Check Point Research

Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns

Key Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security ...
research.checkpoint

Check Point Research Publications

Key Points Agentic hacking platforms like ARTEX, where AI models autonomously drive vulnerability discovery and exploitation, have ...
research.checkpoint

Global Cyber Attack Reports

For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS ... For the latest ...
research.checkpoint

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia

Check Point Research has identified several campaigns targeting multiple countries in the Southeast Asian region. These related activities have been collectively categorized under the codename ...
research.checkpoint

Inside Akira Ransomware’s Rust Experiment

Earlier this year, Talos published an update on the ongoing evolution of Akira ransomware-as-a-service (RaaS) that has become one of the more prominent players in the current ransomware landscape.
research.checkpoint

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking

To prevent remote code execution, AVs and EDRs try to monitor APIs related to known techniques (examples of monitored functions can be found in Mr-Un1k0d3r’s ...
research.checkpoint

Nimbus Manticore Deploys New Malware Targeting Europe

Since early 2025, Check Point Research (CPR) has tracked waves of Nimbus Manticore activity. Known as UNC1549 or Smoke Sandstorm, Nimbus Manticore is a mature Iran-nexus APT group that primarily ...
research.checkpoint

Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal

Following our VIEW8 publication, an open source tool for analysis of Compiled JavaScript files (JSC), we are continuously tracking the usage of such files by threat actors. Among the threats we ...
research.checkpoint

Inside the Box: Malware’s New Playground

Over the past few months, we have been monitoring the increasing abuse of BoxedApp products in the wild. BoxedApp products are commercial packers that provide advanced features such as Virtual Storage ...
research.checkpoint

Bugs on the Windshield: Fuzzing the Windows Kernel

In our previous research, we used WinAFL to fuzz user-space applications running on Windows, and found over 50 vulnerabilities in Adobe Reader and Microsoft Edge. For our next challenge, we decided to ...
research.checkpoint

Behind the Scenes of BBTok: Analyzing a Banker’s Server Side Components

Check Point Research recently discovered an active campaign operating and deploying a new variant of the BBTok banker in Latin America. In the research, we highlight newly discovered infection chains ...
research.checkpoint

The State of Ransomware – Q1 2026

During the first quarter of 2026, we monitored more than 70 active data leak sites (DLS) that collectively listed 2,122 new victims. This figure represents a 12.2% decline from the Q4 2025 all-time ...