research.checkpoint

When LLM Gateways Go Wrong: Findings from LiteLLM

Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved ...
research.checkpoint

12th October – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin.
research.checkpoint

5th October – Threat Intelligence Report

Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway. Attackers have exploited the flaws to gain remote access, deploy web shells and ...
research.checkpoint

Check Point Research Publications

TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact ...
research.checkpoint

Global Cyber Attack Reports

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS ...
research.checkpoint

Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives

In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro ...
research.checkpoint

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia

Check Point Research has identified several campaigns targeting multiple countries in the Southeast Asian region. These related activities have been collectively categorized under the codename ...
research.checkpoint

Researching Xiaomi’s TEE to get to Chinese money

Have you ever wondered if it is safe to make payments from a mobile device? Can a malicious app steal money from your digital wallet? According to the latest statistics, the Far East and China ...
research.checkpoint

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor notorious for persistently targeting Indian government organizations, diplomatic personnel, and military facilities. APT36 has ...
research.checkpoint

VECT: Ransomware by design, Wiper by accident

Figure 1: Announcement of partnership with BreachForums and TeamPCP. In addition, VECT announced a partnership with BreachForums itself, promising that every registered forum user will become an ...
research.checkpoint

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking

To prevent remote code execution, AVs and EDRs try to monitor APIs related to known techniques (examples of monitored functions can be found in Mr-Un1k0d3r’s ...
research.checkpoint

Do you like to read? I can take over your Kindle with an e-book

Since 2007, Amazon has sold tens of millions of Kindles, which is impressive. But this also means that tens of millions of people could have potentially been hacked through a software bug in those ...