SHADOW-VOID-042Threat actor
SHADOW-VOID-042 is a provisional intrusion set tracked by Trend Micro, active in October-November 2025, conducting spear-phishing campaigns against energy, defense, pharmaceutical, cybersecurity, and other sectors using lures like HR complaints, research surveys, and fake Trend Micro security updates urging browser fixes.From MISP Galaxy
Last reported 10 months ago, by Trend Micro Research1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“A scheduled task is then created to launch such process with four arguments at every boot with SYSTEM privileges.”
- T1684Social Engineering
“In November 2025, spear-phishing emails featuring a Trend Micro-themed social engineering lure were sent to various industry verticals – including defense, energy, chemical, cybersecurity (including Trend and a subsidiary), and ICT companies – where a decoy website mimicked Trend…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics“SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics”
Thanks — we review every report.