav-sub-mobile-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/network.html" id="b-nav-network-security-1">Network Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network.html" id="b-nav-network-security-2">Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Security Overview</div> <p class="copy">Expand the power of XDR with network detection and response</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network.html" id="b-nav-network-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-network-2">XDR for Network</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for Network</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-network-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/intrusion-prevention.html" id="b-nav-sub-intrusion-prevention-2">Network Intrusion Prevention (IPS)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Network Intrusion Prevention (IPS)</div> <p class="copy">Protect against known, unknown, and undisclosed vulnerabilities in your network</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention.html" id="b-nav-sub-intrusion-prevention-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/advanced-threat-protection.html" id="b-nav-sub-breach-detection-2">Breach Detection System (BDS)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Breach Detection System (BDS)</div> <p class="copy">Detect and respond to targeted attacks moving inbound, outbound, and laterally</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/advanced-threat-protection.html" id="b-nav-sub-breach-detection-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/network/zero-trust-secure-access.html" id="b-nav-sub-secure-service-edge-2">Secure Service Edge (SSE)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Secure Service Edge (SSE)</div> <p class="copy">Redefine trust and secure digital transformation with continuous risk assessments</p> <a class="leaf-button color-d71920" href="/en_us/business/products/network/zero-trust-secure-access.html" id="b-nav-sub-secure-service-edge-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html" id="b-nav-sub-5g-network-sec-2">5G Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">5G Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html" id="b-nav-sub-5g-network-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2">Industrial Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/products/email-security.html" id="b-nav-email-security-1">Email Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/email-security.html" id="b-nav-email-security-2">Email Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Email Security</div> <p class="copy">Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise</p> <a class="leaf-button color-d71920" href="/en_us/business/products/email-security.html" id="b-nav-email-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html" id="b-nav-sub-email-collaboration-2">Email and Collaboration Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="subtitle">Trend Vision One™</div> <div class="title">Email and Collaboration Security</div> <p class="copy">Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace</p> <a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html" id="b-nav-sub-email-collaboration-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-1">OT Security</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-2">OT Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">OT Security</div> <p class="copy">Learn about solutions for ICS / OT security.</p> <a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html" id="b-nav-ot-security-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-ot-2">XDR for OT</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">XDR for OT</div> <p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p> <a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html" id="b-nav-sub-xdr-ot-2-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2">Industrial Network Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Network Security</div> <a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html" id="b-nav-sub-industrial-network-sec-2-cta">Industrial Network Security</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security" id="b-nav-sub-industrial-endpoint-sec-2">Industrial Endpoint Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industrial Endpoint Security</div> <a class="leaf-button color-d71920" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security" id="b-nav-sub-industrial-endpoint-sec-2-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/one-platform/threat-insights.html" id="b-nav-threat-insights-1">Threat Insights</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Threat Insights</div> <p class="copy">See threats coming from miles away</p> <a class="leaf-button color-d71920" href="/en_us/business/products/one-platform/threat-insights.html" id="b-nav-threat-insights-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/identity.html" id="b-nav-identity-security-1">Identity Security</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Identity Security</div> <p class="copy">End-to-end identity security from identity posture management to detection and response</p> <a class="leaf-button color-d71920" href="/en_us/business/products/identity.html" id="b-nav-identity-security-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products/sovereign-private-cloud.html" id="b-nav-on-prem-1">On-Premises Data Sovereignty</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">On-Premises Data Sovereignty</div> <p class="copy">Prevent, detect, respond and protect without compromising data sovereignty</p> <a class="leaf-button color-d71920" href="/en_us/business/products/sovereign-private-cloud.html" id="b-nav-on-prem-1-cta">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/products.html" id="b-nav-all-products-1">All Products, Services, and Trials</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">All Products, Services, and Trials</div> <a class="leaf-button color-d71920" href="/en_us/business/products.html" id="b-nav-all-products-1-cta">Learn more</a> </div> <div class="leaf-image"> <img src="https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Research</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/threat-research.html">Research</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/threat-research.html">Research</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research</div> <a class="leaf-button color-d71920" href="/en_us/about/threat-research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/research.html">Research, News, and Perspectives</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research, News, and Perspectives</div> <a class="leaf-button color-d71920" href="/en_us/research.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Research and Analysis</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Research and Analysis</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Security News</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security News</div> <a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Zero Day Initiatives (ZDI)</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Zero Day Initiatives (ZDI)</div> <a class="leaf-button color-d71920" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li>  <div class="label">Services</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Our Services</div> <a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/service-one.html">Service Packages</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Service Packages</div> <p class="copy">Augment security teams with 24/7/365 managed detection, response, and support</p> <a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/managed-xdr.html">Managed XDR</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed XDR</div> <p class="copy">Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks</p> <a class="leaf-button color-d71920" href="/en_us/business/services/managed-xdr.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a> </div> <ul class="branch nav-item-3">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Incident Response</div> <p class="copy">Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans</p> <a class="leaf-button color-d71920" href="/en_us/business/services/incident-response.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/incident-response/insurance-law.html">Insurance Carriers and Law Firms</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Insurance Carriers and Law Firms</div> <p class="copy">Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs</p> <a class="leaf-button color-d71920" href="/en_us/business/services/incident-response/insurance-law.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/services/support-services.html">Support Services</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Support Services</div> <a class="leaf-button color-d71920" href="/en_us/business/services/support-services.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> <li>  <div class="label">Partners</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/program.html">Partner Program</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program.html">Partner Program</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Program Overview</div> <p class="copy">Grow your business and protect your customers with the best-in-class complete, multilayered security</p> <a class="leaf-button color-d71920" href="/en_us/partners/program.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/competencies.html">Partner Competencies</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Competencies</div> <p class="copy">Stand out to customers with competency endorsements that showcase your expertise</p> <a class="leaf-button color-d71920" href="/en_us/partners/competencies.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/partner-stories.html">Partner Successes</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Successes</div> <a class="leaf-button color-d71920" href="/en_us/partners/partner-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program/managed-security-service-provider.html">Managed Security Service Provider</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Security Service Provider</div> <p class="copy">Deliver modern security operations services with our industry-leading XDR</p> <a class="leaf-button color-d71920" href="/en_us/partners/program/managed-security-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/program/managed-service-provider.html">Managed Service Provider</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Managed Service Provider</div> <p class="copy">Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs</p> <a class="leaf-button color-d71920" href="/en_us/partners/program/managed-service-provider.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Alliance Partners</div> <p class="copy">We work with the best to help you optimize performance and value</p> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners/technology.html">Technology Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Technology Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/technology.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Find Alliance Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Alliance Partners</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/partners/resources.html">Partner Resources</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/resources.html">Partner Resources</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Resources</div> <p class="copy">Discover resources designed to accelerate your business’s growth and enhance your capabilities as a Trend Micro partner</p> <a class="leaf-button color-d71920" href="/en_us/partners/resources.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Partner Portal Login</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Partner Portal Login</div> <a class="leaf-button color-d71920" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Login</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/campus.html">Trend Campus</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Campus</div> <p class="copy">Accelerate your learning with Trend Campus, an easy-to-use education platform that offers personalized technical guidance</p> <a class="leaf-button color-d71920" href="/en_us/partners/campus.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/co-selling.html">Co-Selling</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Co-Selling</div> <p class="copy">Access collaborative services designed to help you showcase the value of Trend Vision One™ and grow your business</p> <a class="leaf-button color-d71920" href="/en_us/partners/co-selling.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://trendmicro.my.site.com/Gpartner/s/partner-registration?language=en_US" target="_blank" rel="noopener noreferrer">Become a Partner</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Become a Partner</div> <a class="leaf-button color-d71920" href="https://trendmicro.my.site.com/Gpartner/s/partner-registration?language=en_US" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/distributors.html">Distributors</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Distributors</div> <a class="leaf-button color-d71920" href="/en_us/partners/distributors.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Find Partners</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Find Partners</div> <p class="copy">Locate a partner from whom you can purchase Trend Micro solutions</p> <a class="leaf-button color-d71920" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li>  <div class="label">Company</div> <ul class="sub-menu nav-level-1"> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Why Trend Micro</div> <a class="leaf-button color-d71920" href="/en_us/about/why-trend-micro.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/customer-stories.html">Customer Success Stories</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Customer Success Stories</div> <a class="leaf-button color-d71920" href="/en_us/about/customer-stories.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/content/trendmicro/en_us/about/human-connections">The Human Connection</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">The Human Connection</div> <a class="leaf-button color-d71920" href="/content/trendmicro/en_us/about/human-connections">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/industry-recognition.html">Industry Accolades</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Industry Accolades</div> <a class="leaf-button color-d71920" href="/en_us/about/industry-recognition.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/partners/alliance-partners.html">Strategic Alliances</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Strategic Alliances</div> <a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about/compare.html">Compare Trend Micro</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare.html">Compare Trend Micro</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Compare Trend Micro</div> <p class="copy">See how Trend outperforms the competition</p> <a class="leaf-button color-d71920" href="/en_us/about/compare.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-crowdstrike.html">vs. Crowdstrike</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Crowdstrike</div> <p class="copy">Crowdstrike provides effective cybersecurity through its cloud-native platform, but its pricing may stretch budgets, especially for organizations seeking cost-effective scalability through a true single platform</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-crowdstrike.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-microsoft.html">vs. Microsoft</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Microsoft</div> <p class="copy">Microsoft offers a foundational layer of protection, yet it often requires supplemental solutions to fully address customers' security problems</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-microsoft.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/compare/trend-vs-palo-alto-networks.html">vs. Palo Alto Networks</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trend Micro vs. Palo Alto Networks</div> <p class="copy">Palo Alto Networks delivers advanced cybersecurity solutions, but navigating its comprehensive suite can be complex and unlocking all capabilities requires significant investment</p> <a class="leaf-button color-d71920" href="/en_us/about/compare/trend-vs-palo-alto-networks.html">Let's go</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="/en_us/about.html">About Us</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about.html">About Us</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">About Us</div> <a class="leaf-button color-d71920" href="/en_us/about.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/trust-center.html">Trust Center</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Trust Center</div> <a class="leaf-button color-d71920" href="/en_us/about/trust-center.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/history-vision-values.html">History</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">History</div> <a class="leaf-button color-d71920" href="/en_us/about/history-vision-values.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/diversity-inclusion.html">Diversity, Equity and Inclusion</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Diversity, Equity and Inclusion</div> <a class="leaf-button color-d71920" href="/en_us/about/diversity-inclusion.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/corporate-social-responsibility.html">Corporate Social Responsibility</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Corporate Social Responsibility</div> <a class="leaf-button color-d71920" href="/en_us/about/corporate-social-responsibility.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/leaders.html">Leadership</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Leadership</div> <a class="leaf-button color-d71920" href="/en_us/about/leaders.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/leading-experts.html">Security Experts</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Security Experts</div> <a class="leaf-button color-d71920" href="/en_us/about/leading-experts.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/initiative-education.html">Internet Safety and Cybersecurity Education</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Internet Safety and Cybersecurity Education</div> <a class="leaf-button color-d71920" href="/en_us/initiative-education.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/legal.html">Legal</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Legal</div> <a class="leaf-button color-d71920" href="/en_us/about/legal.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Investors</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Investors</div> <a class="leaf-button color-d71920" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/business/campaigns/formula-e.html">Formula E Racing</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Formula E Racing</div> <a class="leaf-button color-d71920" href="/en_us/business/campaigns/formula-e.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> <li> <div class="label branch"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="branch nav-item-2">  <li> <div class="label leaf"> <a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect With Us</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Connect With Us</div> <a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="https://newsroom.trendmicro.com/">Newsroom</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Newsroom</div> <a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/events.html">Events</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Events</div> <a class="leaf-button color-d71920" href="/en_us/about/events.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/careers.html">Careers</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Careers</div> <a class="leaf-button color-d71920" href="/en_us/about/careers.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> <li> <div class="label leaf"> <a class="menu-link" href="/en_us/about/webinars.html">Webinars</a> </div> <ul class="leaf nav-item-leaf">  <li class="desktop-leaf-child"> <div class="desktop-leaf-child-text"> <div class="title">Webinars</div> <a class="leaf-button color-d71920" href="/en_us/about/webinars.html">Learn more</a> </div> <div class="leaf-image"> </div> </li> </ul> </li> </ul> </li> </ul> </li> </ul> </div> <div class="list-wrapper drop-down-menu-2"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-3"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-4"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="list-wrapper drop-down-menu-5"> <button type="button" class="back-one-level"> <span>Back</span> </button> <div class="sub-menu-wrapper"></div> </div> <div class="buttonArrayV1"> <ul class="button-array small left-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button secondary color-ffffff normal" id="rsg-nav-free-trial-a34d5e" href="/en_us/business/products/trials.html"> Free Trials </a> </li> <li class="button-array-list"> <a class="button primary color-d71920 normal" id="rsh-nav-contact-us-b93ab0" href="/en_us/business/get-info-form.html"> Contact Us </a> </li> </ul> </div> </div> </div> <div class="consumerLink"> <a href="/en_us/forHome.html">Looking for home solutions?</a> </div> <a href="https://resources.trendmicro.com/GLB-Under-Attack-Form.html" class="under-attack-link">Under Attack?</a> <div class="alerts"> <div class="alertUtilityMenu"> <div class="utility-wrapper alert-top-menu"> <div class="dropDownMenuV1"> <div class="label"><span class="counter">1</span> Alerts</div> <div class="menu"></div> </div> </div> <div class="utility-wrapper alert-sub-menu"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-wrapper-content"> <div class="alerts-wrapper"> <div class="alert-buttons"> <div class="alerts-unread-button is-active">Unread</div> <div class="alerts-all-button">All</div> </div> <div class="sub-alerts-wrapper"></div> </div> <ul class="alerts-list"> <li id="alert-61020d" class="unread"> <div class="copy-wrapper">  <a href="https://resources.trendmicro.com/AWSreInvent.html" target="_blank" rel="noopener noreferrer"> <p class="copy">Join us at AWS re:Invent for demos and expert-led sessions on AI-powered security.</p> </a> <span class="material-symbols-outlined">close</span> </div>  <a href="https://resources.trendmicro.com/AWSreInvent.html" target="_blank" rel="noopener noreferrer"> <p class="ctaText">Supercharge your security ></p> </a> </li> </ul> </div> </div> </div> </div> <div class="utilityMenuV1"><div class="utilityMenu utilityMenuV1"> <div class="utility-wrapper standard-utility-wrapper"> <div class="dropDownMenuV1"> <div class="label">Support</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Business Support Portal </a> </li> <li> <a href="/en_us/business/services/support-services/education.html"> Education and Certification </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/contactus/" target="_blank"> Contact Support </a> </li> <li> <a rel="noopener noreferrer" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank"> Find a Support Partner </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Resources</div> <div class="menu"> <ul> <li> <a href="/en_us/business/ai.html"> AI Security </a> </li> <li> <a href="/en_us/about/compare.html"> Trend Micro vs. Competition </a> </li> <li> <a href="https://resources.trendmicro.com/security-assessment-service-us.html?_ga=2.66788462.1559035223.1729522833-1050444116.1727452407"> Cyber Risk Assessments </a> </li> <li> <a href="/en_us/what-is.html"> What Is? </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/"> Threat Encyclopedia </a> </li> <li> <a href="/en_us/business/capabilities/solutions-for/cyber-insurance.html"> Cyber Insurance </a> </li> <li> <a href="https://www.trendmicro.com/vinfo/us/security/definition/a"> Glossary of Terms </a> </li> <li> <a href="/en_us/about/webinars.html"> Webinars </a> </li> </ul> </div> </div> <div class="dropDownMenuV1"> <div class="label">Log In</div> <div class="menu"> <ul> <li> <a rel="noopener noreferrer" href="https://signin.v1.trendmicro.com/" target="_blank"> Vision One </a> </li> <li> <a rel="noopener noreferrer" href="https://success.trendmicro.com/en-US/" target="_blank"> Support </a> </li> <li> <a rel="noopener noreferrer" href="https://community-trendmicro.force.com/Gpartner/s/login/?language=en_US&ec=302&startURL=%2FGpartner%2Fs%2F" target="_blank"> Partner Portal </a> </li> <li> <a rel="noopener noreferrer" href="https://cloudone.trendmicro.com/" target="_blank"> Cloud One </a> </li> <li> <a rel="noopener noreferrer" href="https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php" target="_blank"> Product Activation and Management </a> </li> <li> <a rel="noopener noreferrer" href="https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t" target="_blank"> Referral Affiliate </a> </li> </ul> </div> </div> </div> <div class="utility-wrapper active-utility-wrapper"> <button type="button" class="back-one-level-utility"> <span>Back</span> </button> <div class="sub-utility-wrapper"></div> </div> </div> </div> </div> </nav> </header> <div class="search"> <script type="text/javascript" src="//customer.cludo.com/scripts/bundles/search-script.js"></script> <script type="text/javascript"> var cludoSettings = {}; if( undefined === window.utag_data ) { cludoSettings.cludo_language = 'en'; } else { switch (window.utag_data.language_code) { // Cludo dropped the ball on this one case 'ja_jp': cludoSettings.cludo_language = 'jp'; break; case 'in_id': cludoSettings.cludo_language = 'id'; break; default: cludoSettings.cludo_language = window.utag_data.language_code.substring(0, 2); // First two letters are the language break; } } cludoSettings.settingsObject = { customerId: 296, engineId: 1798, searchUrl: "/en_us/common/cse.html", searchInputs: ["cludo-search-form","cludo-search-form-mobile","cludo-search-content-form"], initSearchBoxText: "", language: cludoSettings.cludo_language, //endlessScroll: {stopAfterPage:3, resultsPerPage:10, bottomOffset: 145}, //translateSearchTemplates: true, loading: "<div class='loader'></div>" }; </script> <span class="material-symbols-outlined search-back-arrow">arrow_back</span> <div class="inner-search-wrap"> <span class="material-symbols-outlined search-icon">search</span> <form class="main-menu-search" aria-label="Search Trend Micro"> <div class="main-menu-search__field-wrapper" id="cludo-search-form"> <table class="gsc-search-box"> <tbody> <tr> <td class="gsc-input"> <input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search"/> </td> </tr> </tbody> </table> </div> </form> <span class="material-symbols-outlined search-clear-button">close</span> </div> </div> </div> <section class="folder-indicators slider"> <div class="folder-indicators__wrapper"> <p class="folder-indicators__title">Content has been added to your Folio</p> <div class="folder-indicators__button-wrapper"> <button class="folder-indicators__button counter" id="counter-folder"> Go to Folio (<span>0</span>) </button> <button class="folder-indicators__button close"><span class="material-symbols-outlined close-folio-message">close</span></button> </div> </div> </section></div> <div class="root responsivegrid"> <div class="aem-Grid aem-Grid--12 aem-Grid--default--12 "> <div class="articleBodyNoHero aem-GridColumn aem-GridColumn--default--12"><div class="research-layout article container" role="contentinfo"> <article class="research-layout--wrapper row" data-article-pageID="260029342"> <div class="col-xs-12 col-md-12 one-column"> <div class="col-xs-12 col-md-12"> <div class="article-details" role="heading"> <span class="article-details__bar" role="img"></span> <p class="article-details__display-tag">Malware</p> <h1 class="article-details__title">Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability</h1> <p class="article-details__description">We found an application sample in April called TinkaOTP, and our investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor discovered in December 2019.</p> <p class="article-details__author-by">By: Gabrielle Joyce Mabutas, Fujisawa Kazuki <time class="article-details__date">May 11, 2020</time> <span>Read time: </span><span class="eta"></span> (<span class="words"></span> words) </p> <div class="article-details__icons">  <div class="a2a_kit a2a_default_style" data-a2a-icon-color="#717172"> <a class="a2a_dd addthis_link" href="https://www.addtoany.com/share"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg" class="svg-icon" alt="Share"/> </a> <a class="a2a_button_print addthis_link"> <img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg" class="svg-icon" alt="Print"/> </a> </div>  <div class="add-to-folio tooltip"> <span class="icon-folio-thin"></span> <div class="right"> <p>Save to Folio</p> <i></i> </div> </div>  <div class="subscribe"> <a class="bs-modal" href="https://resources.trendmicro.com/subscription-us.html" title="Subscribe" data-modal-title="Subscribe" target="target"> <span class="icon-subscribe"></span> <span class="text">Subscribe</span> </a> </div> </div> </div> </div> </div> <hr class="research-layout-divider"/> <main class="main--content col-xs-12 col-lg-8 col-lg-push-2"> <div> </div> <div class="richText"> <div> <p>A one-time password (OTP) system involves the use of a generated password that can only be used once to log in and access specific online services. Often managed by a third-party provider, this rolling password system aims to reduce unauthorized intrusions to systems via compromised accounts.</p> <p>We found an application sample in April called TinkaOTP that seemed like a normal OTP authentication tool. However, further investigation showed the application bearing a striking resemblance to Dacls remote access trojan (RAT), a Windows and Linux backdoor that 360 Netlab <a href="https://blog.netlab.360.com/dacls-the-dual-platform-rat-en/">discovered</a> in December 2019. The strings that the trojan’s command and control (C&C) server uses to communicate with the storage samples links it to previous deployments by the cybercriminal group Lazarus.</p> <p><b><span class="body-subhead-title">The Lazarus link</span></b></p> <p>After running the TinkaOTP application, the sample appeared as a Disk iMaGe (DMG) application bundle meant to be mounted and run. Launching the app initially didn’t reveal any suspicious behavior, but it dropped a hidden file <i>~/Library/.mina</i> in the Library folder, along with a LaunchDaemon <i>/Library/LaunchDaemons/com.aex-loop.agent.plist</i> set to run the hidden file on startup.<a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure1.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure1.png"/></a></p> <p style="text-align: center;">Figure 1. TinkaOTP dropping a hidden file</p> <p>Another comparison showed that the main mach-o executable of the bundle —<i>/Contents/MacOS/TinkaOTP</i> — was a repackaged version of another OTP tool called <a href="https://github.com/MinaOTP/MinaOTP-MAC">MinaOTP</a>, an open-source authentication tool available at GitHub.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig1.jpg"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Fig1.jpg"/></a></p> <p style="text-align: center;">Figure 2. TinkaOTP (left) and MinaOTP (right, image taken from GitHub)</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure3.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure3.png"/></a></p> <p style="text-align: center;">Figure 3. Disassembly of TinkaOTP’s main executable showed direct references to MinaOTP modules, as well as the shell command for copying the malicious hidden file</p> <p>Tracing the origin of the hidden .mina file showed that it is a copy of an included resource, renamed SubMenu.nib, from the application bundle and where the main backdoor functions were contained. It also has the same links to Lazarus’ Windows and Linux predecessors: the presence of the hardcoded strings <i>c_2910.cls</i> and <i>k_3872.cls</i>. Both strings were previously used during C&C communication to the domain thevagabondsatchel[.]com as the sample storage of the cybercriminal group, as reported by 360 Netlab researchers.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure4.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure4.png"/></a></p> <p style="text-align: center;">Figure 4. Strings used to communicate with the C&C</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure5.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure5.png"/></a></p> <p style="text-align: center;">Figure 5. Same HTTP Post message format as Windows and Linux backdoor discovered</p> <p>We also found another variant with an executable that drops the main backdoor payload. The SubMenu.nib is nowhere to be found, but it downloads the payload from a hardcoded address and extracts it into the hidden payload to be run. A look into the address, loneeaglerecords[.]com, revealed that the domain has been registered and existing for 11 years, but the issued HTTPS certificate is fairly recent. The domain is assigned to 50[.]87[.]144[.]227, an IP investigated to have hosted different kinds of Windows malware such as ADWIND and URSNIF. Despite the differences, the hidden payload downloaded is the same in both variants.</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure6.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure6.png"/></a></p> <p style="text-align: center;">Figure 6. Payload address of another variant</p> <p>The group appeared to have made this version as a quick follow-up to the Windows/Linux Dacls RAT variants. This was confirmed by matching the latest IP assignment and HTTP certificate from the download address of the new variant.</p> <p><b><span class="body-subhead-title">Backdoor and persistence routines</span></b></p> <p>The backdoor installation sequence shows that it’s meant for persistence via <i>/LaunchAgents/com.aex-loop.agent.plist </i>and <i>/Library/LaunchDaemons/com.aex-loop.agent.plist</i>. It initiates the configuration file <i>/Library/Caches/com.applestore.db</i> to set the C&C server IP and for remote session information. Loading the bot plugins, this enables connection to the server to open and wait for commands, update the configuration file based on the commands received, and encrypt the file via AES CBC. If the configuration file already exists, it will decrypt once a new session starts.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure7.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure7.png"/></a></p> <p style="text-align: center;">Figure 7. Related code disassembly for persistence</p> <p>Once installed, it checks if an existing configuration file exists. If not, it creates a config file and writes data related to the setup such as C&C server addresses and other C&C session information. The initial C&C server IPs — 67[.]43[.]239[.]146 and 185[.]62[.]58[.]207 — the bot connects to are hardcoded in the backdoor file and written to the config file. The config file will then be dropped as <i>/Library/Caches/com.applestore.db</i> and encrypted. Once completed, the backdoor proceeds to load the plugins responsible for specific functions.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure8.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure8.png"/></a></p> <p style="text-align: center;">Figure 8. Initial server IPs written on the config file. The file may have the IPs rewritten to an updated IP address of a new server.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure9.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure9.png"/></a></p> <p style="text-align: center;">Figure 9. Dropping the config file and encrypting with AES CBC</p> <p>A look into the server IPs also showed that the domain hosts legitimate traffic; blocking the said domains may have side effects for other sites.</p> <p><b><span class="body-subhead-title">Attack routines upon infection</span></b></p> <p>During the initial analysis of the disassembled codes, the strings used to load the IPs and plugins appear to be missing characters. However, a closer inspection of the first characters showed that these strings were intentionally separated — likely an effort to evade detection.</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure10.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure10.png"/></a></p> <p style="text-align: center;">Figure 10. Evading detection</p> <p>After receiving a response from the server, it will check the headers to determine the plugins to run, with each plugin templated to load their respective functions on initialization. Comparing the plugins used for MacOS and its Windows/Linux variants showed some differences and additional capabilities.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure11.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure11.png"/></a></p> <p style="text-align: center;">Figure 11. Scanning headers</p> <div class="responsive-table-wrap"><table border="1" width="100%"> <tbody><tr><td width="141"><p style="text-align: center;"><b>Plugin Name</b></p> </td> <td style="text-align: center;" width="151"><b>String</b></td> <td width="331"><p style="text-align: center;"><b>Functions</b></p> </td> </tr><tr><td width="141">Plugin_CMD</td> <td width="151">/bin/bash</td> <td width="331"><p style="text-align: left;">· Execute received commands</p> <p style="text-align: left;">· Capability of Reverse Shell</p> </td> </tr><tr><td style="text-align: left;" width="141">Plugin_FILE</td> <td width="151">plugin_file</td> <td width="331"><p style="text-align: left;">· Scan directories</p> <p style="text-align: left;">· Download files</p> <p style="text-align: left;">· Open, write, and delete</p> </td> </tr><tr><td width="141">Plugin_PROCESS</td> <td width="151">plugin_process</td> <td width="331"><p style="text-align: left;">· Collect data on running processes</p> <p style="text-align: left;">· Create process</p> <p style="text-align: left;">· Terminate process</p> </td> </tr><tr><td style="text-align: left;" width="141">Plugin_TEST</td> <td width="151">plugin_test</td> <td style="text-align: left;" width="331">· Check network access to specified address issued by server</td> </tr><tr><td width="141">Plugin_RP2Pv</td> <td width="151">plugin_reverse_p2p</td> <td style="text-align: left;" width="331">· Setup network proxy between bot and server</td> </tr><tr><td width="141">Plugin_LOGSEND</td> <td width="151">logsend</td> <td width="331"><p style="text-align: left;">· Connect to log server</p> <p style="text-align: left;">· Scan system</p> <p style="text-align: left;">· Send collected logs</p> </td> </tr><tr><td style="text-align: left;" width="141">PLUGIN_SOCKS</td> <td width="151">plugin_socks</td> <td style="text-align: left;" width="331">· Start Socks4 Thread to setup SSL connection</td> </tr></tbody></table> </div> <p style="text-align: center;">Table 1. Plugin templates and functions</p> <p>The <i>bash/cmd</i> plugin is used for executing shell commands in the form of appending them as a bash script and then running it on the terminal. Based on the arguments set in the packet received, it also has the capability to run a reverse shell.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure12.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure12.png"/></a></p> <p style="text-align: center;">Figure 12. The bash/cmd plugin</p> <p>The <i>file</i> plugin runs the same functions as the Windows and Linux variants: it can read, write, delete, and download files, as well as scan a directory for a specific file.</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure13.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure13.png"/></a></p> <p style="text-align: center;">Figure 13. The file plugin</p> <p>Looking into the arguments shows that the <i>process</i> plugin comes from the received packet to execute functions such as collecting process information, running a new process, and terminating a running one. The process information collected includes the username, user ID, group ID, and process parent ID of the target process.</p> <p>Whereas the other plugins may directly call and execute for the arguments’ function passed by the server, the process plugin differs in that the server indirectly calls the function from the plugin itself; the location of the process plugin functions’ addresses are first called prior to the execution.</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure14.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure14.png"/></a></p> <p style="text-align: center;">Figure 14. The process plugin</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure15.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure15.png"/></a></p> <p style="text-align: center;">Figure 15. Process plugin formatting the collected information before sending</p> <p>The <i>test</i> plugin attempts to connect to a provided address to check access to the network. Meanwhile, the <i>reverse P2P</i> plugin creates a proxy server to bridge the C&C and the client. This creates another connection to another C&C specified in the commands to act as a proxy, redirecting traffic from the infected machine to the real C&C server.</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure16.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure16.png"/></a></p> <p style="text-align: center;">Figure 16. The test plugin</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure17.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure17.png"/></a></p> <p style="text-align: center;">Figure 17. The reverse P2P plugin</p> <p>The <i>logsend</i> plugin collects system information by scanning the system using function <i>start_scan_worm</i> and send data to the log server specified. Meanwhile, the <i>socks</i> plugin creates a connection via socks4 for Secure Sockets Layer-related (SSL) transactions. This plugin was not observed in the Windows/Linux variants.</p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure18.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure18.png"/></a></p> <p style="text-align: center;">Figure 18. The logsend plugin</p> <p style="text-align: center;"><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure_19a.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure_19a.png"/></a></p> <p><a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure_19b.png"><img src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Lazarus-macos-dacls-rat-backdoor_Figure_19b.png"/></a></p> <p style="text-align: center;">Figure 19. The socks plugin</p> <p><b><span class="body-subhead-title">Conclusion</span></b></p> <p>The discovery of the Windows/Linux variants and analysis of this routine has shown Lazarus’ range of expertise. As mentioned in a previous Lazarus <a href="https://blog.trendmicro.com/trendlabs-security-intelligence/mac-backdoor-linked-to-lazarus-targets-korean-users/">discovery</a> involving MacOS, this shift in focus towards attacking multiple operating systems indicate an expansion of targets. It also shows that they’re experimenting for future-related cases, highlighted by the additional plugin that has not been observed in similar routines.</p> <p>To note, shortly after our first discovery of Lazarus’ interest in MacOS in 2019 via poisoned spreadsheets, the group was able to follow up with fileless <a href="https://securelist.com/operation-applejeus-sequel/95596/">AppleJeus</a>, showing a rapid development in research. Related to this routine, the dropper from the first variant’s only implemented evasion method was the use of copying the payload into a hidden file; the second variant improved on this by downloading the payload instead. While considerably not as sophisticated yet, given how the AppleJeus malware quickly followed with a fileless version, we could expect the group to deploy a similar execution of this routine soon.</p> <p>We also suspect that the group may be targeting specific users for bot distribution, taking advantage of users’ needs for layered security. OTP authentication tools have also been used to manage cryptocurrency wallets and exchanges, another common target for fraud by the cybercriminal group. The group might also be expanding to mobile platforms. Considering that the original MinaOTP source contains a separate project called <a href="https://github.com/MinaOTP/MinaOTP-iOS">MinaOTP-iOS</a>, the group might be planning to rebuild a repurposed version of this for mobile. We will continue monitoring Lazarus deployments and activities.</p> <p>To protect systems from this type of threat, users should only download apps from official and legitimate marketplaces. Users can also consider multilayered security solutions such as <a href="/en_us/forHome/products/antivirus-for-mac.html">Trend Micro Antivirus for Mac</a>, which provides comprehensive security and multi-device protection against cyberthreats.</p> <p>Enterprises can take advantage of Trend Micro’s <a href="/en_us/business/products/user-protection/sps.html">Smart Protection Suites</a> with XGen™ security, which infuses high-fidelity <a href="https://www.trendmicro.com/vinfo/tmr/?/us/security/definition/machine-learning">machine learning</a> into a blend of threat protection techniques to eliminate security gaps across any user activity or endpoint. </p> <p><b><span class="body-subhead-title">Indicators of Compromise (IOCs)</span></b></p> <div class="responsive-table-wrap"><table border="1" width="100%"> <tbody><tr><td width="319"><b>SHA256</b></td> <td width="191"><b>Filename</b></td> <td width="114"><b>Detection</b></td> </tr><tr><td width="319">846d8647d27a0d729df40b13a644f3bffdc95f6d0e600f2195c85628d59f1dc6</td> <td width="191">/Contents/Resources/Base.lproj/SubMenu.nib</td> <td width="114">Backdoor.MacOS.DACLS.A</td> </tr><tr><td width="319">d3235a29d254d0b73ff8b5445c962cd3b841f487469d60a02819c0eb347111dd</td> <td rowspan="5" width="191">TinkaOTP.dmg</td> <td rowspan="5" width="114">Backdoor.MacOS.DACLS.A</td> </tr><tr><td width="319">e5b842784cc3e9bc0376915d2d823c3e4e076d29b5fb98ea69ff9a56b0f4a54a</td> </tr><tr><td width="319">216a83e54cac48a75b7e071d0262d98739c840fd8cd6d0b48a9c166b69acd57d</td> </tr><tr><td width="319">7e8a086319a218732dde5a749afdd9813d3047eaeef511e0374ca64fd8d0d033</td> </tr><tr><td width="319">899e66ede95686a06394f707dd09b7c29af68f95d22136f0a023bfd01390ad53</td> </tr><tr><td width="319">fea0bd961d8d72642a3e1cb92b6ac084a9680eaef816ad414e282f6ea87d52c6</td> <td width="191">TinkaOTP.app</td> <td width="114">Backdoor.MacOS.DACLS.A</td> </tr><tr><td width="319">7b8792025aacff5dacb3a9121ec2f5bfa33d5932d1f43b9ad0d518c55c6e1298</td> <td rowspan="2" width="191">/Contents/MacOS/TinkaOTP</td> <td rowspan="2" width="114">Backdoor.MacOS.DACLS.A</td> </tr><tr><td width="319">90fbc26c65e4aa285a3f7ee6ff8a3a4318a8961ebca71d47f51ef0b4b7829fd0</td> </tr></tbody></table> </div> <p><b>URL</b></p> <p>https[://]loneeaglerecords[.]com/wp-content/uploads/2020/01/images[.]tgz.001 Malware accomplice </p> <p><b><span class="body-subhead-title">MITRE ATT&CK Framework</span></b></p> <p>Those highlighted in yellow are characteristics observed during analysis, while those in green are possible actions based on observed C&C server commands. <a href="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Mitre-01.jpg"><img title="MITRE_framework_Lazarus_Dacls_RAT_backdoor_MacOS" src="/content/dam/trendmicro/global/en/migrated/trendlabs-security-intelligence-07/files/2020/05/Mitre-01.jpg"/></a></p> </div> </div> <div class="image"> </div> <div> </div> <section class="tag--list"> <div class="tag--list-title">Tags</div> <div class="tag--list-tags"> <a href="/en_us/research.html?category=trend-micro-research:threats/malware" class="tag--list-anchor">Malware</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_us/research.html?category=trend-micro-research:environments/endpoints" class="tag--list-anchor">Endpoints</a> <span class="tag--list-separator" role="separator">|</span> <a href="/en_us/research.html?category=trend-micro-research:article-type/research" class="tag--list-anchor">Research</a> </div> </section> </main> <sidebar class="sidebar--left col-xs-12 col-lg-2 col-lg-pull-8"> <h3 class="article-authors__title"> Authors </h3>  <ul class="article-authors__list"> <li class="article-authors__list-items"> <div class="article-authors__wrapper" role="contentinfo authors profile"> <p class="article-authors__list-items__name">Gabrielle Joyce Mabutas</p> <p class="article-authors__list-items__position">Threats Analyst</p> </div> </li> <li class="article-authors__list-items"> <div class="article-authors__wrapper" role="contentinfo authors profile"> <p class="article-authors__list-items__name">Fujisawa Kazuki</p> <p class="article-authors__list-items__position">Sr. Security Specialist</p> </div> </li> </ul> <div class="article-authors__btn-wrapper" role="button"> <a class="article-authors__button " href="mailto:tm_research@trendmicro.com" target="target" id="article-authors-contact-us-button"> Contact Us </a> </div> <div class="article-authors__btn-wrapper subscribe-wrapper" role="button"> <a class="article-authors__button subscribe bs-modal" href="https://resources.trendmicro.com/subscription-us.html" data-modal-title="Subscribe" target="target"> Subscribe </a> </div> </sidebar> <sidebar class="sidebar--right col-xs-12 col-lg-2"> <div class="sidebar--wrapper" role="contentinfo sidebar"> <div class="row-1" role="contentinfo related articles"> <div class="related--articles" role="contentinfo related articles"> <h3 class="related--articles-title">Related Articles</h3> <ul class="related--articles-items"> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/24/k/earth-estries.html"> Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"> Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024 </a> </li> <li class="related--articles-item"> <a class="related--articles-item-anchor" href="/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"> Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella </a> </li> </ul> </div> <div class="archived--link"> <div class="archived--link-text"> <a href="/en_us/research.html"> See all articles </a> </div> <div class="archived--link-icon"> <a href="/en_us/research.html"> <span class="icon-chevron-right"></span> </a> </div> </div> </div> </div> </sidebar> </article> </div></div> </div> </div> <div class="footer"> <div class="containerV1"><div class="footer_wrapper footer-wrapper"><div class="containerV1"> <div class="container-content"> <div class="responsiveColumnControlV1 section"> <div class="row global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-2618131e-ca10-4b16-911d-2361d0690ff8"> <div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section"> <div class="createAccount"> <div class="containerV1 section"> <style> @media ( min-width: 1024px ){ #container8399bb10-62c2-4d43-843c-44143e68460e, .container8399bb10-62c2-4d43-843c-44143e68460e { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 1023px ) and ( min-width: 768px ){ #container8399bb10-62c2-4d43-843c-44143e68460e, .container8399bb10-62c2-4d43-843c-44143e68460e { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 767px ){ #container8399bb10-62c2-4d43-843c-44143e68460e, .container8399bb10-62c2-4d43-843c-44143e68460e { height: auto; background-repeat: no-repeat; background-size: cover; } } </style> <div id="container8399bb10-62c2-4d43-843c-44143e68460e" class="container8399bb10-62c2-4d43-843c-44143e68460e container-wrap gray-border global-margin-top-none global-margin-bottom-large global-padding-top-none global-padding-bottom-none rounded-corners-all-20 inner-container-width"> <section> <div class="container-content"> <div class="prod-content"><div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnMobile { display: block; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnMobile { display: block; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnMobile { display: block; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c { gap: 0px 0px; grid-template-columns: 1fr 6fr 1fr; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnMobile { display: block; } #grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-dbb9047a-8ec9-4dc1-8f8a-17557e61e11c"> <div class="grid-spacing-footer-lft hideOnDesktop"> </div> <div class="grid-footer-callout "><div class="text primary-color-white section"> <div id="text-627930629e" class="cmp-text"> <p>Experience our unified platform for free</p> </div> </div> </div> <div class="grid-spacing-footer-rht hideOnDesktop"> </div> </div> </div> <div class="buttonArrayV1 section"> <ul class="button-array small center-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none"> <li class="button-array-list"> <a class="button primary color-ffffff normal" id="footer-free-trial-f1f976" href="/en_us/business/products/trials.html"> Claim your 30-day trial </a> </li> </ul> </div> </div> </div> </section> </div> </div> <div class="footer section"> <ul class="social-media-links"> <li> <a href="https://www.linkedin.com/company/trend-micro/" class="social-icon linkedin" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="LinkedIn" d="M8.8,10.3a1.5,1.5,0,0,1,1.5-1.5H25.295A1.5,1.5,0,0,1,26.8,10.3V25.294A1.5,1.5,0,0,1,25.3,26.8H10.3a1.5,1.5,0,0,1-1.5-1.5Zm7.125,5.359h2.437v1.224a2.793,2.793,0,0,1,2.6-1.337c2.593,0,3.207,1.4,3.207,3.973v4.763H21.55V20.109c0-1.465-.352-2.291-1.245-2.291-1.24,0-1.755.891-1.755,2.291v4.178H15.925Zm-4.5,8.512H14.05V15.55H11.425v8.624Zm3-11.437a1.688,1.688,0,1,1-.507-1.17A1.689,1.689,0,0,1,14.425,12.737Z" transform="translate(-8.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.facebook.com/TrendMicro/" class="social-icon facebook" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Facebook" d="M56.087,8.8A3.28,3.28,0,0,0,52.8,12.087V23.513A3.28,3.28,0,0,0,56.087,26.8H62.28V19.763H60.419V17.229H62.28V15.065c0-1.7,1.1-3.262,3.632-3.262a15.371,15.371,0,0,1,1.784.1l-.06,2.366s-.773-.007-1.617-.007c-.913,0-1.06.421-1.06,1.119v1.85h2.75l-.12,2.533h-2.63V26.8h2.554A3.28,3.28,0,0,0,70.8,23.513V12.087A3.28,3.28,0,0,0,67.513,8.8H56.087Z" transform="translate(-52.8 -8.8)" fill="#020607"/> </svg> </a> </li> <li> <a href="https://twitter.com/trendmicro" class="social-icon twitter" target="_blank" rel="noopener noreferrer">  <svg xmlns="http://www.w3.org/2000/svg" width="19.57" height="20" viewBox="0 0 19.57 20"> <path id="x-logo" d="M11.647,8.469,18.932,0H17.206L10.88,7.353,5.827,0H0L7.64,11.119,0,20H1.726l6.68-7.765L13.743,20H19.57L11.646,8.469ZM9.282,11.217,8.508,10.11,2.349,1.3H5L9.971,8.41l.774,1.107,6.461,9.242H14.555L9.282,11.218Z"/> </svg>     </a> </li> <li> <a href="https://www.instagram.com/trendmicro/" class="social-icon instagram" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18"> <path id="Instagram" d="M146.09,8.854c.959-.044,1.265-.054,3.71-.054s2.751.011,3.71.054a6.631,6.631,0,0,1,2.186.418,4.607,4.607,0,0,1,2.631,2.632,6.641,6.641,0,0,1,.419,2.184c.044.961.054,1.267.054,3.711s-.011,2.751-.054,3.711a6.61,6.61,0,0,1-.419,2.184,4.6,4.6,0,0,1-2.631,2.632,6.626,6.626,0,0,1-2.185.419c-.96.044-1.266.054-3.711.054s-2.751-.011-3.71-.054a6.6,6.6,0,0,1-2.185-.419,4.595,4.595,0,0,1-2.633-2.631,6.643,6.643,0,0,1-.419-2.185c-.044-.961-.054-1.267-.054-3.711s.01-2.751.054-3.71a6.611,6.611,0,0,1,.419-2.186A4.611,4.611,0,0,1,143.9,9.272a6.65,6.65,0,0,1,2.185-.418Zm7.346,1.62c-.949-.043-1.234-.052-3.636-.052s-2.687.009-3.636.052a4.976,4.976,0,0,0-1.673.31,2.972,2.972,0,0,0-1.708,1.708,4.968,4.968,0,0,0-.31,1.671c-.044.949-.053,1.234-.053,3.637s.009,2.688.053,3.637a4.968,4.968,0,0,0,.31,1.671,2.972,2.972,0,0,0,1.708,1.708,4.976,4.976,0,0,0,1.673.31c.949.043,1.232.052,3.636.052s2.688-.009,3.636-.052a4.976,4.976,0,0,0,1.673-.31,2.972,2.972,0,0,0,1.708-1.708,4.968,4.968,0,0,0,.31-1.671c.043-.949.053-1.234.053-3.637s-.01-2.688-.053-3.637a4.968,4.968,0,0,0-.31-1.671,2.972,2.972,0,0,0-1.708-1.708A4.976,4.976,0,0,0,153.436,10.474Zm-4.786,10.1a3,3,0,1,0-1.075-.758A3,3,0,0,0,148.65,20.574Zm-2.121-6.046a4.626,4.626,0,1,1-1.355,3.271A4.634,4.634,0,0,1,146.529,14.529Zm8.924-.666a1.091,1.091,0,0,0,.25-.355,1.1,1.1,0,0,0,.093-.425,1.093,1.093,0,1,0-.343.78Z" transform="translate(-140.8 -8.8)" fill="#020607" fill-rule="evenodd"/> </svg> </a> </li> <li> <a href="https://www.youtube.com/user/TrendMicroInc" class="social-icon youtube" target="_blank" rel="noopener noreferrer"> <svg xmlns="http://www.w3.org/2000/svg" width="24.003" height="16.01" viewBox="0 0 24.003 16.01"> <path id="YouTube" d="M205.9,12.112a2.78,2.78,0,0,0-.765-1.27A3.052,3.052,0,0,0,203.8,10.1c-1.877-.495-9.4-.495-9.4-.495a76.616,76.616,0,0,0-9.39.47,3.156,3.156,0,0,0-1.339.76,2.9,2.9,0,0,0-.777,1.276A29.133,29.133,0,0,0,182.4,17.6a29.058,29.058,0,0,0,.489,5.494,2.818,2.818,0,0,0,.775,1.269,3.094,3.094,0,0,0,1.341.743c1.9.494,9.39.494,9.39.494a76.8,76.8,0,0,0,9.4-.47,3.051,3.051,0,0,0,1.339-.742,2.785,2.785,0,0,0,.765-1.27,28.339,28.339,0,0,0,.5-5.495,26.534,26.534,0,0,0-.5-5.517ZM192,21.029V14.182l6.26,3.424Z" transform="translate(-182.4 -9.6)" fill="#020607"/> </svg> </a> </li> </ul> </div> </div> </div> </div> <div class="col-sm-12 col-xs-12 col-md-8 column"><div class="responsiveColumnControlV1 section"> <div class="row global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-2b3820a3-8bf2-4347-b8ee-0d9b398041e9"> <div class="col-sm-12 col-xs-12 col-md-4 column"> </div> <div class="col-sm-12 col-xs-12 col-md-4 column"> </div> <div class="col-sm-12 col-xs-12 col-md-4 column"> </div> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 { display: grid; gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 { gap: 10px 0px; grid-template-columns: 1fr; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnMobile { display: block; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 { gap: 0px 10px; grid-template-columns: 6fr 6fr 6fr 6fr; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnMobile { display: block; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 3fr; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnMobile { display: block; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 { gap: 0px 10px; grid-template-columns: 3fr 3fr 3fr 4fr; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnMobile { display: block; } #grid-areas-4101ad2c-e131-4143-90ec-2848daa69875 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-4101ad2c-e131-4143-90ec-2848daa69875"> <div class="grid-resources-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Resources</h3> <ul> <li><a href="/en_us/research.html" target="_self" rel="noopener noreferrer">Blog</a></li> <li><a href="https://trendmicro.com/newsroom" target="_blank" rel="noopener noreferrer">Newsroom</a></li> <li><a href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports" target="_self" rel="noopener noreferrer">Threat Reports</a></li> <li><a href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Find a Partner</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-support-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>Support</h3> <ul> <li><a href="https://success.trendmicro.com/en-US/" target="_blank" rel="noopener noreferrer">Business Support Portal</a></li> <li><a href="/en_us/business/get-info-form.html" target="_self" rel="noopener noreferrer">Contact Us</a></li> <li><a href="/en_us/business/products/downloads.html" target="_self" rel="noopener noreferrer">Downloads</a></li> <li><a href="/en_us/business/products/trials.html" target="_self" rel="noopener noreferrer">Free Trials</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-about-tab1 "><div class="footer section"> <div class="footerMenu"> <h3>About Trend</h3> <ul> <li><a href="/en_us/about.html" target="_self" rel="noopener noreferrer">About Us</a></li> <li><a href="/en_us/about/careers.html" target="_self" rel="noopener noreferrer">Careers</a></li> <li><a href="/en_us/contact.html" target="_self" rel="noopener noreferrer">Locations</a></li> <li><a href="/en_us/about/events.html" target="_self" rel="noopener noreferrer">Upcoming Events</a></li> <li><a href="/en_us/about/trust-center.html" target="_self" rel="noopener noreferrer">Trust Center</a></li> <li><a target="_self" rel="noopener noreferrer"></a></li> </ul> </div> </div> </div> <div class="grid-address-tab1 "><div class="reference parbase section"><div class="cq-dd-paragraph"><div class="root responsivegrid"> <div class="aem-Grid aem-Grid--12 aem-Grid--default--12 "> <div class="containerV1 aem-GridColumn aem-GridColumn--default--12"> <style> @media ( min-width: 1024px ){ #container509940bd-e2de-4aba-9870-804b0659505c, .container509940bd-e2de-4aba-9870-804b0659505c { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 1023px ) and ( min-width: 768px ){ #container509940bd-e2de-4aba-9870-804b0659505c, .container509940bd-e2de-4aba-9870-804b0659505c { height: auto; background-repeat: no-repeat; background-size: cover; } } @media ( max-width: 767px ){ #container509940bd-e2de-4aba-9870-804b0659505c, .container509940bd-e2de-4aba-9870-804b0659505c { height: auto; background-repeat: no-repeat; background-size: cover; } } </style> <div id="container509940bd-e2de-4aba-9870-804b0659505c" class="container509940bd-e2de-4aba-9870-804b0659505c container-wrap gray-border global-margin-top-none global-margin-bottom-none global-padding-top-x-small global-padding-bottom-none rounded-corners-off inner-container-width"> <section> <div class="container-content"> <div class="prod-content"><div class="text primary-color-lightestgray font-opensans font-size-18 section"> <div id="text-70e863f10f" class="cmp-text"> <p><b>Country Headquarters</b></p> </div> </div> <div class="text primary-color-lightgray font-interstate-extralight font-size-14 section"> <div id="text-a0f105ab39" class="cmp-text"> <p>Trend Micro - United States (US)</p> <p>225 East John Carpenter Freeway<br /> Suite 1500<br /> Irving, Texas 75062</p> <p><b>Phone: +1 (817) 569-8900</b></p> </div> </div> </div> </div> </section> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> <div class="responsiveColumnControlV1 section"> <div class="row global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-e0ecfb75-0ef2-4926-ad10-e8f095e1cd76"> <div class="col-sm-12 col-xs-12 col-md-3 column"><div class="footer section"> <div class="country-selection"> <p>Select a country / region</p> <div class="dropup position-unset"> <button class="btn btn-default dropdown-toggle" type="button" id="countryMenu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <span class="stateSelect"></span> <span class="material-symbols-outlined"> expand_more</span> </button> <div class="row dropdown-menu" aria-labelledby="countryMenu"> <span class="material-symbols-outlined icon-close">close</span> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>The Americas</h4> <ul> <li> <a href="/en_us.html">United States</a> </li> <li> <a href="/pt_br.html">Brasil</a> </li> <li> <a href="/en_ca.html">Canada</a> </li> <li> <a href="/es_mx.html">México</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-2"> <h4>Middle East & Africa</h4> <ul> <li> <a href="/en_za.html">South Africa</a> </li> <li> <a href="/en_ae.html">Middle East and North Africa</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Europe</h4> <ul> <li> <a href="/en_be.html">België (Belgium)</a> </li> <li> <a href="http://www.trendmicro.cz/">Česká Republika</a> </li> <li> <a href="/en_dk.html">Danmark</a> </li> <li> <a href="/de_de.html">Deutschland, Österreich Schweiz</a> </li> <li> <a href="/es_es.html">España</a> </li> <li> <a href="/fr_fr.html">France</a> </li> <li> <a href="/en_ie.html">Ireland</a> </li> <li> <a href="/it_it.html">Italia</a> </li> <li> <a href="/en_nl.html">Nederland</a> </li> <li> <a href="/en_no.html">Norge (Norway)</a> </li> <li> <a href="/pl_pl.html">Polska (Poland)</a> </li> <li> <a href="/en_fi.html">Suomi (Finland)</a> </li> <li> <a href="/en_se.html">Sverige (Sweden)</a> </li> <li> <a href="/tr_tr.html">Türkiye (Turkey)</a> </li> <li> <a href="/en_gb.html">United Kingdom</a> </li> </ul> </div> <div class="coloumn col-xs-12 col-sm-6 col-md-4"> <h4>Asia & Pacific</h4> <ul> <li> <a href="/en_au.html">Australia</a> </li> <li> <a href="/ru_ru.html">Центральная Азия (Central Asia)</a> </li> <li> <a href="/en_hk.html">Hong Kong (English)</a> </li> <li> <a href="/zh_hk.html">香港 (中文) (Hong Kong) </a> </li> <li> <a href="/en_in.html">भारत गणराज्य (India)</a> </li> <li> <a href="/in_id.html">Indonesia</a> </li> <li> <a href="/ja_jp.html">日本 (Japan)</a> </li> <li> <a href="/ko_kr/business.html">대한민국 (South Korea)</a> </li> <li> <a href="/en_my.html">Malaysia</a> </li> <li> <a href="/en_us.html">Монголия (Mongolia) and рузия (Georgia)</a> </li> <li> <a href="/en_nz.html">New Zealand</a> </li> <li> <a href="/en_ph.html">Philippines</a> </li> <li> <a href="/en_sg.html">Singapore</a> </li> <li> <a href="/zh_tw.html">台灣 (Taiwan)</a> </li> <li> <a href="/th_th.html"> ประเทศไทย (Thailand)</a> </li> <li> <a href="/vi_vn.html">Việt Nam</a> </li> </ul> </div> </div> </div> </div> </div> </div> <div class="col-sm-12 col-xs-12 col-md-9 column"><div class="horizontalSeparatorV1 section"> <style> .horizontalSeparator-a3888876-9f4e-4c7a-8890-3141c24e2785.border { border-bottom: 1px solid #bcbdc0; } </style> <div id="horizontalV1-a3888876-9f4e-4c7a-8890-3141c24e2785" class="global-margin-top- global-margin-bottom-default global-padding-top-default global-padding-bottom- border horizontalSeparator-a3888876-9f4e-4c7a-8890-3141c24e2785"> </div> </div> <div class="responsiveColumnControlV1 section"> <div class="row global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-eac7743e-76f1-49d9-b69a-4091dc1b906e"> <div class="col-sm-12 col-xs-12 col-md-6 column"><div class="text primary-color-white font-interstate-light font-size-14 section"> <div id="privacyLink" class="cmp-text"> <p><a title="privacy" href="/en_us/about/trust-center/privacy.html">Privacy</a> <b>|</b> <a title="Legal" href="/en_us/about/legal.html">Legal</a> <b>|</b> <a title="Accessibility" href="/en_us/about/legal/accessibility-policy.html">Accessibility</a> <b>|</b> <a href="/en_us/about/legal/terms-of-use.html">Terms of Use</a> <b>|</b> <a title="Site map" href="/en_us/business/sitemap.html">Site map</a></p> </div> </div> </div> <div class="col-sm-12 col-xs-12 col-md-6 column"><div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnMobile { display: block; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnMobile { display: block; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnMobile { display: block; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnMobile { display: block; } #grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-71465f10-5c98-492c-b2c6-eb82d4025de2"> <div class="grid-hide-4-mobile-footer hideOnTablet hideOnMobile"><div class="text primary-color-white font-interstate-light font-size-14 section"> <div id="copyText" class="cmp-text"> <p style="text-align: right;">Copyright ©2024 Trend Micro Incorporated. All rights reserved</p> </div> </div> </div> </div> </div> <div class="gridContainerV1 section"> <style> /* MOBILE (Default) */ #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 { display: grid; gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnMobile { display: none; } /* TABLET ($tablet-up: 768px) */ @media ( max-width: 1023px ) and ( min-width: 768px ) { #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnMobile { display: block; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnTablet { display: none; } } /* WIDE TABLET ($desktop-up: 1024px) */ @media ( max-width: 1199px ) and ( min-width: 1024px ) { #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnMobile { display: block; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnWideTablet { display: none; } } /* DESKTOP ($desktop-large-up: 1200px) */ @media ( max-width: 1599px ) and ( min-width: 1200px ) { #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnMobile { display: block; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnDesktop { display: none; } } /* WIDE DESKTOP ($desktop-xl-up: 1600px) */ @media ( min-width: 1600px ) { #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 { gap: 0px 0px; grid-template-columns: 1fr; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnMobile { display: block; } #grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3 .hideOnWideDesktop { display: none; } } </style> <div class="gridAreas global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none" id="grid-areas-1bcfe2c1-188c-4118-a372-1aa383c61df3"> <div class="grid-hide-4-desktop-footer hideOnWideDesktop hideOnDesktop hideOnWideTablet"><div class="text primary-color-white font-interstate-light font-size-14 section"> <div id="copyText" class="cmp-text"> <p style="text-align: left;">Copyright ©2024 Trend Micro Incorporated. All rights reserved</p> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> <script src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script> <script src="/etc.clientlibs/clientlibs/granite/jquery/granite.min.js"></script> <script src="/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js"></script> </div> </div></div>  <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js"></script> <script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js"></script> <script type="text/javascript" src="https://www.youtube.com/iframe_api"></script> <script src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js"></script> <script src="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js"></script>  <div class="modal-wrap"></div> <div class="jwPlayerString hidden"> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk</span> </div>  </body> </html>