Research reports

Check Point · Web page · Published 13 Jan

Unveiling VoidLink - A Stealthy, Cloud-Native Linux Malware Framework

VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to…

SOCRadar · Web page · Published 20 Oct

INC and The Gentlemen Ransomware: Exposed AI Infrastructure

SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session…

Team Cymru · Web page · Added 29 Oct

Team Cymru Cybersecurity Blog

Who Team Cymru threat analysts and researchers, with a named byline on technical posts. What pivots behind them. How reporting. Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn Named threat…

Arctic Wolf · Web page · Published 26 Oct

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access

Arctic Wolf Labs has observed a recurring social engineering pattern in hundreds of cases where threat actors have used Microsoft Teams’ external chat creation feature for impersonation scams, or to deliver malicious files. A consistent pattern of attacker…

The Hacker News · Web page · Published 26 Oct

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver…

The Hacker News · Web page · Published 26 Oct

⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security…

Unit 42 · Web page · Published 22 Oct

Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

We investigated a campaign waged by financially motivated threat actors operating out of Morocco. We refer to this campaign as Jingle Thief, due to the attackers’ modus operandi of conducting gift card fraud during festive seasons. Jingle Thief attackers use…

Check Point · Web page · Published 7 Mar

Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities

In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…

Check Point · Web page · Published 27 Mar

Rhadamanthys: The “Everything Bagel” Infostealer

Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…

Check Point · Web page · Published 12 Jan

Going Rogue- a Mastermind behind Android Malware Returns with a New RAT

Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…

cocomelonc.github.io · Web page · Published 23 Jun

MacOS malware persistence 12: Folder Actions. Simple AppleScript and C example

Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. In previous parts we already looked at LaunchAgents , shell environment hijacking, dylib hijacking, Login Items, cron , PAM modules, re-opened applications,…

Check Point · Web page · Published 10 Dec

Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits

Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and development structure (Visual Studio…

Check Point · Web page · Published 10 Apr

Threat Actors Migrating to the Cloud

Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were…

drive.google.com · Web page · Added 27 Oct

OskiStealerEN.pdf

Check Point · Web page · Published 12 Jun

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

Check Point Research uncovered an active malware campaign exploiting expired and released Discord invite links. Attackers hijacked the links through vanity link registration, allowing them to silently redirect users from trusted sources to malicious servers.…

WIRED · Web page · Published 3 Apr

The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

The scourge of software supply chain attacks—an increasingly common hacking technique that hides malicious code in a widely used legitimate program—can take many forms. Hackers can penetrate an update server to seed out their malware, or even break into the…

The Hacker News · Web page · Published 23 Oct

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that…

Group-IB · Web page · Published 21 Oct

Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to…

gov.pl · Web page · Added 25 Oct

Statement on Solar Winds Orion cyberattacks - Ministry of Foreign Affairs Republic of Poland

Team Cymru · Web page · Published 25 May

Bablosoft; Lowering the Barrier of Entry for Malicious Actors

Free-to-use browser automation framework creates thriving criminal community Summary Evidence suggests an increasing number of threat actor groups are making use of a free-to-use browser automation framework. The framework contains numerous features which we…