Nazar: Spirits of the Past

May 5, 2020 7:00 am

In mid-2017, The Shadow Brokers exposed NSA files in a leak known as "Lost In Translation". Recently, researcher uncovered "Nazar", a previously-unknown APT that was mentioned in the leak. We decided to dive into each and every one of the components and share our technical analysis. What we found out, is far from being "advanced".

First seen in the wild – Malware uses Corporate MDM as attack vector

April 29, 2020 4:38 am

Research by: Aviran Hazum, Bogdan Melnykov, Chana Efrati, Danil Golubenko, Israel Wernik, Liav Kuperman, Ohad Mana Overview: Check Point researchers discovered a new Cerberus variant which is targeting a multinational conglomerate, and is... Click to Read More

E-Learning Platforms Getting Schooled – Multiple Vulnerabilities in WordPress’ Most Popular Learning Management System Plugins

April 29, 2020 2:00 am

Research by: Omri Herscovici and Sagi Tzadik Overview The COVID-19 pandemic has changed the way we live and work. “Sheltering in place” requires many people to work from home, thereby necessitating the use... Click to Read More

OptOut – Compiler Undefined Behavior Optimizations

April 24, 2020 2:00 am

Research by: Eyal Itkin, Gili Yankovitch Introduction During 35C3, Gili Yankovitch (@cytingale) and I attended a great talk called: “Memsad – Why Clearing Memory is Hard” (https://media.ccc.de/v/35c3-9788-memsad). In his talk, Ilja van Sprundel presented... Click to Read More

IR Case: The Florentine Banker Group

April 23, 2020 2:59 am

by Matan Ben David Introduction On December 16 2019, Check Point’s Incident Response Team (CPIRT) was engaged by three firms in the finance sector to investigate fraudulent wire transfers sent from their joint... Click to Read More

Ransomware Evolved: Double Extortion

April 16, 2020 2:03 am

Overview Picture this scene:  you arrive at the office one morning to find that cybercriminals have accessed your entire corporate network and encrypted all your files and databases, bringing the operations of your... Click to Read More

Threat Actors Migrating to the Cloud

April 10, 2020 3:06 am

Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has... Click to Read More

Breaking through Windows’ defenses: Analyzing mLNK Builder

March 26, 2020 3:00 am

Introduction Launching an attack does not always require high technical aptitude on the part of a threat actor, especially when there are ready-made tools available for every stage of the infection chain. Delivery... Click to Read More

“I want to learn about exploitation! Where do I start?”

March 25, 2020 4:10 am

We’ve heard this question a lot. We’re even young enough to remember having asked it. The standard answer is often an embarrassed mumble that there are no golden rules, and that you should... Click to Read More

Google Play Store Played Again – Tekya Clicker Hides in 24 Children’s Games and 32 Utility Apps

March 24, 2020 2:14 am

Research by Israel Wernik, Danil Golubenko , Aviran Hazum    Although Google has taken steps to secure its Play store and stop malicious activity, hackers are still finding ways to infiltrate the app store and access users’... Click to Read More

The Inside Scoop on a Six-Figure Nigerian Fraud Campaign

March 17, 2020 3:00 am

Cybercrime is usually a one-way street. Shady types send their malicious documents and Trojans downstream to us innocent folk. Worst-case scenario, we get infected. Best-case scenario, we smirk, hit “delete” and move on... Click to Read More

Vicious Panda: The COVID Campaign

March 12, 2020 7:09 am

Introduction Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target.... Click to Read More

Phorpiex Arsenal: Part II

March 11, 2020 4:37 am

Following our recent Phorpiex publications, we finish with technical descriptions of the modules we encountered in this campaign. Below we describe the remaining ones: XMRig Silent Loader. NetBIOS Worm Module. Auxiliary modules (includes... Click to Read More

March 2nd – Threat Intelligence Bulletin

March 2, 2020 2:30 am

For the latest discoveries in cyber research for the week of March 2nd 2020, please download our Threat Intelligence Bulletin TOP ATTACKS AND BREACHES  An unprotected ElasticSearch database belonging to the sport retailer... Click to Read More

CPR evasion encyclopedia: The Check Point evasion repository

February 27, 2020 3:00 am

As malicious threats evolve, the necessity in automated solutions to analyze such threats emerges. It’s a very common case when malware samples are executed in some kind of virtualized environment. These environments differ... Click to Read More