Yuval Sadowsky

Malware Analyst At
@_CPResearch_

[BlueHat IL @BlueHatIL]

Taking a closer look inside VoidLink, Yuval Sadowsky and David Driker explored Chinese commercial-grade cloud native malware.

[BlueHat IL @BlueHatIL]

It all comes down to this. One last chance to register for BlueHatIL: https://t.co/Rl8t6wHSOj

[Check Point Research @_CPResearch_]

Iranian threat actor #NimbusManticore rapidly developed its tooling, introducing the AI-assisted MiniFast backdoor and new delivery methods including trojanized software and SEO-poisoned sites.

Read More -->
https://t.co/hPjlKBFMFt

[BlueHat IL @BlueHatIL]

New date. Same BlueHatIL energy.
It’s happening - save the date 🗓️
More details soon.

[Check Point Research @_CPResearch_]

⚠️ Iranian APT conducts a wide M365 password spray campaign - focus on Israeli and UAE orgs

🌐TOR used to scan and spray, Israeli VPN infrastructure used for successful logins

🏙️ Israeli municipalities - key focus, likely for missiles BDA

Read more :
https://t.co/N7rJbCJ08t

[Check Point Research @_CPResearch_]

Operation TrueChaos
Zero-day exploited in the wild by Chinese-nexus actor

💥 TrueConf client CVE-2026-3502

🌏 Southeast Asian government entities

🧰 Havoc C2, DLL sideloading, UAC bypass

Read more :
https://t.co/XgzxRBiPd4

[Virus Bulletin @virusbtn]

Check Point researchers have observed increased activity by Chinese-nexus APT actors in the Middle East. Camaro Dragon attempted to deploy a variant of PlugX malware against Qatari targets within one day of the launch of Operation Epic Fury. https://t.co/vJs2LlLUaK

[Check Point Research @_CPResearch_]

🚨ALERT🚨

Gulf countries, Cyprus & Israel - A massive wave of IP camera scanning and exploitation from Iran-linked infrastructure.

✅ Patch to the latest version
🔐 Enforce strong, unique passwords and restrict external access

Read More :
https://t.co/iuZkd446nQ

[BlueHat IL @BlueHatIL]

Last call for BlueHat IL. 1 week left to register - move now before it’s too late: https://t.co/0OoFB1vf92

[Check Point Research @_CPResearch_]

📜🤫2025: The Untold Stories of Check Point Research
Zero-days, wipers, election interference - much of what we uncover never makes it into public reports.
From #APT36 to #MuddyWater, #COLDRIVER to #FlaxTyphoon, here's what we tracked across every region.
https://t.co/OmcamzHreQ

[BlueHat IL @BlueHatIL]

The wait is over! Registration and the full agenda for BlueHatIL 2026 are now live. Register now before spots are gone!
Register here: https://t.co/zVl9dIyv4u
Full agenda: https://t.co/tumf4VWCVG

[Check Point Research @_CPResearch_]

#Voidlink, A new era of malware has arrived! We discovered that the framework was built nearly end-to-end using agentic AI. It stands as an alarming example of what experienced actors are capable of using artificial intelligence.
https://t.co/4cGE620Nrd

[Check Point Research @_CPResearch_]

Deep dive into the new #Sicarii ransomware: technical details and the bigger question - is it pure cybercrime, political signaling, or a possible false flag operation?

Read More :
https://t.co/jAOzQWmvTt

[Check Point Research @_CPResearch_]

Check Point Research unveils #VoidLink, a highly modular Linux malware framework with 30+ plugins, cloud/container persistence, robust OPSEC (runtime encryption, rootkits, self-delete), and links to Chinese-affiliated actors. Full analysis on our blog
https://t.co/9ucKf6eyGC

[Check Point Research @_CPResearch_]

Iranian threat actor #NimbusManticore (aka Smoke Sandstorm) launches advanced malware campaigns targeting Western Europe’s defense & telecom sectors with fake HR lures and evolving stealthy tools.

Read More -->
https://t.co/8Elb5SXdaz

[Check Point Research @_CPResearch_]

Unmasking the China-nexus #Storm2603 toolset that pre-dated the ToolShell wave.
📅Active since at least Apr 2025.
🔑Multiple ransomware deployed together: LockBit + Warlock.
💥Custom backdoors: ak47dns & ak47http.

Read more -->
https://t.co/ah6i4DT1FG

[Check Point Research @_CPResearch_]

Malicious executions of compiled JavaScript, leading to the of JSCEAL — a stealthy, multi-stage crypto stealer :
⚠️ Malicious ads for fake crypto apps installers
🧩 Modular PowerShell loaders
🕵️ Unique evasion techniques that kept the campaign undetected

https://t.co/S9DTH0QU0i

[Check Point Research @_CPResearch_]

🚨 The Sting of Fake Kling: Our latest research uncovers a global malvertising campaign impersonating #KlingAI—delivering a masqueraded, multi-stage #infostealer.
https://t.co/Onbwih7j0G

[Check Point Research @_CPResearch_]

CVE-2025-24054 was patched in Microsoft’s March 11 update, but just over a week later, threat actors began exploiting this NTLM Hash Disclosure Spoofing vulnerability in the wild.
Stay patched. 🔒

Read More -->
https://t.co/cGVWNO4ERu

[Check Point Research @_CPResearch_]

#APT29 (#CozyBear) is back — this time with a twist of 🍷
📨 Fake diplomat wine event invites
🎯 Targeting government entities across Europe
🧬 New custom loader we’re calling #Grapeloader along with a new variant of #Wineloader

Read more --> https://t.co/l7s871LX0j