Check Point Research

Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns

Key Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security ...
research.checkpoint

ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration

Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled ...
research.checkpoint

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake ...
research.checkpoint

5th October – Threat Intelligence Report

Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway. Attackers have exploited the flaws to gain remote access, deploy web shells and ...
research.checkpoint

AI Threat Landscape Digest: July–August 2026

The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and ...
research.checkpoint

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

These indicators strongly resembled malicious kernel loader behavior, particularly given prior research into exotic loading mechanisms such as loading kernel drivers directly from ADS paths – a ...
research.checkpoint

Global Cyber Attack Reports

For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin. TOP ATTACKS ... For the latest discoveries ...
research.checkpoint

AI Security Report 2026

For years, the cyber security industry tracked AI as a force multiplier: something that made existing attack techniques faster, cheaper, and more accessible. That framing was accurate. But the Annual ...
research.checkpoint

VECT: Ransomware by design, Wiper by accident

Figure 1: Announcement of partnership with BreachForums and TeamPCP. In addition, VECT announced a partnership with BreachForums itself, promising that every registered forum user will become an ...
research.checkpoint

DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple underground forums, promoting ...
research.checkpoint

“Handala Hack” – Unveiling Group’s Modus Operandi

Handala Hack, also tracked by Check Point Research as Void Manticore, is an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The ...
research.checkpoint

2025: The Untold Stories of Check Point Research

Check Point Research (CPR) continuously tracks threats, following the clues that lead to major players and incidents in the threat landscape. Whether it’s high-end financially-motivated campaigns or ...