November 13, 2025
The State of Ransomware – Q3 2025
Record fragmentation and decentralization: The number of active extortion groups in Q3 2025 rose to a record of 85 groups, the highest number observed to date.…
Read more
November 13, 2025
November 5, 2025
How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation
On November 3, 2025, Check Point Research’s blockchain monitoring systems detected a sophisticated exploit targeting Balancer V2’s ComposableStablePool contracts. The attacker exploited arithmetic…
Read more
November 4, 2025
Exploiting Microsoft Teams: Impersonation and Spoofing Vulnerabilities Exposed
Check Point Research uncovered four vulnerabilities in Microsoft Teams that allow attackers to impersonate executives, manipulate messages, alter notifications, and forge identities in video and…
Read more
November 3, 2025
Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering
XLoader remains one of the most challenging malware families to analyze. Its code decrypts only at runtime and is protected by multiple layers of encryption, each…
Read more
November 2, 2025
Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure
Check Point Research (CPR) identified three security vulnerabilities in the Graphics Device Interface (GDI) in Windows. We promptly reported these issues to Microsoft, and they were…
Read more
October 23, 2025
Dissecting YouTube’s Malware Distribution Network
Check Point Research uncovered and analyzed the YouTube Ghost Network, a sophisticated and coordinated collection of malicious accounts operating on YouTube. These accounts systematically take…
Read more
October 16, 2025
Denial of Fuzzing: Rust in the Windows kernel
Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI)…
Read more
October 1, 2025
Rhadamanthys 0.9.x – walk through the updates
Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being…
Read more
September 22, 2025
Nimbus Manticore Deploys New Malware Targeting Europe
Check Point Research is tracking a long‑running campaign by the Iranian threat actor Nimbus Manticore, which overlaps with UNC1549, Smoke Sandstorm, and the “Iranian Dream Job”…
Read more
September 16, 2025
Under the Pure Curtain: From RAT to Builder to Coder
Check Point Research conducted a forensic analysis of a ClickFix campaign that lured victims with fake job offers that resulted in an eight-day intrusion. The threat…
Read more
September 12, 2025
Yurei & The Ghost of Open Source Ransomware
First observed on September 5, Yurei is a newly emerged ransomware group that targeted a Sri Lankan food manufacturing company as its first leaked victim. The…
Read more
August 28, 2025
Chasing the Silver Fox: Cat & Mouse in Kernel Shadows
Check Point Research (CPR) uncovered an ongoing in-the-wild campaign attributed to the Silver Fox APT which involves the abuse of a previously unknown vulnerable driver, amsdk.sys…
Read more