Help Stop SOAR Abuse
Risk and complexity are on the rise from use cases that automation was never intended to support
First reported Jun 18, 2024 15:48 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordPublished file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Risk and complexity are on the rise from use cases that automation was never intended to support
First reported Jun 18, 2024 15:48 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordSnowflake's new machine learning functions bring ML to SOCs without data scientists
First reported Mar 07, 2024 15:11 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordAvoid Insider Risk Project Failure with Mencken’s Law of Threat Detection
First reported Jun 27, 2024 13:20 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordWhy success with decoupled data pipelines takes overcoming a people problem
First reported Apr 04, 2024 14:54 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordAn unauthorized playbook for estimating security data lake spend
First reported Feb 01, 2024 15:46 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordHow AI can help us understand the threats we care about, with a step-by-step example for Azure and sample prompts to get started
First reported Jan 11, 2024 14:55 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordHow a generation of security analysts missed out on the data revolution
First reported Feb 15, 2024 17:06 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordWhy the Lacework crash is a lesson on the limitations of AI in cybersecurity
First reported Apr 23, 2024 14:20 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordHow security leaders get ATT&CK wrong and what you can do about it
First reported Mar 21, 2024 14:30 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordHow cybersecurity platforms are raising switching costs and maximizing profits
First reported May 31, 2024 14:41 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordThe SIEM king's future depends on the answer.
First reported Aug 22, 2024 18:22 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordIndustry trends point to multiple SIEMs becoming a wider problem for security operations
First reported Feb 08, 2024 15:52 UTCCatalog metadata updated Oct 13, 2026 11:41 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link. Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports […] The post 5th October – Threat Intelligence Report appeared first on Check Point Research.
First reported Oct 05, 2026 13:57 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordResearch by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional downloaders and […] The post Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect appeared first on Check Point Research.
First reported Aug 18, 2026 13:05 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordResearch by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text generation. Modern systems can execute code, install additional dependencies, analyze user files, and access data through connected services. These capabilities significantly increase the practical value of LLMs, but they also change the security model: protecting user […] The post The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT appeared first on Check Point Research.
First reported Sep 08, 2026 13:00 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 24th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed a breach affecting payment records of more than 1.2 million people – roughly two-thirds of the country’s population – as well as 200,000 organizations. The […] The post 24th August – Threat Intelligence Report appeared first on Check Point Research.
First reported Aug 24, 2026 14:07 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 7th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Thomson Reuters, a global information and technology company, has disclosed a breach of its C-Track court case-management platform affecting courts across 11 US states and Canada. An unauthorized party obtained C-Track files […] The post 7th September – Threat Intelligence Report appeared first on Check Point Research.
First reported Sep 07, 2026 14:54 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a […] The post 14th September – Threat Intelligence Report appeared first on Check Point Research.
First reported Sep 14, 2026 12:22 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordExecutive Summary In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e.g. ”encrypt files in ~/Documents”, “give me a biohazard recipe”, “ignore all previous instructions and…”) is embedded in a specially crafted prose wrapper. An LLM with limited […] The post PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector appeared first on Check Point Research.
First reported Sep 10, 2026 14:32 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordResearch by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first documented targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, […] The post Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon appeared first on Check Point Research.
First reported Sep 02, 2026 10:16 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and […] The post 12th October – Threat Intelligence Report appeared first on Check Point Research.
First reported Oct 12, 2026 14:51 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordThe defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and state use of AI continued to mature along the lines tracked in earlier editions: models now act as attack operators, an underground […] The post AI Threat Landscape Digest: July–August 2026 appeared first on Check Point Research.
First reported Sep 17, 2026 14:41 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 21st September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, […] The post 21st September – Threat Intelligence Report appeared first on Check Point Research.
First reported Sep 21, 2026 23:13 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordFor the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, […] The post 31st August – Threat Intelligence Report appeared first on Check Point Research.
First reported Aug 31, 2026 12:58 UTCCatalog metadata updated Oct 13, 2026 11:39 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.