Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Sun 19 Apr
A Whale of a Tale: HummingBad Returns
Check Point researchers have found a new variant of the HummingBad malware hidden in more than 20 apps on Google Play. The infected apps in this campaign were downloaded several million times by unsuspecting users. Check Point informed the Google Security…
Malware
Added Sat 18 Apr
Osiris: An Enhanced Banking Trojan
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…
MalwareVulnerabilities
Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…
State-sponsoredMalware
Added Fri 17 Apr
GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain Attack
Insikt Group has been monitoring GrayCharlie, a threat actor overlapping with SmartApeSG and active since mid-2023, for some time, and is now publishing its first report on the group. GrayCharlie compromises WordPress sites and injects them with links to…
MalwareSupply chain
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” LucidRook is a…
Malware
Added Thu 16 Apr
SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…
MalwareVulnerabilities
Added Wed 15 Apr
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Pony’s C&C servers hidden inside the Bitcoin blockchain
Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…
Malware
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsoredMalware
Added Tue 14 Apr
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsoredMalware
Added Mon 13 Apr
Banking Trojans Under Development
Although banks themselves have taken measures to strengthen the security of their authentication processes, Banker Trojans, however, are still a popular tool for stealing user’s financial details and draining bank accounts. The Check Point Research team…
Malware
More Than 1 Million Google Accounts Breached by Gooligan
As a result of a lot of hard work done by our security research teams, we revealed today a new and alarming malware campaign. The attack campaign, named Gooligan, breached the security of over one million Google accounts. The number continues to rise at an…
Malware
Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job Lures
Check Point Research is actively tracking Iranian threat actor Nimbus Manticore. Our latest findings show it is expanding operations into Europe and now targeting the defense, telecom, and aerospace sectors. The group uses fake job portals and spear‑phishing…
Malware
Added Sun 12 Apr
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
RansomwareMalwareTakedowns and arrests
New Joker variant hits Google Play with an old trick
Check Point’s researchers recently discovered a new variant of the Joker Dropper and Premium Dialer spyware in Google Play. Hiding in seemingly legitimate applications, we found that this updated version of Joker was able to download additional malware to the…
Malware
3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for…
MalwareMobile
Added Fri 10 Apr
Quick analysis note about DealPly (Adware)
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly The post focuses on the following main sections: Unpack wrapper/loader to get main Dll payload. Decrypt C2url and strings are used in the malware code. Sample: SHA-256:…
Malware
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
A Ukrainian national pleaded guilty today to his role in two separate and wide-ranging malware schemes involving tens of millions of dollars in losses. “Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of…
MalwareTakedowns and arrests
Malware Discovered – SFG: Furtim Malware Analysis
Update, 14-July: There have been a number of stories published since the posting of this blog that have suggested this attack is specifically targeting SCADA energy management systems. We want to emphasize that we do not have any evidence that this is in fact…
Malware
IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs
Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.