Vicious Panda: The COVID Campaign

March 12, 2020 7:09 am

Introduction Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target.... Click to Read More

Phorpiex Arsenal: Part II

March 11, 2020 4:37 am

Following our recent Phorpiex publications, we finish with technical descriptions of the modules we encountered in this campaign. Below we describe the remaining ones: XMRig Silent Loader. NetBIOS Worm Module. Auxiliary modules (includes... Click to Read More

March 2nd – Threat Intelligence Bulletin

March 2, 2020 2:30 am

For the latest discoveries in cyber research for the week of March 2nd 2020, please download our Threat Intelligence Bulletin TOP ATTACKS AND BREACHES  An unprotected ElasticSearch database belonging to the sport retailer... Click to Read More

CPR evasion encyclopedia: The Check Point evasion repository

February 27, 2020 3:00 am

As malicious threats evolve, the necessity in automated solutions to analyze such threats emerges. It’s a very common case when malware samples are executed in some kind of virtualized environment. These environments differ... Click to Read More

“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign

February 17, 2020 3:00 am

Research by: Yohann Sillam and Daniel Alima Introduction and Context Check Point researchers are following an evolving, ongoing malspam campaign that is targeting more than 80 Turkish companies. The malware uses different evasive... Click to Read More

Warzone: Behind the enemy lines

February 3, 2020 1:47 am

Researched by: Yaroslav Harakhavik   Selling malware as a service (MaaS) is a reliable way for criminals to make money. Recently, various Remote Access Tools (RAT) have become increasingly popular. Though these RATs... Click to Read More

Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure (Part II)

January 30, 2020 4:00 am

Research by Ronen Shustin Cloud Attack Part II In the previous part  we talked about the Azure Stack architecture and mentioned that it can be extended with features that are not part of... Click to Read More

Predator the Thief

January 29, 2020 4:36 am

Overview Predator the Thief is a sophisticated malicious stealer which has been on the scene for around one and a half years. What started as coding experiments in malware development later evolved into... Click to Read More

Zoom-Zoom: We Are Watching You

January 28, 2020 4:00 am

Alexander Chailytko Cyber Security, Research & Innovation Manager In this publication we describe a technique which would have allowed a threat actor to potentially identify and join active meetings. All the details discussed... Click to Read More

Phorpiex Arsenal: Part I

January 27, 2020 7:34 am

The Phorpiex botnet currently consists of more than 1,000,000 infected Windows computers. In our previous publications, we wrote about the botnet architecture, its command and control infrastructure, and monetization methods: Phorpiex Breakdown In... Click to Read More

The 2020 Cyber Security Report

January 22, 2020 5:23 am

Crypto Miners, Targeted ransomware and cloud attacks dominate the threat landscape   Each year, Check Point Research (CPR) reviews previous year cyber incidents to gather key insights about the global cyber threat landscape.... Click to Read More

Tik or Tok? Is TikTok secure enough?

January 8, 2020 1:30 am

Researchers: Alon Boxiner, Eran Vaknin, Alexey Volodin, Dikla Barda, Roman Zaikin December 2019   Available in over 150 markets, used in 75 languages globally, and with over 1 billion users, TikTok has definitely... Click to Read More

Canadian banks targeted in a massive phishing campaign

December 23, 2019 3:00 am

Introduction Recently, Check Point engines detected a new phishing campaign impersonating the Royal Bank of Canada (RBC). The attack starts by sending legitimate-looking e-mails containing a PDF attachment to multiple organizations and victims... Click to Read More

BreakingApp – WhatsApp Crash & Data Loss Bug

December 17, 2019 3:00 am

By Dikla Barda, Roman Zaikin and Yaara Shriki Background: Some of the latest news regarding WhatsApp vulnerabilities are relating to a manipulation of the WhatsApp protocol using a tool built by Check Point... Click to Read More

DeCypherIT – All eggs in one basket

December 12, 2019 12:01 am

Research by: Arie Olshtein These days, attackers use cheap and publicly accessible services to help them bypass Anti-Virus protections and gain a foothold in their victims’ systems. We give a behind the scenes... Click to Read More