Check Point Research Archives • Daily CyberSecurity

Unmasked: 16GB “Rocket” Database Leak Exposes The Gentlemen Ransomware Cartel The Gentlemen Ransomware Leak Rocket Database RaaS

Unmasked: 16GB “Rocket” Database Leak Exposes The Gentlemen Ransomware Cartel

Do Son May 18, 2026

A massive internal data leak has blown the lid off “The Gentlemen,” a highly organized Ransomware-as-a-Service (RaaS)...

Broken by Design: How VECT 2.0 Ransomware Becomes a Permanent Data Wiper

Do Son April 30, 2026

A new investigation by Check Point Research (CPR) has revealed that the “ambitious” VECT 2.0 ransomware—currently targeting...

Iran-Linked “Password Spraying” Targets Municipal Response to Missile Strikes Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Iran-Linked “Password Spraying” Targets Municipal Response to Missile Strikes

Do Son April 6, 2026

Check Point Research (CPR) has been tracking an extensive password-spraying operation targeting Microsoft 365 environments, conducted by...

ChatGPT Lockdown Mode OpenAI OpenClaw acquisition OpenAI Prism GPT-5.2 LaTeX, scientific research AI workspace OpenAI, Mixpanel Breach ChatGPT Data Preservation, NYT Lawsuit ChatGPT Apps SDK, super app OpenAI Jony Ive, AI Hardware Delay Musk Apple lawsuit, App Store antitrust UK AI Partnership, OpenAI Collaboration Jony Ive OpenAI, DoD Contract OpenAI Lawsuit, ChatGPT Privacy North Korea ChatGPT - GPT-4.5 model OpenAI Models, AI Advancements OpenAI pricing, Flex API

The DNS Trap: How a “Hidden” Path Allowed ChatGPT to Silently Leak Your Private Data

Do Son April 6, 2026

In the world of AI, trust is built on a simple, unspoken agreement: what stays in the...

Weaver E-cology RCE CVE-2026-22679 CVE-2026-20127 Cisco SD-WAN Exploitation AI-Driven Cyberattack ARXON Malware React Server Components Vulnerability CVE-2025-55182 FortiWeb Auth Bypass, Unauthenticated Admin Takeover RayInitiator Bootkit, LINE VIPER CVE-2025-59689 Department of the Treasury cybersecurity - CVE-2025-0108 PoC CVE-2025-31103 Dior Data Breach SK Telecom data breach, long-term intrusion

TrueChaos: The TrueConf Zero-Day That Turned Secure Updates Into a Government Espionage Backdoor

Do Son April 1, 2026

A trusted communication tool has been turned into a weapon of mass malware distribution. Check Point Research...

The Face of Destruction: Inside Void Manticore’s ‘Handala Hack’ AI-Assisted Wiping Operations Void Manticore Handala Hack

The Face of Destruction: Inside Void Manticore’s ‘Handala Hack’ AI-Assisted Wiping Operations

Do Son March 16, 2026

Cybersecurity researchers at Check Point Research have released a detailed expose on Handala Hack, a prominent online...

Blurring the Lines: How Iranian State Hackers are Weaponizing RaaS and the Cybercriminal Underground Iranian Cyber Espionage Void Manticore

Blurring the Lines: How Iranian State Hackers are Weaponizing RaaS and the Cybercriminal Underground

Do Son March 15, 2026

A striking evolution is occurring in the world of state-sponsored cyber warfare. According to a recent deep-dive...

Eyes on the Front: Iranian Threat Actors Weaponize IP Cameras in Middle East Conflict Iranian Cyber Reconnaissance IP Camera Security NCSC Warning Russian Hacktivists Taiwan Cyberattacks China State-Sponsored Hacking state-sponsored threat actor Ransomware RAT Abuse, AnyDesk

Iranian Cyber Reconnaissance IP Camera Security NCSC Warning Russian Hacktivists Taiwan Cyberattacks China State-Sponsored Hacking state-sponsored threat actor Ransomware RAT Abuse, AnyDesk

Eyes on the Front: Iranian Threat Actors Weaponize IP Cameras in Middle East Conflict

Do Son March 6, 2026

As modern warfare increasingly moves into the digital realm, a new report from Check Point Research (CPR)...

Unmasking Silver Dragon: The Chinese-Nexus APT Haunting Southeast Asia and Europe CloudComputating - QSC framework

Unmasking Silver Dragon: The Chinese-Nexus APT Haunting Southeast Asia and Europe

Do Son March 5, 2026

Cybersecurity researchers at Check Point Research (CPR) have lifted the veil on a sophisticated advanced persistent threat...

Code by AI: KONNI APT Targets Crypto Devs with “Polished” Backdoor NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

Code by AI: KONNI APT Targets Crypto Devs with “Polished” Backdoor

Do Son January 26, 2026

The KONNI APT group, a threat actor historically aligned with North Korean interests, has launched a sophisticated...

VoidLink: The First Advanced Malware Framework Architected Entirely by AI NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

VoidLink: The First Advanced Malware Framework Architected Entirely by AI

Do Son January 21, 2026

In a new report, Check Point Research (CPR) has unveiled “VoidLink,” a sophisticated malware framework that wasn’t...

40,000 Hits in 4 Hours: RondoDox Botnet Storms HPE OneView GUARDIANWALL MailSuite Exploit CVE-2026-32661 FileZen Vulnerability CVE-2026-25108 Ivanti EPMM Vulnerability Dormant Backdoor Fortinet Authentication Bypass CVE-2026-24858 VMware vCenter Server Flaw CVE-2025-21590

GUARDIANWALL MailSuite Exploit CVE-2026-32661 FileZen Vulnerability CVE-2026-25108 Ivanti EPMM Vulnerability Dormant Backdoor Fortinet Authentication Bypass CVE-2026-24858 VMware vCenter Server Flaw CVE-2025-21590

40,000 Hits in 4 Hours: RondoDox Botnet Storms HPE OneView

Do Son January 16, 2026

Check Point Research uncovered a massive, automated assault on HPE OneView. Researchers observed a botnet launching over...

Sicarii Ransomware Masquerades as Israeli Hacktivists AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Sicarii Ransomware Masquerades as Israeli Hacktivists

Do Son January 16, 2026

Security researchers at Check Point have released an analysis of Sicarii, a Ransomware-as-a-Service (RaaS) group that emerged...

VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers

Do Son January 14, 2026

A new, highly sophisticated malware framework has emerged from the shadows, specifically engineered to infest the modern...

GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet

Do Son January 8, 2026

A sophisticated new variant of the GoBruteforcer botnet is on the loose, and it’s capitalizing on a...

YouTube Ghost Network: The New GachiLoader Malware Hiding in Your Favorite Video Links GachiLoader, YouTube Ghost Network

YouTube Ghost Network: The New GachiLoader Malware Hiding in Your Favorite Video Links

Do Son December 19, 2025

A massive network of compromised YouTube accounts is being weaponized to spread a sophisticated new threat, turning...

Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes Salt Typhoon Teleco Hack, Cisco Academy Link CVE-2025-0282 PoC exploit

Salt Typhoon Teleco Hack, Cisco Academy Link CVE-2025-0282 PoC exploit

Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes

Do Son December 18, 2025

A sophisticated Chinese cyber-espionage group is rewriting the rules of persistence, turning compromised government servers into a...

Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier AI Fraud Schemes TAMECAT Malware APT42 Espionage

AI Fraud Schemes TAMECAT Malware APT42 Espionage

Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier

Do Son October 2, 2025

The notorious Rhadamanthys stealer, first released in 2022, has returned with a powerful new update that underscores...

Yurei: The New Ransomware Group Using Open-Source Code to Target Businesses Yurei ransomware, open-source malware

Yurei: The New Ransomware Group Using Open-Source Code to Target Businesses

Do Son September 16, 2025

Recently, researchers at Check Point Research (CPR) identified a new ransomware group calling itself Yurei—a name inspired...

Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor Silver Fox, vulnerable driver

Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor

Do Son September 1, 2025

Check Point Research (CPR) has uncovered a sophisticated campaign by the Silver Fox APT group leveraging a...

Critical Alert 1 Active Exploit Detected Today