Advanced Research Reports
Insights into malware, ransomware, and other cybersecurity threats
Latest CyberThreat report
The Trellix Advanced Research Center CyberThreat Report offers insights, intelligence, and guidance on cybersecurity threats from critical data sources, providing expert interpretations to support best practices in cyber defense. This edition covers data from October 1, 2025 to March 31, 2026.
Read the Report
SecondSight Threat Hunting report: September 2026
This report highlights threat hunting insights, intelligence, and guidance gleaned from multiple sources of critical data, including Trellix SecondSight, on the top five critical campaigns observed in the first half of 2026.
Read the ReportOther Threat Reports
OT Threat Report
The October 2025 - March 2026 reporting period highlights a measurable shift in how adversaries target OT and ICS environments. The Trellix Advanced Research Center observed nation-state actors expanding their prepositioning operations, and ransomware syndicates exploiting the eroding IT/OT air gap.
Trellix Healthcare Cybersecurity Threat Intelligence Report
In 2025, Trellix Advanced Research Center recorded 54.7 million detections from our healthcare industry customers. Adversaries moved beyond simple encryption to "triple extortion" data theft, service disruption, and individual patient harassment. The data reveals a persistent, high-volume threat environment specifically tuned to the healthcare sector's unique vulnerabilities.
OT Threat Report
In the last half of 2025, Trellix Advanced Research Center observed an increase in threats targeting operational technology (OT) and industrial control systems (ICS). The threat landscape reveals coordinated campaigns by state-sponsored actors and ransomware groups, with the manufacturing, transportation and shipping, utilities, and energy/oil and gas sectors bearing the highest risk.
Trellix SecondSight Threat Hunting Report February 2026
Authored by the Trellix Advanced Research Center, this report (1) highlights threat hunting insights, intelligence, and guidance gleaned from multiple sources of critical data, including Trellix SecondSight, on the top five critical campaigns observed in 2025, and (2) develops expert, thorough case studies to inform and enable best practices in defending against these types of campaigns.
Evolving threats, meet adaptive defense.
Learn about a new approach to modeling cybersecurity defense.
Get the Whitepaper
Archived reports
October 2025 Report
The Trellix Advanced Research Center CyberThreat Report offers insights, intelligence, and guidance on cybersecurity threats from critical data sources, providing expert interpretations to support best practices in cyber defense. This edition covers data from April 1 to September 30, 2025.
April 2025 Report
The Trellix Advanced Research Center report offers insights, intelligence, and guidance on cybersecurity threats from critical data sources, providing expert interpretations to support best practices in cyber defense. This edition covers data from October 1, 2024 to March 31, 2025.
November 2024 Report
The Trellix Advanced Research Center report offers insights, intelligence, and guidance on cybersecurity threats from critical data sources, providing expert interpretations to support best practices in cyber defense. This edition covers data from April 1 to September 30, 2024.
June 2024 Report
Trellix ARC's CyberThreat Report highlights insights, intelligence, and guidance gleaned from data on cybersecurity threats. It interprets this data to inform and enable best practices in cyber defense. This edition focuses on data and insights captured primarily between October 1, 2023, and March 31, 2024.
November 2023 Report
Trellix's report distills cybersecurity insights from diverse data sources, offering expert interpretations for informed cyber defense practices. Covers April 1 - September 30, 2023.
June 2023 Report
This report highlights insights, intelligence, and guidance gleaned from multiple sources of critical data on cybersecurity threats focusing on data and insights captured between January 1, 2023, and March 31, 2023.
February 2023 Report
The Trellix Advanced Research Center team offers in-depth research and analysis of threat data on which countries and industries were most targeted in Q4 2022 as well as the threat groups and nation-states behind those threats and most prevalent attack techniques.
Fall 2022 Report
Trellix Advanced Research Center analyzes Q3 2022 threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
April 2022 Report
Our report on the rise of cyberattacks targeting critical infrastructure in the fourth quarter and Ukraine in the start of the new year.
January 2022 Report
In our new company's first threat report, we acknowledge the Log4j issue that dominated not only headlines, but the focus of defenders and enterprise security teams.
October 2021 Report
This McAfee Enterprise Advanced Threat Research Report reveals the prevalence of ransomware campaigns, their favorite targets and evolving models.