Research reports

Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy

Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a…

State-sponsoredPhishing

Banking Trojans Under Development

Although banks themselves have taken measures to strengthen the security of their authentication processes, Banker Trojans, however, are still a popular tool for stealing user’s financial details and draining bank accounts. The Check Point Research team…

Malware

More Than 1 Million Google Accounts Breached by Gooligan

As a result of a lot of hard work done by our security research teams, we revealed today a new and alarming malware campaign. The attack campaign, named Gooligan, breached the security of over one million Google accounts. The number continues to rise at an…

Malware

Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job Lures

Check Point Research is actively tracking Iranian threat actor Nimbus Manticore. Our latest findings show it is expanding operations into Europe and now targeting the defense, telecom, and aerospace sectors. The group uses fake job portals and spear‑phishing…

Malware

Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months

Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…

RansomwareMalwareTakedowns and arrests

New Joker variant hits Google Play with an old trick

Check Point’s researchers recently discovered a new variant of the Joker Dropper and Premium Dialer spyware in Google Play. Hiding in seemingly legitimate applications, we found that this updated version of Joker was able to download additional malware to the…

Malware

Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity

Check Point Research has been tracking ongoing activity of WIRTE threat actor, previously associated with the Hamas-affiliated group Gaza Cybergang, despite the ongoing war in the region. The conflict has not disrupted the WIRTE’s activity, and they continue…

State-sponsored

3rd October – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for…

MalwareMobile

Rampant Kitten – An Iranian Espionage Campaign

Check Point Research unraveled an ongoing surveillance operation by Iranian entities that has been targeting Iranian expats and dissidents for years. While some individual sightings of this attack were previously reported by other researchers and journalists,…

State-sponsored

'Stayin' Alive' Campaign in Asia

Check Point Research has been tracking “Stayin’ Alive”, an ongoing espionage campaign operating in Asia, and primarily targeting the Telecom industry, as well as government organizations. The “Stayin’ Alive” campaign used against high-profile Asian…

Nazar: Spirits of the Past

Those were some of the words that the Equation Group (NSA) operators left in the records documenting their attacks against target systems, and which were later leaked by the Shadow Brokers. The plethora of information exposed in the fifth and last leak by the…

The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day

There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has…

State-sponsoredVulnerabilities

Deobfuscating APT32 Flow Graphs with Cutter and Radare2

The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a…

State-sponsored

The Muddy Waters of APT Attacks

The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…

State-sponsored

Ryuk Ransomware: A Targeted Campaign Break-Down

Over the past two weeks, Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. So far the campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.…

Ransomware

MuddyWater Threat Group Deploys New BugSleep Backdoor

Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…

State-sponsoredMalware

Bandook: Signed & Delivered

Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…

Malware

Deep Dive into UPAS Kit vs. Kronos

In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…

MalwareTakedowns and arrests

APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit

With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new…

State-sponsoredVulnerabilities

Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign

In recent weeks, a new hacktivist campaign has emerged to demand the release of Telegram CEO Pavel Durov, after his arrest by French authorities. In this report, Check Point Research explores the most prominent and dominant hacking groups involved in the…

Botnets and DDoSTakedowns and arrests