Skip to content

Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

781–800 of 1,281 reports · page 40 of 65

Added Wed 15 Apr

Check Point · Web page · Published 17 Oct
Pony’s C&C servers hidden inside the Bitcoin blockchain
Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…
Malware Original (new tab)
Cybernews · Web page · Published 1 Sep
Unraveling EternalBlue: inside the WannaCry’s enabler
WannaCry and NotPetya, probably two most damaging cyberattacks in recent history, were both only made possible because of EternalBlue. Here is how the NSA-developed cyber monster works, and how you should defend against it. What is the EternalBlue…
Vulnerabilities Original (new tab)
Check Point · Web page · Published 16 May
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsored Malware Original (new tab)
Cybernews · Web page · Published 27 Oct
Thomson Reuters collected and leaked at least 3TB of sensitive data
Thomson Reuters, a multinational media conglomerate, left an open database with sensitive customer and corporate data, including third-party server passwords in plaintext format. Attackers could use the details for a supply-chain attack. Media giant with…
Original (new tab)
Cybernews · Web page · Published 21 Apr
Million-dollar deposits and friends in high places: how we applied for a job with a ransomware gang
During an undercover interview, a CyberNews researcher tricked ransomware operators affiliated with Ragnar Locker into revealing their ransom payout structure, cash out schemes, and target acquisition strategies. From a relatively rare threat just a few years…
Ransomware Original (new tab)
Check Point · Web page · Published 20 May
Bad Karma, No Justice: Void Manticore Destructive Activities in Israel
Void Manticore is an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS). They carry out destructive wiping attacks combined with influence operations. The threat actor operates several online personas, with the most…
Original (new tab)
Check Point · Web page · Published 17 Jun
17th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An attack targeting Snowflake customer databases, identified as the work of threat actor UNC5537, has led to…
State-sponsored Original (new tab)

Added Tue 14 Apr

Check Point · Web page · Published 3 Apr
Agent Tesla Targeting United States & Australia: Revealing the Attackers’ Identities
Check Point Research (CPR) uncovered three recent malicious campaigns of one of the most prevalent malware in the market – Agent Tesla. These operations were aimed against US and Australian organizations and exploited the topics of goods purchasing and order…
Original (new tab)
Check Point · Web page · Published 16 May
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 30 Oct
Evolving Cyber Dynamics Amidst the Israel-Hamas Conflict
Pro-Palestinian cyber activists have broadened their scope beyond Israel, targeting countries perceived as Israeli allies in the war against Hamas. The cyber operations mainly serve as informational and retaliatory tactics, with limited reported damage.…
Original (new tab)

Added Mon 13 Apr

Check Point · Web page · Published 15 Apr
Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy
Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a…
State-sponsored Phishing Original (new tab)
Check Point · Web page · Published 6 Jun
Banking Trojans Under Development
Although banks themselves have taken measures to strengthen the security of their authentication processes, Banker Trojans, however, are still a popular tool for stealing user’s financial details and draining bank accounts. The Check Point Research team…
Malware Original (new tab)
Check Point · Web page · Published 30 Nov
More Than 1 Million Google Accounts Breached by Gooligan
As a result of a lot of hard work done by our security research teams, we revealed today a new and alarming malware campaign. The attack campaign, named Gooligan, breached the security of over one million Google accounts. The number continues to rise at an…
Malware Original (new tab)
Check Point · Web page · Published 22 Sep
Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job Lures
Check Point Research is actively tracking Iranian threat actor Nimbus Manticore. Our latest findings show it is expanding operations into Europe and now targeting the defense, telecom, and aerospace sectors. The group uses fake job portals and spear‑phishing…
Malware Original (new tab)
CISA · Web page · Published 24 Feb
Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
* Search for indicators of compromise. * Use antivirus software. * Patch all systems. * Prioritize patching known exploited vulnerabilities. * Train users to recognize and report phishing attempts. * Use multi-factor authentication. Note: this advisory uses…
Vulnerabilities Original (new tab)
cfr.org · Web page · Added 13 Apr
Cyber Operations Tracker
A threat actor used malware known as Shamoon 2.0 to exfiltrate and delete data from computers in the Saudi transportation sector. Suspected victims General Authority of Civil Aviation of Saudi Arabia Type of incident Data destruction Target category…
Original (new tab)

Added Sun 12 Apr

specopssoft.com · Web page · Published 28 Jul
“Can you reset my password?” How a simple service desk attack cost Clorox $400 million
“Can you reset my password?” How a simple service desk attack cost Clorox $400 million Clorox breach: Attack summary Clorox hack: How the service desk social engineering played out Specops analysis: What can we learn from the Clorox hack? Hand holding a…
Original (new tab)
Check Point · Web page · Published 8 Dec
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
Ransomware Malware Takedowns and arrests Original (new tab)
Check Point · Web page · Published 9 Jul
New Joker variant hits Google Play with an old trick
Check Point’s researchers recently discovered a new variant of the Joker Dropper and Premium Dialer spyware in Google Play. Hiding in seemingly legitimate applications, we found that this updated version of Joker was able to download additional malware to the…
Malware Original (new tab)
Check Point · Web page · Published 12 Nov
Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
Check Point Research has been tracking ongoing activity of WIRTE threat actor, previously associated with the Hamas-affiliated group Gaza Cybergang, despite the ongoing war in the region. The conflict has not disrupted the WIRTE’s activity, and they continue…
State-sponsored Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.