lostpacket

Threat Researcher at @_CPResearch_

[Check Point Research @_CPResearch_]

🚨ALERT🚨

Gulf countries, Cyprus & Israel - A massive wave of IP camera scanning and exploitation from Iran-linked infrastructure.

✅ Patch to the latest version
🔐 Enforce strong, unique passwords and restrict external access

Read More :
https://t.co/iuZkd446nQ

[Check Point Research @_CPResearch_]

China-linked #InkDragon expands into Europe, building a distributed relay network by weaponizing compromised servers with a custom #ShadowPad IIS listener alongside new TTPs and an evolved FinalDraft.https://t.co/HiVSN2rngc

[lostpacket @_lostpacket_]

@_JohnHammond We reported this issue to Microsoft back in June, also talked about it at @labscon_io and @virusbtn — and, well, you already know how that turned out :)

[Check Point Research @_CPResearch_]

Unmasking the China-nexus #Storm2603 toolset that pre-dated the ToolShell wave.
📅Active since at least Apr 2025.
🔑Multiple ransomware deployed together: LockBit + Warlock.
💥Custom backdoors: ak47dns & ak47http.

Read more -->
https://t.co/ah6i4DT1FG

[Check Point Research @_CPResearch_]

🇮🇷🇮🇱 In their latest phishing campaigns, Iranian APT Educated Manticore poses as cybersecurity researchers and executives to target top tech academics in Israel:

🔗 Fake Google Meet meetings
🌐 Phishing kits as Single Page App with React

👉 Details: https://t.co/W0neXbcnUU

[Check Point Research @_CPResearch_]

Zero-Day used by Stealth Falcon APT group in a spear-phishing campaign:
💥 .URL file exploitation (assigned CVE-2025-33053)
🧰 Custom Mythic implants, LOLBins, and custom payloads
🌍 High-profile targets across the Middle East and Africa
https://t.co/OnQmC2GBLJ

[Check Point Research @_CPResearch_]

Following the advisory, CPR shares an in-depth analysis of the malware attributed to Emennet Pasargad:
🐁 WezRat: a custom infostealer
🧀 Uses DLL modules for screenshots, keylogging, file theft, etc.
🐈 Over a year of activity and evolution

Read more:
👉 https://t.co/P7UtZkvlqk

[Check Point Research @_CPResearch_]

🇪🇺Amid the upcoming EU membership referendum, Moldova is being hit with #disinformation emails aimed at discrediting the pro-EU course and its supporters.

🕵️Read more about hybrid disinformation-malware operations across Europe by the #LyingPigeon group:

https://t.co/6gtNMONUqI

[Bernardo Quintero @bquintero]

20 years of VirusTotal: 2004-2024

[lostpacket @_lostpacket_]

@thepacketrat Duolingo always prepares you for the best case scenario. In others, Maria pours kefir into this salad and calls it a soup.

[lostpacket @_lostpacket_]

While most associate this report with the Israel-Hamas conflict, the actor managed to infiltrate numerous high-profile targets throughout the Middle East in recent years. Given their track record of sharing access with disruptive malware operators, this is a region-wide concern.

[Check Point Research @_CPResearch_]

[4\5] ScarredManticore has been consistently targeting high-profile organizations in Saudi Arabia, UAE, Kuwait, Oman, Jordan, and Israel. The most commonly targeted sectors are Government and Telecommunications.

[Check Point Research @_CPResearch_]

[1/5] CPR in collaboration with @sygnia_labs has been tracking #ScarredManticore, one of the most sophisticated Iranian threat actors uncovered to date. Attributed to the MOIS, it is linked to some of the most impactful Iranian intrusions in recent years.
https://t.co/Oi5Tg9a9Ab

[lostpacket @_lostpacket_]

@thehellu or simply from VT

[Greg Brooks @GregBrooksOH]

This coup could have been an email

[Check Point Research @_CPResearch_]

Amid the crisis in Azerbaijan’s breakaway region of Nagorno-Karabakh, our new report reveals Azerbaijani political surveillance using #OxtaRAT malware:

🕵️AutoIT/JPEG polyglot file
🎯Targets activists in Azerbaijan🇦🇿 and entities in Armenia🇦🇲

Read more >>
https://t.co/qq8VU6bIyC

[lostpacket @_lostpacket_]

Since the end of March, all the files submitted to VirusTotal from Donetsk and Luhansk regions are shown in their telemetry as ZZ country. @virustotal Any chance you can assist with geography to your geolocation services provider?

[Check Point Research @_CPResearch_]

#CloudAtlas continues its operations and during the last year narrows its targeting :
🎯Focus on Russia, Belarus and conflicted areas in Ukraine and Moldova
👾New DLL to proxy connections through the victims’ machines.

👉https://t.co/D6gkpC2ttY

[Check Point Research @_CPResearch_]

We Reveal 7 Years of #ScarletMimic Mobile Surveillance Campaign Targeting Uyghurs:

📱 More than 20 different Android samples
📄 Uyghur-related lures
👁️ Full surveillance capabilities
🤙 Conduct calls and SMS from victim's device

Read More:
https://t.co/Wy3ByDYj9p

[lostpacket @_lostpacket_]

@vinopaljiri @_CPResearch_ @CheckPointSW Happy Birthday and welcome to the team! We are so excited to have you on board! 🙏

[lostpacket @_lostpacket_]

Thank you everyone who made #HagueTIX2022 happen. It was insightful, it was fun, and it had trains!