Check Point Research
@_CPResearch_
Followers
24K
Following
379
Media
137
Statuses
554
Fighting cyber threats one research at a time. News from Check Point’s (@checkpointSW) Research team.
The Internet
Joined April 2018
🔍 Critical flaws in Microsoft Teams could have allowed attackers to impersonate executives, spoof notifications, and alter messages — breaking the trust of a platform used by 320M+ people. Read more: https://t.co/Ya1UxMHRyl
#VulnerabilityResearch #MicrosoftTeams #CyberSecurity
research.checkpoint.com
By Andrey Charikov and Oded Vanunu Key Findings: Launched in March 2017, Microsoft Teams has become one of the most widely used communication and collaboration platforms in the world. As part of the...
3
47
135
A new approach to static analysis with AI that turns days of research into hours. No MCP or live IDA required. Using GPT-5, we completely cracked XLoader v8, one of the most challenging malware families to analyze. #XLoader #MalwareAnalysis #AI
research.checkpoint.com
Check Point Research succeeded in understanding the infamous malware family, Xloader, by leveraging Generative AI
1
66
186
🚨 We uncovered #security #vulnerabilities in #Windows graphics. #CVE-2025-30388 and CVE-2025-53766 are #BufferOverflows enabling #RemoteCodeExecution. CVE-2025-47984 leaks memory over the network due to an incomplete fix. 👇 https://t.co/mK5qUol34V
research.checkpoint.com
Background Check Point Research (CPR) identified three security vulnerabilities in the Graphics Device Interface (GDI) in Windows. We promptly reported these issues to Microsoft, and they were...
0
44
102
LockBit is attempting a comeback! 🎯 The new ransomware variant “ChuongDong”, targeting Windows, Linux, and ESXi, is already in the wild with potential victims span the globe. Read more: https://t.co/UT8GZKqvca
blog.checkpoint.com
Key Takeaways LockBit is back. After being disrupted in early 2024, the ransomware group has resurfaced and is already extorting new victims. New version,
8
29
87
🚨 Check Point Research uncovered a malware distribution network on #YouTube and reported over 3,000 malicious videos. Recent campaigns deliver the latest version of #Rhadamanthys #infostealer. Full report:
research.checkpoint.com
Research by: Antonis Terefos (@Tera0017) Key Points Introduction In recent years, threat actors have continuously adapted their tactics to discover new and effective methods for malware distribution....
2
44
108
👻 Some ghosts never die. Even with #Rust in the #Windows kernel, the Blue Screen of Death still haunts us. We uncovered a #DoS vulnerability in the Rust-based #GDI component that can trigger system-wide crashes and hard reboots. More details in our blog https://t.co/UKDvjBwrkd
research.checkpoint.com
Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in...
2
28
74
🚨 Rhadamanthys v0.9.2 is here! What’s new in this multi-layered stealer’s latest evolution? We break down the updates, tactics, and what defenders need to know. Dive into our blog for the full analysis. https://t.co/b5SL8bWR81
research.checkpoint.com
Research by: hasherezade Highlights Introduction Rhadamanthys is a complex, multi-modular malware sold on the underground market since September 2022. It was first advertised by the actor “kingcret...
0
32
112
Iranian threat actor #NimbusManticore (aka Smoke Sandstorm) launches advanced malware campaigns targeting Western Europe’s defense & telecom sectors with fake HR lures and evolving stealthy tools. Read More --> https://t.co/8Elb5SXdaz
research.checkpoint.com
Nimbus Manticore continuously attacks defense, manufacturing, telecommunications, and aviation targets aligned with the IRGC
7
45
124
🧪 Under the Pure Curtain: From RAT to Builder to Coder A deep dive into the Pure malware ecosystem — from IR engagement with ClickFix campaign to Rust loader and PureHVNC RAT deployment. https://t.co/piMQvv4kf8
research.checkpoint.com
Research by: Antonis Terefos (@Tera0017) Key Points Introduction The Pure malware family is a suite of malicious tools developed and sold by the author known as PureCoder. This suite includes PureH...
0
27
76
We analyzed #Yurei, a new ransomware group, and their open-source-based ransomware🔒. This research shows how open-source malware lowers the barrier, so that even low-skilled threat actors can run successful operations. https://t.co/fXJ4QrFpka
research.checkpoint.com
The latest ransomware group Yurei uses open source malware, Prince Ransomware, and has already claimed victims
0
32
96
🚨 Chasing the Silver Fox: Cat & Mouse in Kernel Shadows CP<r> uncovers: 🦊 Silver Fox APT in the wild 🔓 New vuln driver amsdk.sys 🛡️ EDR/AV evasion via PP/PPL kill ⚔️ Dual-driver trick 🐀 ValleyRAT payload 🚩 Patched driver bypassed w/ 1-byte flip
research.checkpoint.com
An ongoing in-the-wild campaign by Silver Fox APT abuses a previously unknown vulnerable driver to terminate protected processes
1
44
102
Phishing, but backwards ↩️ ✉️ Meet #ZipLine, where actors flipped the script: the victims send the first e-mail. 👾 Weeks of back-and-forth later, attackers dropped #MixShell in ZIPs disguised as legal docs. Read more about this elaborate campaign: https://t.co/Kg0FznsHj5
research.checkpoint.com
Check Point Research exposes ZipLine, an advanced phishing campaign targeting U.S. manufacturing with MixShell malware and AI-themed lures
0
25
67
📖 Full write-up here → https://t.co/7NnOY141nF Props to the @cursor_aiteam for fixing it quickly in v1.3. #CyberSecurity #AItools #SupplyChainSecurity #CursorIDE #CheckPointResearch #RCE
research.checkpoint.com
Identified Cursor IDE's vulnerability allows attackers to modify MCP configuration files after its one-time approval system
0
5
21
🌐 Wider implications: This flaw reveals a deeper trust issue in AI-assisted developer tools. As LLMs & automation get baked into coding workflows, securing the AI supply chain becomes critical.
1
2
9
Three months of confusion. One revelation: God was listening the whole time. Get the rest of the story on my page.
0
9
133
⚙️ How it works: After a user approves an MCP file, Cursor continues to trust it—even if it's later changed. This lets attackers inject malicious code without triggering new prompts.
1
2
5
🚨 New research alert Check Point Research discovered a critical RCE vulnerability (CVE-2025-54136) in Cursor, a fast-growing AI-powered IDE. The flaw allows persistent, silent code execution by modifying previously approved Model Context Protocol (MCP) configs. 🧵More below:
8
40
143
Unmasking the China-nexus #Storm2603 toolset that pre-dated the ToolShell wave. 📅Active since at least Apr 2025. 🔑Multiple ransomware deployed together: LockBit + Warlock. 💥Custom backdoors: ak47dns & ak47http. Read more --> https://t.co/ah6i4DT1FG
research.checkpoint.com
Key Findings Introduction Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as...
1
33
50
The State of Ransomware - Q2 : ⏳Disappearance of significant RaaS groups 🔧Decline in publicly posted victims 🔝Qilin – the new leader introduces innovative extortion methods 🔑Ongoing shift from encryption to data theft-based extortion https://t.co/fR5GR64TcY
research.checkpoint.com
Key Findings Several prominent RaaS groups, including RansomHub, Babuk-Bjorka, FunkSec, BianLIan, 8Base, Cactus, Hunters International, and Lockbit, stopped publishing new victims. Though the reasons...
2
14
42
Federal investigators are taking a closer look at the Black Lives Matter Global Network Foundation’s finances. What could this probe mean for transparency, accountability, and the broader nonprofit sector?
19
30
195