Check Point · Published 10 Apr
The Muddy Waters of APT Attacks
By deugenio
Excerpt
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers.
Ever since at least 2017, the attackers behind MuddyWater have used a simple yet effective infection vector: Spear-phishing. Attacks usually begin with a targeted email sent to an organization. The next step is to steal legitimate documents from the compromised systems within that organization and then weaponize and distribute them to other unsuspecting victims.
To do this, a lure message that prompts the u…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt2
More from Check Point98
Check Point · Web page · Published 12 Dec
November 2023’s Most Wanted Malware: New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus
Researchers reported on a new AsyncRAT campaign where malicious HTML files were being used to spread the stealthy malware. Meanwhile, downloader FakeUpdates jumped straight into second place after a short break from the top ten list Our latest Global Threat…
Check Point · Web page · Published 3 Dec
Inside Akira Ransomware's Rust Experiment
Check Point Research analyzed the construction and control flow of Akira ransomware’s Rust version that circulated in early 2024, which has specific features uniquely targeting ESXi server. Our analysis demonstrates how Rust idioms, boilerplate code, and…
Check Point · Web page · Published 13 Jan
Unveiling VoidLink - A Stealthy, Cloud-Native Linux Malware Framework
VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to…
Check Point · Web page · Published 7 Mar
Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities
In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…
On the same topics
polyswarm.io · Web page · Added 29 Oct
UNC4841 Targeting Government Entities with Barracuda ESG 0day
Verticals Targeted: Government, Military, Defense, Aerospace, Technology, Telecommunications Executive Summary UNC4841 was observed using CVE-2023-2868 to target entities in multiple verticals, including government and military. Key Takeaways government and…
Malwarebytes · Web page · Published 5 Jan
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud,…
Malpedia · Web page · Added 18 Oct
Kazuar (Malware Family)
There is no description at this point. References 2026-06-25 ⋅ Google ⋅ Google Threat Intelligence Group The Latest Addition to Turla’s Intelligence Gathering Apparatus Kazuar 2026-05-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Kazuar: Anatomy of a…
eweek.com · Web page · Published 6 Apr
Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claims
The National Foreign Trade Council (NFTC) website was allegedly infiltrated by Chinese nation-state threat actors, according to a new report from Fidelis Cybersecurity. The attack against the NFTC site has been dubbed ‘Operation TradeSecret’ by Fidelis and is…