Bandook: Signed & Delivered

November 26, 2020 2:21 pm

Introduction Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from... Click to Read More

Pay2Key – The Plot Thickens

November 12, 2020 12:58 pm

Introduction Last weekend we issued a ransomware alert about a wave of attacks using a never-seen-before strain dubbed ‘Pay2Key.’ Our investigation suggested the ransomware operators were mostly targeting Israeli companies.  The ransomware used... Click to Read More

Ransomware Alert: Pay2Key

November 6, 2020 1:53 pm

Introduction Over the past week, an exceptional number of Israeli companies reported ransomware attacks. While some of the attacks were carried out by known ransomware strands like REvil and Ryuk, several large corporations... Click to Read More

Exploit Developer Spotlight: The Story of PlayBit

October 26, 2020 1:00 pm

Research By: Eyal Itkin and Itay Cohen Introduction Exploits have always been an important and integral part of malicious attacks. They allow attackers to gain capabilities that are not easy to achieve otherwise.... Click to Read More

Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints

October 2, 2020 1:00 pm

Research by: Itay Cohen, Eyal Itkin In the past months, our Vulnerability and Malware Research teams joined efforts to focus on the exploits inside the malware and specifically, on the exploit writers themselves.... Click to Read More

Rampant Kitten – An Iranian Espionage Campaign

September 18, 2020 12:58 pm

Introduction Check Point Research unraveled an ongoing surveillance operation by Iranian entities that has been targeting Iranian expats and dissidents for years. While some individual sightings of this attack were previously reported by... Click to Read More

Gozi: The Malware with a Thousand Faces

August 28, 2020 12:57 pm

Introduction Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the... Click to Read More

An Old Bot’s Nasty New Tricks: Exploring Qbot’s Latest Attack Methods

August 27, 2020 12:57 pm

Research By: Alex Ilgayev Introduction The notorious banking trojan Qbot has been in business for more than a decade. The malware, which has also been dubbed Qakbot and Pinkslipbot, was discovered in 2008... Click to Read More

Keeping the gate locked on your IoT devices: Vulnerabilities found on Amazon’s Alexa

August 13, 2020 1:59 am

Research By: Dikla Barda, Roman Zaikin , Yaara Shriki  Introduction & Motivation “Please lower the temperature of the AC, it’s getting humid in here,” said Eric to Alexa, who turned the AC to... Click to Read More

Don’t be silly – it’s only a lightbulb

August 7, 2020 1:28 pm

Research by: Eyal Itkin Background Everyone is familiar with the concept of IoT, the Internet of Things, but how many have heard of smart lightbulbs? You can control the light in your house, and... Click to Read More

CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository

August 5, 2020 1:34 am

Debugging is the essential part of malware analysis. Every time we need to drill down into malware behavior, restore encryption methods or examine communication protocols – generally, whenever we need to examine memory... Click to Read More

Hacker, 22, seeks LTR with your data: vulnerabilities found on popular OkCupid dating app

July 29, 2020 2:00 am

No Actual Daters Harmed in This Exercise   Research by Alon Boxiner, Eran Vaknin With over 50 million registered users since its launch, and the majority aged between 25 and 34, OkCupid is... Click to Read More


July 22, 2020 2:00 am

In the past six months, the way we live and work has changed beyond recognition. To put it simply – life on earth has gone online. The change was not gradual but happened... Click to Read More

SIGRed – Resolving Your Way into Domain Admin: Exploiting a 17 Year-old Bug in Windows DNS Servers

July 14, 2020 10:39 am

Research by: Sagi Tzadik Introduction DNS, which is often described as the “phonebook of the internet”, is a network protocol for translating human-friendly computer hostnames into IP addresses. Because it is such a... Click to Read More

Would you like some RCE with your Guacamole?

July 2, 2020 2:31 am

Research by: Eyal Itkin Overview In many companies, the daily routine involves coming to the office each day to work on your company computer, safely inside the corporate network. Once in a while, a... Click to Read More