Research reports

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

Check Point Research is tracking an ongoing, large scale and sophisticated phishing campaign deploying the newest version of the Rhadamanthys stealer (0.7). We dubbed this campaign CopyRh(ight)adamantys. This campaign utilizes a copyright infringement theme…

Vulnerabilities

Deep into the SunBurst Attack

During the week of December 13th, we witnessed what many are calling one of the biggest cyberattacks in recent times. SunBurst, the malware installed on SolarWinds’ Orion product, perpetrated what seems like a nation-state sponsored supply chain attack, and…

Supply chain

Rhadamanthys 0.9.x – walk through the updates

Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. The latest version, 0.9.2, comes with significant updates…

7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs

In 2022, Check Point Research (CPR) observed a new wave of a long-standing campaign targeting the Uyghur community, a Turkic ethnic group originating from Central Asia, one of the largest minority ethnic groups in China. This malicious activity, which we…

MalwareMobile

Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk

Last seen in August 2021, Zloader, a banking malware designed to steal user credentials and private information, is back with a simple yet sophisticated infection chain. Previous Zloader campaigns, which were seen in 2020, used malicious documents, adult…

Vulnerabilities

Lumma Infostealer – Down but Not Out?

The takedown achieved a significant disruption to Lumma infostealers’ infrastructure, but likely didn’t permanently affect most of its Russia-hosted infrastructure. Lumma’s developers are undertaking significant efforts to reinstate the activity and to…

InfostealersTakedowns and arrests

From Hidden Bee to Rhadamanthys – The Evolution of Custom Executable Formats

Rhadamanthys stealer’s design and implementation significantly overlap with those of Hidden Bee coin miner. The similarity is apparent at many levels: custom executable formats, the use of similar virtual filesystems, identical paths to some of the…

In the Wild: Malware Prototype with Embedded Prompt Injection

In this write-up we present a malware sample found in the wild that boasts a novel and unusual evasion mechanism — an attempted prompt injection (”Ignore all previous instructions…”) aimed to manipulate AI models processing the sample. The sample gives the…

MalwareAI

Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes

In the past two months, we observed multiple APT groups attempting to leverage the Russia and Ukraine war as a lure for espionage operations. It comes as no surprise that Russian entities themselves became an attractive target for spear-phishing campaigns…

State-sponsored

Vicious Panda: The COVID Campaign

Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…

State-sponsoredMalware

Naikon APT: Cyber Espionage Reloaded

Recently Check Point Research discovered new evidence of an ongoing cyber espionage operation against several national government entities in the Asia Pacific (APAC) region. This operation, which we were able to attribute to the Naikon APT group, used a new…

State-sponsored

The Growing Danger of Blind Eagle: One of Latin America’s Most Dangerous Cyber Criminal Groups Targe ...

Check Point Research (CPR) has uncovered a series of ongoing, targeted cyber campaigns by Blind Eagle (APT-C-36)—one of Latin America’s most dangerous threat actors Days after Microsoft released a fix for CVE-2024-43451, the group began employing a comparable…

OSX/Dok Refuses to Go Away and It’s After Your Money

Following up on our recent discovery of the new OSX/Dok malware targeting macOS users, we’d like to report that the malicious actors behind it are not giving up yet. They are aiming at the victim’s banking credentials by mimicking major bank sites. The fake…

Mobile

VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled

VSCode (short for Visual Studio Code) is a popular and free source code editor developed by Microsoft. It’s an efficient and customizable coding environment that can support a wide range of programming languages, frameworks, and tools. VSCode has gained muc

Malware

Rancor: The Year of The Phish

Earlier this year, Check Point researchers identified a targeted and extensive attack against Southeast Asian government entities over the span of 7 months. The attackers, which we believe are members of the Rancor threat group, used classic spear-phishing to…

Phishing

Sunburst Hack: Best Practices, Identifying And Mitigating

During the closing weeks of 2020 a Cyber Security attack became one of the main headline news stories of what had already been a news-rich year. Attributed to a campaign that began months earlier, the information security teams of government agencies and…

Man-in-the-Disk: Android Apps Exposed via External Storage

Recently, our researchers came across a shortcoming in the design of Android’s use of storage resources. Careless use of External Storage by applications may open the door to an attack resulting in any number of undesired outcomes, such as silent installation…

Mobile

IndigoZebra APT continues to attack Central Asia with evolving tools

Check Point research recently discovered an ongoing spear-phishing campaign targeting the Afghan government. Further investigation revealed this campaign was a part of a long-running activity targeting other Central-Asia countries, including Kyrgyzstan and…

State-sponsored

A Whale of a Tale: HummingBad Returns

Check Point researchers have found a new variant of the HummingBad malware hidden in more than 20 apps on Google Play. The infected apps in this campaign were downloaded several million times by unsuspecting users. Check Point informed the Google Security…

Malware

CRYING IS FUTILE: SandBlast Forensic Analysis of WannaCry

Using the NSA exploit EternalBlue released by the Shadow Brokers, the WannaCry ransomware developers have added their names to malware lore. Given the number of institutions hit and the amount of media generated, it seemed appropriate to show what the…

Ransomware