{"id":56889,"date":"2024-08-22T00:00:00","date_gmt":"2024-08-22T00:00:00","guid":{"rendered":"urn:uuid:8cefee7d-46ca-c295-3c65-19149782977d"},"modified":"2024-08-22T00:00:00","modified_gmt":"2024-08-22T00:00:00","slug":"how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/","title":{"rendered":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\"><!-- OneTrust Cookies Consent Notice start for trendmicro.com --><!-- OneTrust Cookies Consent Notice end for trendmicro.com --> <head> <meta charset=\"UTF-8\"> <meta name=\"viewport\" content=\"width=device-width\"> <meta name=\"description\" content=\"Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.\"> <meta name=\"robots\" content=\"index,follow\"> <meta name=\"keywords\" content=\"endpoints,ransomware,research,articles, news, reports\"> <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge,chrome=1\"> <meta name=\"template\" content=\"article1withouthero\"> <meta property=\"article:published_time\" content=\"2024-08-22\"> <meta property=\"article:tag\" content=\"ransomware\"> <meta property=\"article:section\" content=\"research\"> <link rel=\"icon\" type=\"image\/ico\" href=\"\/content\/dam\/trendmicro\/favicon.ico\"> <link rel=\"canonical\" href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/h\/pressing-pause-on-play-ransomware.html\"> <title>How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack | Trend Micro (US)<\/title> <link href=\"https:\/\/fonts.googleapis.com\/css?family=Open+Sans:300,300i,400,400i,600\" rel=\"stylesheet\">\n<link href=\"\/\/customer.cludo.com\/css\/296\/1798\/cludo-search.min.css\" type=\"text\/css\" rel=\"stylesheet\"> <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch.min.css\" type=\"text\/css\">\n<link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendmicro\/clientlibs\/trendmicro-core-2\/clientlibs\/header-footer.min.css\" type=\"text\/css\"> <meta property=\"og:url\" content=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/h\/pressing-pause-on-play-ransomware.html\"><br \/>\n<meta property=\"og:title\" content=\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack\"><br \/>\n<meta property=\"og:description\" content=\"Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.\"><br \/>\n<meta property=\"og:site_name\" content=\"Trend Micro\"><br \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/24\/Pressing-Pause-on-Play-Ransomware.png\"><br \/>\n<meta property=\"og:locale\" content=\"en_US\"> <meta name=\"twitter:card\" content=\"summary_large_image\"><br \/>\n<meta name=\"twitter:site\" content=\"@TrendMicro\"><br \/>\n<meta name=\"twitter:title\" content=\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack\"><br \/>\n<meta name=\"twitter:description\" content=\"Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.\"><br \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/24\/Pressing-Pause-on-Play-Ransomware.png\"> <\/head> <body class=\"articlepage page basicpage context-business\" id=\"readabilityBody\" readability=\"51.328963539533\"> <!-- Page Scroll: Back to Top --> <a id=\"page-scroll\" title=\"VerticalPageScroll\" href=\"javascript:jumpScroll($(this).scrollTop());\"> <span class=\"icon-chevron-up\"><\/span> <\/a> <!-- \/* Data Layers *\/ --> <\/p>\n<div class=\"root responsivegrid\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"articleBodyNoHero aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"research-layout article container\" role=\"contentinfo\">\n<article class=\"research-layout--wrapper row\" data-article-pageid=\"1292599877\">\n<div class=\"col-xs-12 col-md-12 one-column\">\n<div class=\"col-xs-12 col-md-12\" readability=\"8.2555910543131\">\n<div class=\"article-details\" role=\"heading\" readability=\"35.936102236422\"> <span class=\"article-details__bar\" role=\"img\"><\/span> <\/p>\n<p class=\"article-details__display-tag\">Ransomware<\/p>\n<p class=\"article-details__description\">Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.<\/p>\n<p class=\"article-details__author-by\">By: Trent Bessell <time class=\"article-details__date\">August 22, 2024<\/time> <span>Read time:&nbsp;<\/span><span class=\"eta\"><\/span> (<span class=\"words\"><\/span> words) <\/p>\n<div class=\"article-details__icons\"> <!--Add This--> <\/p>\n<div class=\"a2a_kit a2a_default_style\" data-a2a-icon-color=\"#717172\"> <a class=\"a2a_dd addthis_link\" href=\"https:\/\/www.addtoany.com\/share\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch\/resources\/img\/share-more.svg\" class=\"svg-icon\" alt=\"Share\"> <\/a> <a class=\"a2a_button_print addthis_link\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch\/resources\/img\/printer.svg\" class=\"svg-icon\" alt=\"Print\"> <\/a> <\/div>\n<p> <!--Add to Folio--> <!--Subscribe--> <\/div>\n<\/div><\/div>\n<\/p><\/div>\n<hr class=\"research-layout-divider\"> <main class=\"main--content col-xs-12 col-lg-8 col-lg-push-2\"> <\/p>\n<div class=\"richText\" readability=\"41.321351700387\">\n<div readability=\"27.87946620749\">\n<h2><span class=\"body-subhead-title\">Report highlights<\/span><\/h2>\n<ul>\n<li><span class=\"rte-red-bullet\">We show how a Play ransomware infection was quickly identified and contained via a swift and coordinated response by Trend Micro Managed Detection and Response (MDR).<\/span><\/li>\n<li><span class=\"rte-red-bullet\">The Play ransomware group used the following malware tools: SYSTEMBC, a proxy malware that can deliver other payloads like ransomware, and GRIXBA, a custom tool meant to circumvent signature-based detections.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">In this particular attack, the ransomware group was also found weaponizing legitimate tools like PsExec and Remote Desktop Protocol (RDP). This is another example of the common cybercriminal technique called \u201cliving-off-the-land,\u201d which enables threat actors to conduct stealthy attacks to avoid security detection.<\/span><\/li>\n<\/ul>\n<h2><span class=\"body-subhead-title\">Introduction<\/span><\/h2>\n<p><a href=\"https:\/\/www.trendmicro.com\/vinfo\/ph\/security\/definition\/ransomware\">Ransomware<\/a> threats have existed for some time now as one of the most pernicious forms of cybercrime. One particular ransomware group that has gained notoriety is the Play ransomware group, which has become known for its aggressive strategies and significant impact on various organizations since June 2022.<\/p>\n<p>Earlier this year, Trend Micro Managed Detection and Response (MDR) identified a highly sophisticated and well-coordinated intrusion attempt that was related to the notorious Play ransomware group. Using the Trend Micro Vision One platform, the MDR team was able to quickly identify and respond to the threat. The swift and decisive actions effectively thwarted the attack, thereby preventing any potential data loss or operational impact. This incident underscores the critical importance of having robust cybersecurity measures in place to defend against increasingly complex cyberthreats.<\/p>\n<h2><span class=\"body-subhead-title\">Incident overview<\/span><\/h2>\n<p>Trend Micro MDR was first alerted to the breach via the triggering of Vision One Workbench alerts following the detection via the Apex One Endpoint Protection Platform (EPP) agent of a command-and-control tool identified as SYSTEMBC. The tool, which was dropped in the \u201cC:\\Users\\Public\\Music\\\u201d directory of a Windows server, is a proxy malware that uses SOCKS5 and can deliver other payloads, such as ransomware. Despite the backdoor being quarantined by the EPP agent, the threat actor still had access to the endpoint using valid logon credentials. The source host was identified as being from an IP address belonging to the victim\u2019s virtual private network (VPN) subnet.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\" readability=\"6\">\n<figure class=\"image-figure\" readability=\"2\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/h\/pressing-pause-on-play-ransomware\/Fig1.png\" alt=\"SYSTEMBC Detection Event (Vision One)\"> <\/p>\n<p><figcaption>Figure 1. SYSTEMBC Detection Event (Vision One)<\/figcaption><\/p>\n<\/figure><\/div>\n<div>\n<div class=\"richText\" readability=\"34\">\n<div readability=\"13\">\n<p>The threat actor transferred a legitimate administration tool, PsExec, from their attacking machine via the VPN. PsExec, which is designed to run programs and execute commands on remote systems, was deployed to the same directory used to stage the previously detected SYSTEMBC binary.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\" readability=\"6\">\n<figure class=\"image-figure\" readability=\"2\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/h\/pressing-pause-on-play-ransomware\/Fig2.png\" alt=\"PSEXEC Detection (Vision One)\"> <\/p>\n<p><figcaption>Figure 2. PSEXEC Detection (Vision One)<\/figcaption><\/p>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"33.5\">\n<div readability=\"12\">\n<p>The threat actor also altered Remote Desktop Protocol (RDP) settings through modifications made in the Windows Registry. This involved changing a specific registry value, \u201c<i>fdenyTSConnections<\/i>\u201d, as highlighted in the observed attack technique (OAT). This modification enabled RDP access on the host.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\" readability=\"6\">\n<figure class=\"image-figure\" readability=\"2\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/h\/pressing-pause-on-play-ransomware\/Fig3.png\" alt=\"RDP Registry Modification (Vision One)\"> <\/p>\n<p><figcaption>Figure 3. RDP Registry Modification (Vision One)<\/figcaption><\/p>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"38\">\n<div readability=\"21\">\n<p>An additional tool, <i>GT_NET.exe<\/i>, was introduced on the host and executed, resulting in a series of network reconnaissance tasks to identify accessible hosts on the network. The resulting list of endpoints was placed into a file and archived to <i>data.zip<\/i>. This file was identified as GRIXBA after malware analysis was performed post its execution. GRIXBA is a custom tool that the Play ransomware group uses and provides. While the use of custom tools is not new, using them provide advantages for both an attacker and defender:<\/p>\n<ul>\n<li><b>Advantages for Attackers<\/b><\/li>\n<li><b> <\/b>\n<ul>\n<li><span class=\"rte-red-bullet\">Stealth and Evasion:&nbsp;Custom tooling is often tailored to the intrusion, or packaged with obfuscation wrappers to avoid signature-based detections. Rapid development can be performed to avoid newly developed defensive techniques.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Modular Functionality:&nbsp;Customs tools are often designed to be modular, deploying only necessary functionality dependent on the breached environment.<\/span><\/li>\n<li><b><br \/>Advantages for Defenders<\/b><\/li>\n<\/ul>\n<\/li>\n<li>\n<ul>\n<li><span class=\"rte-red-bullet\">Attribution:&nbsp;The detection of custom tooling can aid defenders applying early attribution back to the threat actor. This allows defenders to better understand the unique tactics, techniques and procedures employed and remain a step ahead of the adversary.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Behavioural Analysis: With signature-based detections being a weaker method of detecting custom tooling, behaviour-based detections, such as behavior monitoring (BM) or predictive machine learning (PML) help identify potential changes to the tooling by focusing on the intended goal and methods employed by the tooling.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Following this, an attempt was made to dump the running LSASS process memory via Task Manager. However, this action was successfully blocked by the Apex One EPP agent\u2019s Behaviour Monitoring (BM) module. The BM module effectively detected the suspicious activity and intervened to prevent the sensitive LSASS process artifacts from being breached.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\" readability=\"6\">\n<figure class=\"image-figure\" readability=\"2\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/h\/pressing-pause-on-play-ransomware\/Fig4.png\" alt=\"LSASS Process Memory Dump (Vision One)\"> <\/p>\n<p><figcaption>Figure 4. LSASS Process Memory Dump (Vision One)<\/figcaption><\/p>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"36\">\n<div readability=\"17\">\n<h3><span class=\"body-subhead-title\">Timeline of Events<\/span><\/h3>\n<p>Through diligent and continuous monitoring of the victim organization&#8217;s environment, the Trend Micro MDR team was able to meticulously piece together the threat actor&#8217;s activity. This comprehensive monitoring allowed the team to perform timely and effective response actions aimed at containing the threat. Additionally, they were able to notify the victim organization promptly, ensuring that immediate measures could be taken. This swift and coordinated response ultimately prevented the Play ransomware group from achieving further objectives, such as data collection, exfiltration, and encryption, which could have resulted in severe data breaches and significant operational disruptions for the victim organization.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\" readability=\"6\">\n<figure class=\"image-figure\" readability=\"2\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/h\/pressing-pause-on-play-ransomware\/Fig5.png\" alt=\"Attack Timeline of Events\"> <\/p>\n<p><figcaption>Figure 5. Attack Timeline of Events<\/figcaption><\/p>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"43.299636972913\">\n<div class=\"responsive-table-wrap\" readability=\"32.474727729684\">\n<p><span class=\"body-subhead-title\">Mitigation Strategies<br \/><\/span><\/p>\n<p>The FBI, CISA, and ASD\u2019s ACSC recommend organizations implement several key mitigations to limit potential adversarial use of common system and network discovery techniques. These measures are essential to reducing the risk of compromise by Play ransomware. Below is an overview of some of the recommended strategies:<\/p>\n<ol>\n<li>Regularly Update and Patch Systems:<span> Ensure that all systems and software are up to date with the latest patches and updates. This helps close vulnerabilities that attackers could exploit.<\/span><\/li>\n<li>Implement Network Segmentation:<span> Divide your network into segments to limit the spread of ransomware and other malicious activities. This can help contain the damage in case of an intrusion.<\/span><\/li>\n<li>Use Multi-Factor Authentication (MFA):<span> Enforce the use of MFA for accessing critical systems and sensitive data. MFA adds an extra layer of security, making it harder for attackers to gain unauthorized access.<\/span><\/li>\n<li>Monitor Network Traffic:<span> Continuously monitor network traffic for unusual activity that could indicate an intrusion. Use advanced threat detection tools to identify and respond to potential threats in real-time.<\/span><\/li>\n<li>Backup Data Regularly:<span> Maintain regular backups of critical data and store them in a secure, offsite location. Ensure that backups are not connected to the main network to prevent ransomware from encrypting them as well.<\/span><\/li>\n<li>Deploy Endpoint Protection:<span> Use robust endpoint protection solutions to detect and block malicious activities on individual devices. This includes utilizing anti-malware and anti-ransomware tools.<\/span><\/li>\n<\/ol>\n<p>Applying these mitigations can help organizations significantly reduce the risk of compromise by Play ransomware and other similar threats. For a comprehensive guide and detailed recommendations, refer to the <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-12\/aa23-352a-stopransomware-play-ransomware.pdf\">#STOPRANSOMWARE Play Ransomware guide<\/a>.<\/p>\n<h2><span class=\"body-subhead-title\">Conclusion<\/span><\/h2>\n<p>The successful detection and containment of the Play Ransomware intrusion highlight the vital importance of proactive security measures in today&#8217;s digital landscape. This incident underscores the need for organizations to be vigilant and adopt comprehensive strategies, including Managed Detection and Response (MDR) services. By leveraging the Trend Micro MDR service, organizations benefit from continuous monitoring and expert analysis 24\/7\/365. Additionally, layered defences, using a range of security tools and practices as referenced in the #STOPRANSOMWARE guide, are essential to create a robust barrier against sophisticated and evolving cyber threats.<\/p>\n<p>For further information on the Play ransomware group, read Trend Micro\u2019s <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-play\">Ransomware Spotlight<\/a> post to learn some interesting facts about the group.<\/p>\n<p><span class=\"body-subhead-title\">Indicators of Compromise (IoC)<\/span><\/p>\n<table cellpadding=\"1\" cellspacing=\"0\" border=\"1\" width=\"100%\" height=\"100%\">\n<tbody readability=\"13.5\">\n<tr readability=\"3\">\n<td width=\"88\" valign=\"top\">\n<p><b>Name\/Detail<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\">\n<p><b>Indicator<\/b><\/p>\n<\/td>\n<td width=\"180\" valign=\"top\" readability=\"5\">\n<p><b>Trend Micro Detection\/OAT<\/b><\/p>\n<\/td>\n<\/tr>\n<tr readability=\"7.5\">\n<td width=\"88\" valign=\"top\">\n<p><b>SYSTEMBC<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\" readability=\"6\">\n<p>File Name: Socks32.dll<br \/>File Path: C:\\Users\\Public\\Music\\<br \/>SHA1: 2b7e28442bc7ef5e7b37afde5423b29e897a59ca<\/p>\n<\/td>\n<td width=\"180\" valign=\"top\" readability=\"5\">\n<p>Backdoor.Win32.COROXY.SMRTI<\/p>\n<\/td>\n<\/tr>\n<tr readability=\"4.5\">\n<td width=\"88\" valign=\"top\">\n<p><b>GRIXBA<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\" readability=\"6\">\n<p>File Name: GT_NET.exe<br \/>File Path: C:\\Users\\Public\\Music\\list (2)\\<br \/>SHA1: 3890272563cd044761a9a5c0ab049a2117b38884<\/p>\n<\/td>\n<td width=\"180\" valign=\"top\">\n<p>Trojan.MSIL.GRIXBA.A<\/p>\n<\/td>\n<\/tr>\n<tr readability=\"7.5\">\n<td width=\"88\" valign=\"top\">\n<p><b>PsExec<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\" readability=\"6\">\n<p>File Name: PsExec.exe<br \/>File Path: C:\\Users\\Public\\Music\\PsExec.exe<br \/>SHA1: a0ee0761602470e24bcea5f403e8d1e8bfa29832<\/p>\n<\/td>\n<td width=\"180\" valign=\"top\" readability=\"5\">\n<p>OAT: Suspicious File Creation in Uncommon Folder<\/p>\n<\/td>\n<\/tr>\n<tr readability=\"7.5\">\n<td width=\"88\" valign=\"top\">\n<p><b>Registry Modification<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\" readability=\"6\">\n<p>Process Command: &#8220;C:\\Windows\\system32\\reg.exe&#8221; add &#8220;\\\\&lt;IP ADDRESS&gt;\\HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server&#8221; \/v fDenyTSConnections \/t REG_DWORD \/d 0 \/f<\/p>\n<\/td>\n<td width=\"180\" valign=\"top\" readability=\"5\">\n<p>OAT: RDP Setting Modification Via Reg.exe<\/p>\n<\/td>\n<\/tr>\n<tr readability=\"10.5\">\n<td width=\"88\" valign=\"top\" readability=\"5\">\n<p><b>LSASS Process Memory Dump<\/b><\/p>\n<\/td>\n<td width=\"333\" valign=\"top\" readability=\"6\">\n<p>Process File Path: C:\\Windows\\System32\\Taskmgr.exe<br \/>Object File Path: C:\\Users\\&lt;USERNAME&gt;\\AppData\\Local\\Temp\\lsass.DMP<\/p>\n<\/td>\n<td width=\"180\" valign=\"top\" readability=\"5\">\n<p>OAT: Dump LSASS Process Memory via Taskmgr<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<section class=\"tag--list\">\n<p>Tags<\/p>\n<\/section>\n<p> <\/main> <\/article>\n<\/div>\n<\/div><\/div>\n<\/div>\n<p> <!-- \/* Core functionality javascripts, absolute URL to leverage Akamai CDN *\/ --> <!--For Modal-start--> <\/p>\n<p> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk<\/span> <\/p>\n<p> <!--For Modal-end--> <\/body> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/h\/pressing-pause-on-play-ransomware.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9508,9539,9509],"class_list":["post-56889","post","type-post","status-publish","format-standard","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-endpoints","tag-trend-micro-research-ransomware","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-22T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack\",\"datePublished\":\"2024-08-22T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/\"},\"wordCount\":1444,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Endpoints\",\"Trend Micro Research : Ransomware\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/\",\"name\":\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\",\"datePublished\":\"2024-08-22T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\",\"contentUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/","og_locale":"en_US","og_type":"article","og_title":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-08-22T00:00:00+00:00","og_image":[{"url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack","datePublished":"2024-08-22T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/"},"wordCount":1444,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Endpoints","Trend Micro Research : Ransomware","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/","url":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/","name":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80","datePublished":"2024-08-22T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#primaryimage","url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80","contentUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/Pressing-Pause-on-Play-Ransomware:Large?qlt=80"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/how-trend-micro-managed-detection-and-response-pressed-pause-on-a-play-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56889"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56889\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}