Research reports
1,224 reports from 387 publishers45 added in the past week
34 reports, newest added first
Added Wed 15 Apr
Pony’s C&C servers hidden inside the Bitcoin blockchain
Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…
Malware
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsoredMalware
Added Tue 14 Apr
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsoredMalware
Added Mon 13 Apr
Banking Trojans Under Development
Although banks themselves have taken measures to strengthen the security of their authentication processes, Banker Trojans, however, are still a popular tool for stealing user’s financial details and draining bank accounts. The Check Point Research team…
Malware
More Than 1 Million Google Accounts Breached by Gooligan
As a result of a lot of hard work done by our security research teams, we revealed today a new and alarming malware campaign. The attack campaign, named Gooligan, breached the security of over one million Google accounts. The number continues to rise at an…
Malware
Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job Lures
Check Point Research is actively tracking Iranian threat actor Nimbus Manticore. Our latest findings show it is expanding operations into Europe and now targeting the defense, telecom, and aerospace sectors. The group uses fake job portals and spear‑phishing…
Malware
Added Sun 12 Apr
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
RansomwareMalwareTakedowns and arrests
New Joker variant hits Google Play with an old trick
Check Point’s researchers recently discovered a new variant of the Joker Dropper and Premium Dialer spyware in Google Play. Hiding in seemingly legitimate applications, we found that this updated version of Joker was able to download additional malware to the…
Malware
3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for…
MalwareMobile
Added Wed 8 Apr
MuddyWater Threat Group Deploys New BugSleep Backdoor
Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…
State-sponsoredMalware
Bandook: Signed & Delivered
Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…
Malware
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…
MalwareTakedowns and arrests
From Albania to the Middle East: The Scarred Manticore is Listening
Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…
Malware
Added Tue 7 Apr
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor
Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…
State-sponsoredMalware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.