Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Fri 17 Apr
28th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches The European Parliament website has been attacked following a vote declaring Russia a state sponsor of…
State-sponsoredBotnets and DDoS
Added Wed 15 Apr
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsoredMalware
17th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An attack targeting Snowflake customer databases, identified as the work of threat actor UNC5537, has led to…
State-sponsored
Added Tue 14 Apr
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsoredMalware
Added Mon 13 Apr
Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy
Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a…
State-sponsoredPhishing
Added Sun 12 Apr
Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
Check Point Research has been tracking ongoing activity of WIRTE threat actor, previously associated with the Hamas-affiliated group Gaza Cybergang, despite the ongoing war in the region. The conflict has not disrupted the WIRTE’s activity, and they continue…
State-sponsored
Added Sat 11 Apr
Rampant Kitten – An Iranian Espionage Campaign
Check Point Research unraveled an ongoing surveillance operation by Iranian entities that has been targeting Iranian expats and dissidents for years. While some individual sightings of this attack were previously reported by other researchers and journalists,…
State-sponsored
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has…
State-sponsoredVulnerabilities
Added Fri 10 Apr
奇安信威胁情报中心
APT groups often use some uncommon file types to host malicious code in order to increase the probability of immunity against antivirus software, such as CD-ROM image files (.iso) and virtual hard disk files (.vhd), which we have monitored for abuse in recent…
State-sponsored
Deobfuscating APT32 Flow Graphs with Cutter and Radare2
The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a…
State-sponsored
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
State-sponsored
Added Wed 8 Apr
MuddyWater Threat Group Deploys New BugSleep Backdoor
Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…
State-sponsoredMalware
APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit
With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new…
State-sponsoredVulnerabilities
Added Tue 7 Apr
State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage
Geopolitical tensions often make headlines and present a golden opportunity for threat actors to exploit the situation, especially those targeting high-profile victims. In the past month while the Russian invasion of Ukraine was unfolding, Check Point…
State-sponsored
BlindEagle Targeting Ecuador With Sharpened Tools
APT-C-36, also known as Blind Eagle, is a financially motivated threat group that has been launching indiscriminate attacks against citizens of various countries in South America since at least 2018. In a recent campaign targeting Ecuador based organizations,…
State-sponsored
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor
Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…
State-sponsoredMalware
Added Mon 6 Apr
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsoredMalwareBotnets and DDoS
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsoredMalwareBotnets and DDoS
Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. [3] G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28…
State-sponsoredVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.