Fire Ant, a group linked to Chinese intelligence services, is compromising Cisco routers to intercept credentials and falsify security logs. A persistent eavesdropping strategy that is difficult to detect—and can last for months.
Sep 1, 2026 2 1
A campaign conceals malicious code in PNG files via steganography, then deploys a custom reverse tunnel to maintain persistent access. The reverse tunnel technique continues to diversify in its delivery vectors.
Sep 1, 2026 2 1
Check Point Research has documented a technique that uses BTR.sys, the official Windows Defender boot-time driver, to delete system files at the kernel level—without exploiting a vulnerability, without importing an external driver.
Aug 25, 2026 8 2
