Check Point Research Details $6.3B Binance Heist, AI-Driven Attacks, and Multiple Data Breaches
Check Point Research's latest threat intelligence report highlights a massive $6.3 billion crypto theft linked to North Korea, significant data breaches at Japan Airlines and Florida's Department of Education, and the growing use of AI by threat actors.
Check Point Research has released its latest threat intelligence bulletin, detailing a tumultuous week in cybersecurity marked by a colossal cryptocurrency theft, widespread data breaches, and the increasing integration of artificial intelligence by malicious actors. The most significant incident reported is a cyberattack against Binance, the global cryptocurrency exchange, which resulted in the theft of approximately $6.3 billion in digital assets. Attackers reportedly gained access to a DevOps engineer's laptop and exploited internal wallet infrastructure to authorize unauthorized withdrawals, making this one of the largest crypto heists on record and linking it to a North Korean threat group.
Beyond the massive crypto theft, the report details several other high-profile breaches. Polymarket, a US-based prediction market platform, suffered a cyberattack where malicious JavaScript, injected via a compromised third-party service, hijacked authenticated trading sessions and attempted unauthorized transactions, leading to the loss of approximately $2.7 million in cryptocurrency. In the travel sector, Japan Airlines disclosed a third-party data breach affecting around 92,000 passengers through the Amadeus reservation system, with sensitive flight information potentially exposed. The Florida Department of Education also reported a breach impacting nearly 5 million individuals, with names, Social Security numbers, and other personal data compromised through unauthorized access to its student financial aid website.
The report also sheds light on the evolving tactics of threat actors, particularly their adoption of AI. The GOLD OGRE ransomware group has been observed using AI agents for network reconnaissance, identifying privileged accounts, and aiding lateral movement during its Aur0ra attacks. These AI tools were also used to test endpoint security evasion techniques. Similarly, North Korean cyber threat actors are expanding their use of AI for reconnaissance, malicious tool development, social engineering refinement, and accelerating intrusion workflows, integrating AI into their established espionage and financially motivated operations.
Furthermore, a global espionage campaign orchestrated by the China-linked VAPOR PANDA group utilized the AI-enabled ARTEX framework against over 200 organizations across 14 countries, including government agencies and telecommunications providers. This campaign involved credential theft and the deployment of the BLOODALCHEMY backdoor.
In terms of vulnerabilities, Check Point Research analyzed HTTP2Shell (CVE-2026-111497), an actively exploited remote code execution vulnerability affecting Brotli decompression implementations across various platforms including Node.js, Python, and .NET. A critical Linux kernel vulnerability (CVE-2026-98432) with a CVSS score of 9.8, affecting TCP networking, was also disclosed, potentially allowing unauthenticated remote code execution with root privileges. Drupal addressed a critical access control vulnerability (CVE-2026-118539) in its Commerce Core module, which has already seen exploitation. Cisco patched CVE-2026-76418, a high-severity vulnerability in its Adaptive Security Appliance and Firepower Threat Defense software that allowed unauthenticated attackers to crash devices configured with SSL VPN functionality, and had been exploited prior to the patch.
The report also covers the Yoba malware campaign, which distributes malicious installers disguised as popular AI chatbot desktop applications via fraudulent GitHub projects. These installers leverage legitimate signed executables to load malicious components and establish persistence. Additionally, researchers noted unexpected network activity from Alibaba's Qwen model, suggesting potential instability rather than deliberate data exfiltration. The UAT-11473 threat actor was identified exploiting a Cisco Catalyst SD-WAN authentication bypass to deploy the KeyDrift malware framework, targeting aerospace and defense sectors. Finally, the abuse of Microsoft Teams external chat functionality for initial access has been documented in over 400 incidents, with attackers impersonating IT support to gain remote access and deploy malicious tools.
This comprehensive report underscores the multifaceted nature of current cyber threats, from large-scale financial crime and data breaches to sophisticated AI-driven attacks and the continuous discovery of critical vulnerabilities. The findings emphasize the need for organizations to remain vigilant, update their defenses, and closely monitor threat intelligence to mitigate evolving risks.