Research reports

Chinese Threat Actors Targeting Europe in SmugX Campaign

In the last couple of months, Check Point Research (CPR) has been tracking the activity of a Chinese threat actor targeting Foreign Affairs ministries and embassies in Europe. Combined with other Chinese activity previously reported by Check Point Research,…

A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies

This research comes as a follow-up to our previous article on Trickbot, “When Old Friends Meet Again: Why Emotet Chose Trickbot For Rebirth” where we provided an overview of the Trickbot infrastructure after its takedown. Check Point Research (CPR) now sheds…

Osiris: An Enhanced Banking Trojan

Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…

MalwareVulnerabilities

North Korea Turns Against New Targets?!

Over the past few weeks, we have been monitoring suspicious activity directed against Russian-based companies that exposed a predator-prey relationship that we had not seen before. For the first time we were observing what seemed to be a coordinated North…

State-sponsored

Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives

In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…

State-sponsoredMalware

UPSynergy: Chinese-American Spy vs. Spy Story

Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants…

State-sponsoredVulnerabilities

Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation

Check Point Research identifies phishing domain patterns, offering actionable insights to proactively counter threats from the notorious cyber group behind recent airline attacks Scattered Spider, a sophisticated cyber threat group known for aggressive social…

Phishing

28th November– Threat Intelligence Report

For the latest discoveries in cyber research for the week of 28th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches The European Parliament website has been attacked following a vote declaring Russia a state sponsor of…

State-sponsoredBotnets and DDoS

Ramnit’s Network of Proxy Servers

As you may know, Ramnit is one of the most prominent banking malware families in existence today and lately Check Point Research monitored a new massive campaign of Ramnit, dubbed ‘Black’, reaching over 100,000 infections over the course of two months. It is…

Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations

Iranian threat actor Agrius continues to operate against Israeli targets, masking destructive influence operations as ransomware attacks. In recent attacks the group deployed Moneybird, a previously unseen ransomware written in C++. Despite presenting…

Ransomware

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa

Recent studies show that more than 85% of financial institutions in Central and Western Africa have repeatedly been victimized in multiple, damaging cyberattacks. In a quarter of these cases, intrusions into network systems resulted in the worst possible…

SpeakUp: A New Undetected Backdoor Linux Trojan

Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…

MalwareVulnerabilities

New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns

MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…

State-sponsoredMalwarePhishing

Pony’s C&C servers hidden inside the Bitcoin blockchain

Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…

Malware

Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group

Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…

State-sponsoredMalware

Bad Karma, No Justice: Void Manticore Destructive Activities in Israel

Void Manticore is an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS). They carry out destructive wiping attacks combined with influence operations. The threat actor operates several online personas, with the most…

17th June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 17th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An attack targeting Snowflake customer databases, identified as the work of threat actor UNC5537, has led to…

State-sponsored

Agent Tesla Targeting United States & Australia: Revealing the Attackers’ Identities

Check Point Research (CPR) uncovered three recent malicious campaigns of one of the most prevalent malware in the market – Agent Tesla. These operations were aimed against US and Australian organizations and exploited the topics of goods purchasing and order…

The Dragon Who Sold His Camaro: Analyzing Custom Router Implant

Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…

State-sponsoredMalware

Evolving Cyber Dynamics Amidst the Israel-Hamas Conflict

Pro-Palestinian cyber activists have broadened their scope beyond Israel, targeting countries perceived as Israeli allies in the war against Hamas. The cyber operations mainly serve as informational and retaliatory tactics, with limited reported damage.…