CopperDragon: Uncovering a Global China-Nexus Cyber Espionage Framework

A year-long Check Point Research investigation has connected three China-nexus cyber-espionage clusters targeting government, telecommunications and critical infrastructure organizations across Europe, Asia and Latin America. While parts of this activity have previously been reported separately, the wider investigation reveals new insights and connections through shared malware and infrastructure, pointing to a broader ecosystem linked to an entity Check Point Research tracks as “CopperDragon”. CopperDragon may operate as a digital quartermaster, developing or supplying malware and infrastructure to multiple sophisticated China-nexus threat actors. By examining the connections between these campaigns, Check Point Research provides a broader view of an espionage ecosystem […]

The post CopperDragon: Uncovering a Global China-Nexus Cyber Espionage Framework appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/cWS9ouE
via

How Safe Remediation Reduces Exposure Without Disrupting Production

The exposure is critical, the exploit is public, and the affected system supports a production application. Security needs the risk reduced before attackers can use it. Infrastructure and application teams carry a different responsibility. They need to understand whether the proposed action could block legitimate traffic, consume additional resources, affect availability, or interrupt a system the business relies on. They also need a safe path back if the change behaves unexpectedly. Both sides are protecting the organization. Safe Remediation gives them the evidence to move forward together. Safe Remediation: Confident Remediation in Production examines how Check Point Exposure Management evaluates […]

The post How Safe Remediation Reduces Exposure Without Disrupting Production appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/8mp3ZDL
via

Beyond Unified Detection: What Email Security Teams Need to Control

For email security teams, evaluating an integration means understanding both the detections it brings together and the quarantine management and administrative workflows it supports. Proofpoint’s integration with Microsoft’s Integrated Cloud Email Security (ICES) ecosystem brings its post-delivery detections into Microsoft Defender and consolidates investigation and remediation workflows. For customers, the next step is to understand how that integration supports their requirements for administrator-configured enforcement. Within ICES, Microsoft applies enforcement based on submitted verdicts, verdict severity, and configured policies. Proofpoint contributes its assessments within that model; a third-party engine does not independently override a Microsoft malicious verdict through ICES. Customers can […]

The post Beyond Unified Detection: What Email Security Teams Need to Control appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/F15pskD
via

A Critical SSH Password Bypass Hits musl-Based Linux

OpenSSH 10.6p2 shipped on November 5, 2026, and it closes a critical password authentication bypass. On affected systems, anyone who can reach the SSH port can log in without knowing a password.   If you run sshd on musl-based Linux with pluggable authentication modules (PAM) disabled, Alpine Linux being the common example, upgrade today.  At Check Point Software, our testing adds two points to the public advisory. The attack needs a second account that is active and has a real password, because a stored hash alone is not enough. Two conditions are also visible remotely before login: the OpenSSH version in […]

The post A Critical SSH Password Bypass Hits musl-Based Linux appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/gc0eMyu
via

Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks

AI agents are already changing how cyberattacks are carried out. Check Point Research (CPR) analyzed ARTEX, an AI-powered penetration testing platform increasingly adopted by cybercriminals and gained rare visibility into how attackers are using autonomous agents from inside their own operator consoles. The findings show that attackers can set an initial objective and leave AI agents to independently find vulnerabilities, exploit systems and pursue that goal at scale, often with very little human involvement. Key Findings ARTEX is already operating at scale: CPR identified 2,557 systems that hosted ARTEX, including 1,608 live, publicly accessible instances at the time of the […]

The post Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/hcT5eC2
via

ChatGPT Lockdown Mode Bypass Reveals a Wider Challenge in AI Security

Check Point Research (CPR) discovered a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature designed to reduce prompt-injection-driven data exfiltration. The flaw could enable silent chat data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application. OpenAI fixed the vulnerability following responsible disclosure, but the finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them. Key Findings Check Point Research bypassed ChatGPT Lockdown Mode, a security feature specifically designed to limit prompt-injection-driven data exfiltration. The vulnerability could enable multiple attack scenarios, including chat […]

The post ChatGPT Lockdown Mode Bypass Reveals a Wider Challenge in AI Security appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/bYLfVM3
via

Why Pay Twice? One Platform for Enterprise WAF and CDN Speed

Two Teams. Two Priorities. One Application.  Application teams want fast, reliable application delivery without disrupting existing cloud native architectures, CI/CD pipelines, or deployment processes. They want fewer platforms to manage, predictable cloud economics, low latency, and the flexibility to scale without introducing additional operational complexity.  Security teams want enterprise-grade protection for mission-critical applications and APIs, including strong zero-day prevention, low false positives, centralized visibility, and consistent security policies without relying on basic native cloud controls or creating gaps between the CDN and the application.  Check Point WAF Enables Both Teams to Win.  Our WAF comes with a full enterprise-grade CDN […]

The post Why Pay Twice? One Platform for Enterprise WAF and CDN Speed appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/GLs1US9
via