Research reports

Check Point · Web page · Published 11 Jan

APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit

With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new…

Check Point · Web page · Published 4 Sep

Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign

In recent weeks, a new hacktivist campaign has emerged to demand the release of Telegram CEO Pavel Durov, after his arrest by French authorities. In this report, Check Point Research explores the most prominent and dominant hacking groups involved in the…

Check Point · Web page · Published 31 Oct

From Albania to the Middle East: The Scarred Manticore is Listening

Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…

Check Point · Web page · Published 29 Sep

EternalBlue – Everything There Is To Know

Since the revelation of the EternalBlue exploit, allegedly developed by the NSA, and the malicious uses that followed with WannaCry, it went under thorough scrutiny by the security community. While many details were researched and published, several remained…

Check Point · Web page · Published 31 Mar

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

Geopolitical tensions often make headlines and present a golden opportunity for threat actors to exploit the situation, especially those targeting high-profile victims. In the past month while the Russian invasion of Ukraine was unfolding, Check Point…

Check Point · Web page · Published 15 Nov

Uncovering MosesStaff techniques: Ideology over Money

In September 2021, the hacker group MosesStaff began targeting Israeli organizations, joining a wave of attacks which was started about a year ago by the Pay2Key and BlackShadow attack groups. Those actors operated mainly for political reasons in attempt to…

Check Point · Web page · Published 5 Jan

BlindEagle Targeting Ecuador With Sharpened Tools

APT-C-36, also known as Blind Eagle, is a financially motivated threat group that has been launching indiscriminate attacks against citizens of various countries in South America since at least 2018. In a recent campaign targeting Ecuador based organizations,…

csirt-cti.net · Web page · Added 7 Apr

Access Denied

endurant.io · Web page · Added 7 Apr

detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon

Check Point · Web page · Published 25 Apr

Educated Manticore – Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools

In this report we reveal new findings related to Educated Manticore, an activity cluster with strong overlap with Phosphorus, an Iranian-aligned threat actor operating in the Middle East and North America. Like many other actors, Educated Manticore has…

Microsoft · Web page · Added 7 Apr

404 ~ Not found

1. MSRC 2. Customer Guidance 3. Security Update Guide 4. Not found The page you were looking for was either not found or not available! Source: https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021

Check Point · Web page · Published 8 Mar

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities

Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the…

Check Point · Web page · Published 3 Jun

SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor

Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…

Microsoft · Web page · Added 7 Apr

404 ~ Not found

1. MSRC 2. Customer Guidance 3. Security Update Guide 4. Not found The page you were looking for was either not found or not available! Source: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625 (Feed generated wi

cysecurity.news · Web page · Added 7 Apr

CySecurity News - Latest Information Security and Hacking Incidents: Twisted Spider's Dangerous CACTUS Ransomware Attack

In a sophisticated cyber campaign, the group Twisted Spider, also recognized as Storm-0216, has joined forces with the cybercriminal faction Storm-1044. Employing a strategic method, they target specific endpoints through the deployment of an initial access…

Radware · Web page · Added 7 Apr

Six-day, 14.7 Million RPS Web DDoS Attack Campaign Attributed to SN_BLACKMETA

Key Attack Insights: Web DDoS attack campaign lasted six days and peaked at 14.7 Million RPS Featured multiple attack waves amounting to a total of 100 hours of attack time Sustained an average of 4.5 million RPS Targeted a financial institution in the Middle…

Check Point · Web page · Published 18 Feb

EvilPlayout: Attack Against Iran’s State Broadcaster

In the past few months, a new wave of cyberattacks has been flooding Iran. These attacks are far from minor website defacements – the recent wave is hitting national infrastructure and causing major disruptions to public services. This article provides an…

US Department of Justice · Web page · Published 8 Aug

Department Disrupts North Korean Remote IT Worker Fraud Schemes Through Charges and Arrest of Nashville Facilitator

NASHVILLE – Matthew Isaac Knoot, 38, of Nashville, Tennessee, was charged today for his efforts to generate revenue for the Democratic People’s Republic of Korea’s (DPRK or North Korea) illicit weapons program, which includes weapons of mass destruction…

US Department of Justice · Web page · Published 6 Apr

Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)

Operation Copied and Removed Malware Known as “Cyclops Blink” from the Botnet’s Command-And-Control Devices, Disrupting the GRU’s Control Over Thousands of Infected Devices Worldwide. Victims Must Take Additional Steps to Remediate the Vulnerability and…

Group-IB · Web page · Added 7 Apr

Cybersecurity Services, Solutions & Products. Global Provider