Research reports
1,224 reports from 387 publishers45 added in the past week
26 reports, newest added first
Added Thu 7 May
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsoredMalware
Added Sat 25 Apr
The Evolution of Transparent Tribe’s New Malware
The ElizaRAT campaigns first executed the same function to verify that the system was set to India Standard Time, indicating that the campaigns targeted Indian systems. Transparent Tribe, otherwise known as APT36, is a Pakistan-affiliated threat actor that…
State-sponsoredMalware
Added Fri 24 Apr
Cyber Espionage on Afghanistan, Kyrgyzstan and Uzbekistan by Chinese-speaking Hacker Group
Check Point Research (CPR) detects an ongoing cyber espionage operation targeting the Afghan government. Attributed to a Chinese-speaking hacker group, the threat actors impersonated the Office of the President of Afghanistan to infiltrate the Afghan National…
State-sponsored
Added Wed 22 Apr
Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes
In the past two months, we observed multiple APT groups attempting to leverage the Russia and Ukraine war as a lure for espionage operations. It comes as no surprise that Russian entities themselves became an attractive target for spear-phishing campaigns…
State-sponsored
Vicious Panda: The COVID Campaign
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…
State-sponsoredMalware
Naikon APT: Cyber Espionage Reloaded
Recently Check Point Research discovered new evidence of an ongoing cyber espionage operation against several national government entities in the Asia Pacific (APAC) region. This operation, which we were able to attribute to the Naikon APT group, used a new…
State-sponsored
Added Mon 20 Apr
IndigoZebra APT continues to attack Central Asia with evolving tools
Check Point research recently discovered an ongoing spear-phishing campaign targeting the Afghan government. Further investigation revealed this campaign was a part of a long-running activity targeting other Central-Asia countries, including Kyrgyzstan and…
State-sponsored
Added Sat 18 Apr
North Korea Turns Against New Targets?!
Over the past few weeks, we have been monitoring suspicious activity directed against Russian-based companies that exposed a predator-prey relationship that we had not seen before. For the first time we were observing what seemed to be a coordinated North…
State-sponsored
Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…
State-sponsoredMalware
Added Fri 17 Apr
UPSynergy: Chinese-American Spy vs. Spy Story
Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants…
State-sponsoredVulnerabilities
28th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches The European Parliament website has been attacked following a vote declaring Russia a state sponsor of…
State-sponsoredBotnets and DDoS
Added Wed 15 Apr
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsoredMalware
17th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An attack targeting Snowflake customer databases, identified as the work of threat actor UNC5537, has led to…
State-sponsored
Added Tue 14 Apr
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsoredMalware
Added Mon 13 Apr
Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy
Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a…
State-sponsoredPhishing
Added Sun 12 Apr
Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
Check Point Research has been tracking ongoing activity of WIRTE threat actor, previously associated with the Hamas-affiliated group Gaza Cybergang, despite the ongoing war in the region. The conflict has not disrupted the WIRTE’s activity, and they continue…
State-sponsored
Added Sat 11 Apr
Rampant Kitten – An Iranian Espionage Campaign
Check Point Research unraveled an ongoing surveillance operation by Iranian entities that has been targeting Iranian expats and dissidents for years. While some individual sightings of this attack were previously reported by other researchers and journalists,…
State-sponsored
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has…
State-sponsoredVulnerabilities
Added Fri 10 Apr
Deobfuscating APT32 Flow Graphs with Cutter and Radare2
The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.