Check Point Research Details Wide-Ranging Cyber Incidents, Including AI Exploitation and Critical Vulnerabilities
Check Point Research's latest threat intelligence report highlights a diverse array of cyber threats, from ransomware attacks and destructive breaches to the novel exploitation of AI frameworks and critical vulnerabilities in widely used software.
Check Point Research has released its latest Threat Intelligence Bulletin, detailing a broad spectrum of cyber incidents that occurred during the week of November 9th. The report underscores the evolving threat landscape, encompassing significant ransomware attacks, destructive cyber operations, supply-chain compromises, and the emerging use of artificial intelligence in cyberattacks.
Among the most notable incidents is a ransomware attack that crippled the Queens Public Library system in New York City. The attack encrypted critical systems, disrupting public computers, Wi-Fi, checkout equipment, digital media services, and the library's mobile application, though all 66 branches remained operational. Concurrently, Russian web hosting provider Beget suffered a destructive cyberattack on November 1st, which wiped data across its cloud infrastructure and impacted hundreds of websites, necessitating manual inspection of over 1,000 servers for restoration, with some backup data also lost.
A sophisticated supply-chain attack was also disclosed by OPSSHIELD, the developer of the Linux security tool cPGuard. Compromised credentials allowed attackers to distribute malicious updates on November 2nd, leading to approximately 2,950 customer servers executing a backdoor script that harvested password hashes, credentials, and sensitive server files. In a separate incident, Ukraine's Air Alert app, a vital emergency notification service, was compromised, with attackers distributing false radiation and chemical-threat alerts to residents of Kyiv, prompting a temporary suspension of notifications.
The report also sheds light on the growing role of AI in cyber threats. Check Point Research documented the use of ARTEX, an AI-powered framework that autonomously discovers and exploits vulnerable systems, with researchers identifying over 1,600 live instances. Observed campaigns leveraging ARTEX have already obtained hundreds of iOS signing certificates and harvested a significant number of gaming credentials. Furthermore, a jailbreak bundle named Haiou was identified, targeting OpenAI Codex to weaken safeguards and redirect AI agent instructions, potentially for malicious purposes.
Several critical vulnerabilities were detailed, including CVE-2026-19868 affecting SonicWall's SonicOS SSL VPN services with SAML authentication, which has been linked to active exploitation. Barracuda patched two high-severity vulnerabilities (CVE-2026-116606 and CVE-2026-111560) in its Email Security Gateway appliances, which could allow attackers to gain root-level control. OpenSSH addressed CVE-2026-123158, a flaw allowing authentication bypass on certain Linux systems, also observed in active exploitation.
Google's November Android Security bulletin patched numerous vulnerabilities, including CVE-2026-58868, a critical flaw enabling remote code execution without user interaction. These vulnerabilities underscore the ongoing challenges in securing widely deployed software and operating systems.
Beyond specific incidents, the report analyzes the evolution of HYFLOCK ransomware across four generations, noting new capabilities and encryption weaknesses that allowed for partial data recovery. It also details an APT29 cyberespionage campaign targeting mobile users through compromised websites and an espionage campaign by BITTER APT using malicious files disguised as diplomatic documents. Additionally, the report traces SlippyNunchucks, a China-aligned group, to attacks abusing the Sogou Input Method's update mechanisms to deliver malware.
Overall, Check Point Research's report paints a comprehensive picture of the current threat landscape, highlighting the convergence of traditional cybercrime tactics with advanced techniques like AI exploitation and the persistent risk posed by unpatched vulnerabilities across various sectors.