Research reports

From Albania to the Middle East: The Scarred Manticore is Listening

Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…

Malware

EternalBlue – Everything There Is To Know

Since the revelation of the EternalBlue exploit, allegedly developed by the NSA, and the malicious uses that followed with WannaCry, it went under thorough scrutiny by the security community. While many details were researched and published, several remained…

Vulnerabilities

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

Geopolitical tensions often make headlines and present a golden opportunity for threat actors to exploit the situation, especially those targeting high-profile victims. In the past month while the Russian invasion of Ukraine was unfolding, Check Point…

State-sponsored

Uncovering MosesStaff techniques: Ideology over Money

In September 2021, the hacker group MosesStaff began targeting Israeli organizations, joining a wave of attacks which was started about a year ago by the Pay2Key and BlackShadow attack groups. Those actors operated mainly for political reasons in attempt to…

BlindEagle Targeting Ecuador With Sharpened Tools

APT-C-36, also known as Blind Eagle, is a financially motivated threat group that has been launching indiscriminate attacks against citizens of various countries in South America since at least 2018. In a recent campaign targeting Ecuador based organizations,…

State-sponsored

Educated Manticore – Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools

In this report we reveal new findings related to Educated Manticore, an activity cluster with strong overlap with Phosphorus, an Iranian-aligned threat actor operating in the Middle East and North America. Like many other actors, Educated Manticore has…

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities

Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the…

Vulnerabilities

SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor

Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…

State-sponsoredMalware

EvilPlayout: Attack Against Iran’s State Broadcaster

In the past few months, a new wave of cyberattacks has been flooding Iran. These attacks are far from minor website defacements – the recent wave is hitting national infrastructure and causing major disruptions to public services. This article provides an…