Research.Checkpoint

Ransomware and Vulnerabilities Targeting Ivanti and Check Point Systems

First seen 9 Feb 2026, 20:04 UTC • Research.Checkpoint

•81% similarity •18.4

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

On February 9, 2026, Check Point reported on active ransomware threats and vulnerabilities affecting Ivanti Endpoint Manager. Specifically, CVE-2026-1281 and CVE-2026-1340 were published on January 29, 2026, with CVE-2026-1281 being actively exploited as of the same day. Check Point Harmony Endpoint and Threat Emulation are providing protection against these threats.

ThreatCluster AI

Timeline

2024-05-26

First public exploit for CVE-2025-8088 released

2025-11-03

CVE-2025-11953 published

2026-01-29

CVE-2026-1281 and CVE-2026-1340 published

2026-01-29

CVE-2026-1281 added to CISA KEV (active exploitation)

2026-02-01

First public PoC for CVE-2026-1281

2026-02-05

CVE-2025-11953 added to CISA KEV (active exploitation)

Attack Flow

14 entities, 45 inferred relationships (STIX 2.1).

Threat Actor (5)

APT41
Amaranth
Akira
Clop
Qilin

Technique (4)

Ransomware
Trojan
Command Injection
T1059 - Command and Scripting Interpreter

Vulnerability (5)

CVE-2025-11953
CVE-2025-8088
CVE-2026-1281
CVE-2026-1340
Directory Traversal

Relationships

APT41 uses Ransomware
APT41 uses Trojan
APT41 uses Command Injection
APT41 uses T1059 - Command and Scripting Interpreter
Amaranth uses Ransomware
Amaranth uses Trojan
Amaranth uses Command Injection
Amaranth uses T1059 - Command and Scripting Interpreter
Akira uses Ransomware
Akira uses Trojan
Akira uses Command Injection
Akira uses T1059 - Command and Scripting Interpreter
Clop uses Ransomware
Clop uses Trojan
Clop uses Command Injection
Clop uses T1059 - Command and Scripting Interpreter
Qilin uses Ransomware
Qilin uses Trojan
Qilin uses Command Injection
Qilin uses T1059 - Command and Scripting Interpreter
APT41 exploits CVE-2025-11953
APT41 exploits CVE-2025-8088
APT41 exploits CVE-2026-1281
APT41 exploits CVE-2026-1340
APT41 exploits Directory Traversal
Amaranth exploits CVE-2025-11953
Amaranth exploits CVE-2025-8088
Amaranth exploits CVE-2026-1281
Amaranth exploits CVE-2026-1340
Amaranth exploits Directory Traversal
Akira exploits CVE-2025-11953
Akira exploits CVE-2025-8088
Akira exploits CVE-2026-1281
Akira exploits CVE-2026-1340
Akira exploits Directory Traversal
Clop exploits CVE-2025-11953
Clop exploits CVE-2025-8088
Clop exploits CVE-2026-1281
Clop exploits CVE-2026-1340
Clop exploits Directory Traversal
Qilin exploits CVE-2025-11953
Qilin exploits CVE-2025-8088
Qilin exploits CVE-2026-1281
Qilin exploits CVE-2026-1340
Qilin exploits Directory Traversal

Community

Browse all →

Tracked Entities in This Story

APT41 Amaranth Akira Clop Qilin Ransomware Trojan Command Injection

Ransomware and Vulnerabilities Targeting Ivanti and Check Point Systems

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story