Research reports
1,224 reports from 387 publishers45 added in the past week
34 reports, newest added first
Added Sun 25 Oct
Gozi: The Malware with a Thousand Faces
Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the malware directly or distributing it via an…
Malware
Added Tue 4 Aug
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are…
Malware
Added Wed 3 Jun
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict
The Iranian, IRGC affiliated, threat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities. The campaign leveraged…
Malware
Added Thu 7 May
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
RansomwareMalware
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
RansomwareMalware
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsoredMalware
Added Sun 26 Apr
Bumblebee: increasing its capacity and evolving its TTPs
The spring of 2022 saw a spike in activity of Bumblebee loader, a recent threat that has garnered a lot of attention due to its many links to several well-known malware families. In this piece we outline the conclusions of our research into this piece of…
Malware
Added Sat 25 Apr
The Evolution of Transparent Tribe’s New Malware
The ElizaRAT campaigns first executed the same function to verify that the system was set to India Standard Time, indicating that the campaigns targeted Indian systems. Transparent Tribe, otherwise known as APT36, is a Pakistan-affiliated threat actor that…
State-sponsoredMalware
Added Fri 24 Apr
Charger Malware Calls and Raises the Risk on Google Play
Several weeks ago, Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “Charger.” This incident demonstrates how…
RansomwareMalwareMobile
The Emergence of the New Azorult 3.3
During the past week, Check Point Research spotted a new version of Azorult in the wild being delivered through the RIG exploit kit, as well as other sources. Azorult is a long known information stealer and malware downloader, with this particular version…
MalwareInfostealers
Added Thu 23 Apr
Turning Telegram toxic: ‘ToxicEye’ RAT is the latest to use Telegram for command & control
Remote access trojan exploits Telegram communications to steal data from victims and update itself to perform additional malicious activities Research by: Omer Hofman Telegram, the cloud-based IM platform has enjoyed a surge in popularity this year because of…
Malware
7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs
In 2022, Check Point Research (CPR) observed a new wave of a long-standing campaign targeting the Uyghur community, a Turkic ethnic group originating from Central Asia, one of the largest minority ethnic groups in China. This malicious activity, which we…
MalwareMobile
In the Wild: Malware Prototype with Embedded Prompt Injection
In this write-up we present a malware sample found in the wild that boasts a novel and unusual evasion mechanism — an attempted prompt injection (”Ignore all previous instructions…”) aimed to manipulate AI models processing the sample. The sample gives the…
MalwareAI
Added Wed 22 Apr
Vicious Panda: The COVID Campaign
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…
State-sponsoredMalware
Added Tue 21 Apr
VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled
VSCode (short for Visual Studio Code) is a popular and free source code editor developed by Microsoft. It’s an efficient and customizable coding environment that can support a wide range of programming languages, frameworks, and tools. VSCode has gained muc
Malware
Added Sun 19 Apr
A Whale of a Tale: HummingBad Returns
Check Point researchers have found a new variant of the HummingBad malware hidden in more than 20 apps on Google Play. The infected apps in this campaign were downloaded several million times by unsuspecting users. Check Point informed the Google Security…
Malware
Added Sat 18 Apr
Osiris: An Enhanced Banking Trojan
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…
MalwareVulnerabilities
Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…
State-sponsoredMalware
Added Thu 16 Apr
SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…
MalwareVulnerabilities
Added Wed 15 Apr
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.