Check Point Research ✓

@_CPResearch_ · The Internet · joined 30 Apr 2018

Fighting cyber threats one research at a time. News from Check Point’s (@checkpointSW) Research team.

25 478Followers

120Following

606Posts total

91.6KViews on collected posts

Latest posts

Check Point Research ✓@_CPResearch_2 Sep

From local banking trojans to foreign 🇨🇳 operators targeting Brazil 🇧🇷. CPR uncovered #GamblingGoblin, a Chinese-speaking actor abusing Brazilian government sites for large-scale #SEO fraud. Read more 👇: https://t.co/uzfFajajyf 5.9K views · 63 likes · 25 reposts · 0 replies Open on X →

Check Point Research ✓@_CPResearch_31 Aug

#JSCeal didn't give up its secrets willingly. Following our #BlackHat2026 talk, we're releasing Breaking the Seal: our research on statically deobfuscating compiled, obfuscated #V8 #malware. Inside: the methodology, the open-source toolkit, and the malware capabilities recovered 19.5K views · 55 likes · 22 reposts · 0 replies Open on X →

Check Point Research ✓@_CPResearch_24 Aug

@_CPResearch_ The detail that makes this different from BYOVD is that you cannot blocklist your way out. BTR.sys is a required component, so WDAC and the vulnerable driver list are both off the table. Defenders are left with behavioural signals on service creation and driver load 447 views · 0 likes · 0 reposts · 0 replies Open on X →

Check Point Research ✓@_CPResearch_20 Aug

@_CPResearch_ The durable part isn't the primitive, it's the exemption. A remediation driver ships signed and sits on every allowlist by policy, so the identity check that usually does the work is the one you can't lean on. Known-good becomes a claim about provenance, not runtime 33 views · 0 likes · 0 reposts · 0 replies Open on X →

Check Point Research ✓@_CPResearch_20 Aug

⚒️ BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive ⚠ Trusted Remediation Primitives with Undocumented Internals. 🔓 15+ years. Unchanged. Unblockable. 🤔 What if an attacker learned its language? We did. 👇 https://t.co/AICs7JCI4d 24.5K views · 58 likes · 25 reposts · 3 replies Open on X →

Check Point Research ✓@_CPResearch_18 Aug

#StopAndProtect blends ransomware, data theft and hands-on keyboard control. 🥷OPSEC failures reveals logs from over 6,000 victim IPs 📰Thousands of hacked WordPress websites used to lure victims and host operation infrastructure 📱 Custom stealer uses WhatsApp web and desktop 5.3K views · 28 likes · 16 reposts · 1 replies Open on X →

Check Point Research ✓@_CPResearch_11 Aug

0-Day Used by Lazarus in #DreamJob Campaign Against Defense Sector: 💥LPE vulnerability in Microsoft’s Afd.sys driver (CVE-2026-68820) 🧰New tools, including #Troy backdoor 🌍Compromised Roundcube servers (CVE-2025-49113) as infrastructure Read More : https://t.co/GDI2Ze7CRH https

35.9K views · 311 likes · 83 reposts · 2 replies Open on X →

Against accounts of the same size

7 posts from the last 90 days, next to the 10K–100K follower range. shown widely, but few of those viewers react.

Median views5 890this account937median for 10K–100K

Reach, %23.12%this account3.44%median for 10K–100K

Engagement, %0.40%this account1.55%median for 10K–100K

Metric	This account	Median for 10K–100K	Ratio
Median views per post	5 890	937	6.29×
Reach (views ÷ followers)	23.12%	3.44%	6.72×
Engagement rate	0.40%	1.55%	0.26×

Others in this range → Compare with another account → How these benchmarks are built →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

35.9K11 Aug

5.3K18 Aug

24.5K20 Aug

44724 Aug

19.5K31 Aug

5.9K2 Sep

Last 7 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

1.11%11 Aug

0.85%18 Aug

0.37%20 Aug

0.00%

0.00%24 Aug

0.40%31 Aug

1.49%2 Sep

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.55%.

What the audience does

Likes54.9%515 in total

Reposts18.2%171 in total

Replies0.6%6 in total

Quotes1.1%10 in total

Bookmarks25.2%236 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.