Check Point Research

Online/Digital
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber attack data stored on ThreatCloud to keep hackers at bay while ensuring all Check Point products are updated with the latest protections. From the moment a breach is initiated, ThreatCloud begins sharing data across the entire network, providing researchers with the intelligence they need to deeply analyze and report on attacks. Check Point Research publications and intelligence sharing fuel the discovery of new cyber threats and the development of the international threat intelligence community to keep you secure. Source

Actions

Share this page

Media Outlet details

Scope International
Language English
Country United States of America
Similarweb UVMSimilarweb UVM Request pricing
Comscore UVMComscore UVM Request pricing

Recent Articles

Search

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

|
By public enum Command.Type
| Check Point Research
Check Point Research (CPR) tracks ‘Cavern Manticore’ as an Iran-nexus threat actor operating against Israeli targets, with a focus on the government and IT sectors. Cavern Manticore shares technical overlaps with other Iranian MOIS (Ministry of Intelligence and Security)-linked threat actors, including MuddyWater and Lyceum. CPR observed a modular C2 framework in the wild, with all samples built on top of .NET but compiled into different output formats.
Open in Who Shared Issue with article?

6th July – Threat Intelligence Report

| Check Point Research
For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated.
Open in Who Shared View Duplicates (2) Issue with article?

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

| Check Point Research
Research by: Alexey Bukhteyev AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns. In this research, DeepSeek connected unrealistic browser-malware concepts with a real browser capability, turning an AI-generated malware hallucination into a plausible browser-native ransomware technique.
Open in Who Shared Issue with article?

29th June – Threat Intelligence Report

| Check Point Research
For the latest discoveries in cyber research for the week of 29th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Polymarket, a large cryptocurrency-based prediction market, has confirmed a supply chain attack after a third-party frontend vendor breach led to malicious JavaScript being injected into its website.
Open in Who Shared Issue with article?

22nd June – Threat Intelligence Report

| Check Point Research
For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for 3,087,721 hunting and fishing license customers. Social Security numbers and payment data were not affected.
Open in Who Shared View Duplicates (2) Issue with article?

From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker

| Check Point Research
The threat actor uses multiple channels to promote and distribute a Rust clipboard hijacker, starting with a dedicated phishing page as the central hub and extending to GitHub and SourceForge projects promoted by fake accounts. A dedicated YouTube channel, using AI‑generated narrators, suspicious view spikes, and highly positive (likely coordinated) comments, further reinforces the illusion of popularity and trustworthiness.
Open in Who Shared View Duplicates (2) Issue with article?

15th June – Threat Intelligence Report

| Check Point Research
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Nottingham, a UK research university, has suffered a data breach after ShinyHunters accessed its student records system. The incident affected about 454,600 current and former students and exposed contact details, passport numbers, enrollment information, and fee payment records later appeared online.
Open in Who Shared View Duplicates (2) Issue with article?

From SQLi to RCE – Exploiting LangGraph’s Checkpointer

| Check Point Research
By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? Check Point Research analyzed LangGraph, an open-source framework for stateful AI agents with over 50 million monthly downloads, and uncovered three vulnerabilities in its persistence layer.
Open in Who Shared View Duplicates (2) Issue with article?

8th June – Threat Intelligence Report

| Check Point Research
For the latest discoveries in cyber research for the week of 1st June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES DentaQuest, a U.S. dental benefits administrator owned by Sun Life, has suffered a data breach after threat group ShinyHunters leaked exfiltrated data. Analysts assessed that 2.6 million accounts were exposed, including names, emails, government IDs, and health insurance details.
Open in Who Shared View Duplicates (2) Issue with article?

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

| Check Point Research
Research by: Alexey Bukhteyev Check Point Research investigateda large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing real upstream resources. The deception is not in the page content alone, it’s in what happens when a user interacts.
Open in Who Shared Issue with article?