CINXE.COM

<!DOCTYPE html> <html lang="en-US"> <head> <meta http-equiv="content-type" content="text/html" charset="UTF-8" /> <meta name="description" content="Latest Research by our Team" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="pingback" href="https://research.checkpoint.com/xmlrpc.php" /> <style> /*region wordpress core*/ .alignnone {margin: 5px 20px 20px 0;}.aligncenter, div.aligncenter {display: block;margin: 5px auto 5px auto;}.alignright {float:right;margin: 5px 0 20px 20px;}.alignleft {float: left;margin: 5px 20px 20px 0;}a img.alignright {float: right;margin: 5px 0 20px 20px;}a img.alignnone {margin: 5px 20px 20px 0;}a img.alignleft {float: left;margin: 5px 20px 20px 0;}a img.aligncenter {display: block;margin-left: auto;margin-right: auto;}.wp-caption {background: #fff;border: 1px solid #f0f0f0;max-width: 96%;padding: 5px 3px 10px;text-align: center;}.wp-caption.alignnone {margin: 5px 20px 20px 0;}.wp-caption.alignleft {margin: 5px 20px 20px 0;}.wp-caption.alignright {margin: 5px 0 20px 20px;}.wp-caption img {border: 0 none;height: auto;margin: 0;max-width: 98.5%;padding: 0;width: auto;}.wp-caption p.wp-caption-text {font-size: 11px;line-height: 17px;margin: 0;padding: 0 4px 5px;}.screen-reader-text {border: 0;clip: rect(1px, 1px, 1px, 1px);clip-path: inset(50%);height: 1px;margin: -1px;overflow: hidden;padding: 0;position: absolute !important;width: 1px;word-wrap: normal !important;}.screen-reader-text:focus {background-color: #eee;clip: auto !important;clip-path: none;color: #444;display: block;font-size: 1em;height: auto;left: 5px;line-height: normal;padding: 15px 23px 14px;text-decoration: none;top: 5px;width: auto;z-index: 100000;} .dmbs-container {}.dmbs-header {}.dmbs-header-img {}.dmbs-header-text {}.dmbs-top-menu {}.dmbs-content {}.dmbs-main {}.dmbs-left {}.dmbs-right {}.dmbs-footer-menu {}.dmbs-author-credits {}.dmbs-footer {} /*endregion*/ /*region slick-slider*/ .slick-slider {position: relative;display: block;box-sizing: border-box;-webkit-user-select: none;-moz-user-select: none;-ms-user-select: none;user-select: none;-webkit-touch-callout: none;-khtml-user-select: none;-ms-touch-action: pan-y;touch-action: pan-y;-webkit-tap-highlight-color: transparent;}.slick-list {position: relative;display: block;overflow: hidden;margin: 0;padding: 0;}.slick-list:focus {outline: none;}.slick-list.dragging {cursor: pointer;cursor: hand;}.slick-slider .slick-track, .slick-slider .slick-list {-webkit-transform: translate3d(0, 0, 0);-moz-transform: translate3d(0, 0, 0);-ms-transform: translate3d(0, 0, 0);-o-transform: translate3d(0, 0, 0);transform: translate3d(0, 0, 0);}.slick-track {position: relative;top: 0;left: 0;display: block;}.slick-track:before, .slick-track:after {display: table;content: '';}.slick-track:after {clear: both;}.slick-loading .slick-track {visibility: hidden;}.slick-slide {display: none;float: left;height: 100%--;min-height: 1px;}[dir='rtl'] .slick-slide {float: right;}.slick-slide img {display: block;}.slick-slide.slick-loading img {display: none;}.slick-slide.dragging img {pointer-events: none;}.slick-initialized .slick-slide {display: block;}.slick-loading .slick-slide {visibility: hidden;}.slick-vertical .slick-slide {display: block;height: auto;border: 1px solid transparent;}.slick-arrow.slick-hidden {display: none;} /*endregion*/ /*region AOS*/ [data-aos][data-aos][data-aos-duration="50"],body[data-aos-duration="50"] [data-aos]{transition-duration:50ms}[data-aos][data-aos][data-aos-delay="50"],body[data-aos-delay="50"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="50"].aos-animate,body[data-aos-delay="50"] [data-aos].aos-animate{transition-delay:50ms}[data-aos][data-aos][data-aos-duration="100"],body[data-aos-duration="100"] [data-aos]{transition-duration:.1s}[data-aos][data-aos][data-aos-delay="100"],body[data-aos-delay="100"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="100"].aos-animate,body[data-aos-delay="100"] [data-aos].aos-animate{transition-delay:.1s}[data-aos][data-aos][data-aos-duration="150"],body[data-aos-duration="150"] [data-aos]{transition-duration:.15s}[data-aos][data-aos][data-aos-delay="150"],body[data-aos-delay="150"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="150"].aos-animate,body[data-aos-delay="150"] [data-aos].aos-animate{transition-delay:.15s}[data-aos][data-aos][data-aos-duration="200"],body[data-aos-duration="200"] [data-aos]{transition-duration:.2s}[data-aos][data-aos][data-aos-delay="200"],body[data-aos-delay="200"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="200"].aos-animate,body[data-aos-delay="200"] [data-aos].aos-animate{transition-delay:.2s}[data-aos][data-aos][data-aos-duration="250"],body[data-aos-duration="250"] [data-aos]{transition-duration:.25s}[data-aos][data-aos][data-aos-delay="250"],body[data-aos-delay="250"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="250"].aos-animate,body[data-aos-delay="250"] [data-aos].aos-animate{transition-delay:.25s}[data-aos][data-aos][data-aos-duration="300"],body[data-aos-duration="300"] [data-aos]{transition-duration:.3s}[data-aos][data-aos][data-aos-delay="300"],body[data-aos-delay="300"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="300"].aos-animate,body[data-aos-delay="300"] [data-aos].aos-animate{transition-delay:.3s}[data-aos][data-aos][data-aos-duration="350"],body[data-aos-duration="350"] [data-aos]{transition-duration:.35s}[data-aos][data-aos][data-aos-delay="350"],body[data-aos-delay="350"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="350"].aos-animate,body[data-aos-delay="350"] [data-aos].aos-animate{transition-delay:.35s}[data-aos][data-aos][data-aos-duration="400"],body[data-aos-duration="400"] [data-aos]{transition-duration:.4s}[data-aos][data-aos][data-aos-delay="400"],body[data-aos-delay="400"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="400"].aos-animate,body[data-aos-delay="400"] [data-aos].aos-animate{transition-delay:.4s}[data-aos][data-aos][data-aos-duration="450"],body[data-aos-duration="450"] [data-aos]{transition-duration:.45s}[data-aos][data-aos][data-aos-delay="450"],body[data-aos-delay="450"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="450"].aos-animate,body[data-aos-delay="450"] [data-aos].aos-animate{transition-delay:.45s}[data-aos][data-aos][data-aos-duration="500"],body[data-aos-duration="500"] [data-aos]{transition-duration:.5s}[data-aos][data-aos][data-aos-delay="500"],body[data-aos-delay="500"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="500"].aos-animate,body[data-aos-delay="500"] [data-aos].aos-animate{transition-delay:.5s}[data-aos][data-aos][data-aos-duration="550"],body[data-aos-duration="550"] [data-aos]{transition-duration:.55s}[data-aos][data-aos][data-aos-delay="550"],body[data-aos-delay="550"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="550"].aos-animate,body[data-aos-delay="550"] [data-aos].aos-animate{transition-delay:.55s}[data-aos][data-aos][data-aos-duration="600"],body[data-aos-duration="600"] [data-aos]{transition-duration:.6s}[data-aos][data-aos][data-aos-delay="600"],body[data-aos-delay="600"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="600"].aos-animate,body[data-aos-delay="600"] [data-aos].aos-animate{transition-delay:.6s}[data-aos][data-aos][data-aos-duration="650"],body[data-aos-duration="650"] [data-aos]{transition-duration:.65s}[data-aos][data-aos][data-aos-delay="650"],body[data-aos-delay="650"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="650"].aos-animate,body[data-aos-delay="650"] [data-aos].aos-animate{transition-delay:.65s}[data-aos][data-aos][data-aos-duration="700"],body[data-aos-duration="700"] [data-aos]{transition-duration:.7s}[data-aos][data-aos][data-aos-delay="700"],body[data-aos-delay="700"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="700"].aos-animate,body[data-aos-delay="700"] [data-aos].aos-animate{transition-delay:.7s}[data-aos][data-aos][data-aos-duration="750"],body[data-aos-duration="750"] [data-aos]{transition-duration:.75s}[data-aos][data-aos][data-aos-delay="750"],body[data-aos-delay="750"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="750"].aos-animate,body[data-aos-delay="750"] [data-aos].aos-animate{transition-delay:.75s}[data-aos][data-aos][data-aos-duration="800"],body[data-aos-duration="800"] [data-aos]{transition-duration:.8s}[data-aos][data-aos][data-aos-delay="800"],body[data-aos-delay="800"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="800"].aos-animate,body[data-aos-delay="800"] [data-aos].aos-animate{transition-delay:.8s}[data-aos][data-aos][data-aos-duration="850"],body[data-aos-duration="850"] [data-aos]{transition-duration:.85s}[data-aos][data-aos][data-aos-delay="850"],body[data-aos-delay="850"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="850"].aos-animate,body[data-aos-delay="850"] [data-aos].aos-animate{transition-delay:.85s}[data-aos][data-aos][data-aos-duration="900"],body[data-aos-duration="900"] [data-aos]{transition-duration:.9s}[data-aos][data-aos][data-aos-delay="900"],body[data-aos-delay="900"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="900"].aos-animate,body[data-aos-delay="900"] [data-aos].aos-animate{transition-delay:.9s}[data-aos][data-aos][data-aos-duration="950"],body[data-aos-duration="950"] [data-aos]{transition-duration:.95s}[data-aos][data-aos][data-aos-delay="950"],body[data-aos-delay="950"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="950"].aos-animate,body[data-aos-delay="950"] [data-aos].aos-animate{transition-delay:.95s}[data-aos][data-aos][data-aos-duration="1000"],body[data-aos-duration="1000"] [data-aos]{transition-duration:1s}[data-aos][data-aos][data-aos-delay="1000"],body[data-aos-delay="1000"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1000"].aos-animate,body[data-aos-delay="1000"] [data-aos].aos-animate{transition-delay:1s}[data-aos][data-aos][data-aos-duration="1050"],body[data-aos-duration="1050"] [data-aos]{transition-duration:1.05s}[data-aos][data-aos][data-aos-delay="1050"],body[data-aos-delay="1050"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1050"].aos-animate,body[data-aos-delay="1050"] [data-aos].aos-animate{transition-delay:1.05s}[data-aos][data-aos][data-aos-duration="1100"],body[data-aos-duration="1100"] [data-aos]{transition-duration:1.1s}[data-aos][data-aos][data-aos-delay="1100"],body[data-aos-delay="1100"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1100"].aos-animate,body[data-aos-delay="1100"] [data-aos].aos-animate{transition-delay:1.1s}[data-aos][data-aos][data-aos-duration="1150"],body[data-aos-duration="1150"] [data-aos]{transition-duration:1.15s}[data-aos][data-aos][data-aos-delay="1150"],body[data-aos-delay="1150"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1150"].aos-animate,body[data-aos-delay="1150"] [data-aos].aos-animate{transition-delay:1.15s}[data-aos][data-aos][data-aos-duration="1200"],body[data-aos-duration="1200"] [data-aos]{transition-duration:1.2s}[data-aos][data-aos][data-aos-delay="1200"],body[data-aos-delay="1200"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1200"].aos-animate,body[data-aos-delay="1200"] [data-aos].aos-animate{transition-delay:1.2s}[data-aos][data-aos][data-aos-duration="1250"],body[data-aos-duration="1250"] [data-aos]{transition-duration:1.25s}[data-aos][data-aos][data-aos-delay="1250"],body[data-aos-delay="1250"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1250"].aos-animate,body[data-aos-delay="1250"] [data-aos].aos-animate{transition-delay:1.25s}[data-aos][data-aos][data-aos-duration="1300"],body[data-aos-duration="1300"] [data-aos]{transition-duration:1.3s}[data-aos][data-aos][data-aos-delay="1300"],body[data-aos-delay="1300"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1300"].aos-animate,body[data-aos-delay="1300"] [data-aos].aos-animate{transition-delay:1.3s}[data-aos][data-aos][data-aos-duration="1350"],body[data-aos-duration="1350"] [data-aos]{transition-duration:1.35s}[data-aos][data-aos][data-aos-delay="1350"],body[data-aos-delay="1350"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1350"].aos-animate,body[data-aos-delay="1350"] [data-aos].aos-animate{transition-delay:1.35s}[data-aos][data-aos][data-aos-duration="1400"],body[data-aos-duration="1400"] [data-aos]{transition-duration:1.4s}[data-aos][data-aos][data-aos-delay="1400"],body[data-aos-delay="1400"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1400"].aos-animate,body[data-aos-delay="1400"] [data-aos].aos-animate{transition-delay:1.4s}[data-aos][data-aos][data-aos-duration="1450"],body[data-aos-duration="1450"] [data-aos]{transition-duration:1.45s}[data-aos][data-aos][data-aos-delay="1450"],body[data-aos-delay="1450"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1450"].aos-animate,body[data-aos-delay="1450"] [data-aos].aos-animate{transition-delay:1.45s}[data-aos][data-aos][data-aos-duration="1500"],body[data-aos-duration="1500"] [data-aos]{transition-duration:1.5s}[data-aos][data-aos][data-aos-delay="1500"],body[data-aos-delay="1500"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1500"].aos-animate,body[data-aos-delay="1500"] [data-aos].aos-animate{transition-delay:1.5s}[data-aos][data-aos][data-aos-duration="1550"],body[data-aos-duration="1550"] [data-aos]{transition-duration:1.55s}[data-aos][data-aos][data-aos-delay="1550"],body[data-aos-delay="1550"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1550"].aos-animate,body[data-aos-delay="1550"] [data-aos].aos-animate{transition-delay:1.55s}[data-aos][data-aos][data-aos-duration="1600"],body[data-aos-duration="1600"] [data-aos]{transition-duration:1.6s}[data-aos][data-aos][data-aos-delay="1600"],body[data-aos-delay="1600"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1600"].aos-animate,body[data-aos-delay="1600"] [data-aos].aos-animate{transition-delay:1.6s}[data-aos][data-aos][data-aos-duration="1650"],body[data-aos-duration="1650"] [data-aos]{transition-duration:1.65s}[data-aos][data-aos][data-aos-delay="1650"],body[data-aos-delay="1650"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1650"].aos-animate,body[data-aos-delay="1650"] [data-aos].aos-animate{transition-delay:1.65s}[data-aos][data-aos][data-aos-duration="1700"],body[data-aos-duration="1700"] [data-aos]{transition-duration:1.7s}[data-aos][data-aos][data-aos-delay="1700"],body[data-aos-delay="1700"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1700"].aos-animate,body[data-aos-delay="1700"] [data-aos].aos-animate{transition-delay:1.7s}[data-aos][data-aos][data-aos-duration="1750"],body[data-aos-duration="1750"] [data-aos]{transition-duration:1.75s}[data-aos][data-aos][data-aos-delay="1750"],body[data-aos-delay="1750"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1750"].aos-animate,body[data-aos-delay="1750"] [data-aos].aos-animate{transition-delay:1.75s}[data-aos][data-aos][data-aos-duration="1800"],body[data-aos-duration="1800"] [data-aos]{transition-duration:1.8s}[data-aos][data-aos][data-aos-delay="1800"],body[data-aos-delay="1800"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1800"].aos-animate,body[data-aos-delay="1800"] [data-aos].aos-animate{transition-delay:1.8s}[data-aos][data-aos][data-aos-duration="1850"],body[data-aos-duration="1850"] [data-aos]{transition-duration:1.85s}[data-aos][data-aos][data-aos-delay="1850"],body[data-aos-delay="1850"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1850"].aos-animate,body[data-aos-delay="1850"] [data-aos].aos-animate{transition-delay:1.85s}[data-aos][data-aos][data-aos-duration="1900"],body[data-aos-duration="1900"] [data-aos]{transition-duration:1.9s}[data-aos][data-aos][data-aos-delay="1900"],body[data-aos-delay="1900"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1900"].aos-animate,body[data-aos-delay="1900"] [data-aos].aos-animate{transition-delay:1.9s}[data-aos][data-aos][data-aos-duration="1950"],body[data-aos-duration="1950"] [data-aos]{transition-duration:1.95s}[data-aos][data-aos][data-aos-delay="1950"],body[data-aos-delay="1950"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1950"].aos-animate,body[data-aos-delay="1950"] [data-aos].aos-animate{transition-delay:1.95s}[data-aos][data-aos][data-aos-duration="2000"],body[data-aos-duration="2000"] [data-aos]{transition-duration:2s}[data-aos][data-aos][data-aos-delay="2000"],body[data-aos-delay="2000"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2000"].aos-animate,body[data-aos-delay="2000"] [data-aos].aos-animate{transition-delay:2s}[data-aos][data-aos][data-aos-duration="2050"],body[data-aos-duration="2050"] [data-aos]{transition-duration:2.05s}[data-aos][data-aos][data-aos-delay="2050"],body[data-aos-delay="2050"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2050"].aos-animate,body[data-aos-delay="2050"] [data-aos].aos-animate{transition-delay:2.05s}[data-aos][data-aos][data-aos-duration="2100"],body[data-aos-duration="2100"] [data-aos]{transition-duration:2.1s}[data-aos][data-aos][data-aos-delay="2100"],body[data-aos-delay="2100"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2100"].aos-animate,body[data-aos-delay="2100"] [data-aos].aos-animate{transition-delay:2.1s}[data-aos][data-aos][data-aos-duration="2150"],body[data-aos-duration="2150"] [data-aos]{transition-duration:2.15s}[data-aos][data-aos][data-aos-delay="2150"],body[data-aos-delay="2150"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2150"].aos-animate,body[data-aos-delay="2150"] [data-aos].aos-animate{transition-delay:2.15s}[data-aos][data-aos][data-aos-duration="2200"],body[data-aos-duration="2200"] [data-aos]{transition-duration:2.2s}[data-aos][data-aos][data-aos-delay="2200"],body[data-aos-delay="2200"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2200"].aos-animate,body[data-aos-delay="2200"] [data-aos].aos-animate{transition-delay:2.2s}[data-aos][data-aos][data-aos-duration="2250"],body[data-aos-duration="2250"] [data-aos]{transition-duration:2.25s}[data-aos][data-aos][data-aos-delay="2250"],body[data-aos-delay="2250"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2250"].aos-animate,body[data-aos-delay="2250"] [data-aos].aos-animate{transition-delay:2.25s}[data-aos][data-aos][data-aos-duration="2300"],body[data-aos-duration="2300"] [data-aos]{transition-duration:2.3s}[data-aos][data-aos][data-aos-delay="2300"],body[data-aos-delay="2300"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2300"].aos-animate,body[data-aos-delay="2300"] [data-aos].aos-animate{transition-delay:2.3s}[data-aos][data-aos][data-aos-duration="2350"],body[data-aos-duration="2350"] [data-aos]{transition-duration:2.35s}[data-aos][data-aos][data-aos-delay="2350"],body[data-aos-delay="2350"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2350"].aos-animate,body[data-aos-delay="2350"] [data-aos].aos-animate{transition-delay:2.35s}[data-aos][data-aos][data-aos-duration="2400"],body[data-aos-duration="2400"] [data-aos]{transition-duration:2.4s}[data-aos][data-aos][data-aos-delay="2400"],body[data-aos-delay="2400"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2400"].aos-animate,body[data-aos-delay="2400"] [data-aos].aos-animate{transition-delay:2.4s}[data-aos][data-aos][data-aos-duration="2450"],body[data-aos-duration="2450"] [data-aos]{transition-duration:2.45s}[data-aos][data-aos][data-aos-delay="2450"],body[data-aos-delay="2450"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2450"].aos-animate,body[data-aos-delay="2450"] [data-aos].aos-animate{transition-delay:2.45s}[data-aos][data-aos][data-aos-duration="2500"],body[data-aos-duration="2500"] [data-aos]{transition-duration:2.5s}[data-aos][data-aos][data-aos-delay="2500"],body[data-aos-delay="2500"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2500"].aos-animate,body[data-aos-delay="2500"] [data-aos].aos-animate{transition-delay:2.5s}[data-aos][data-aos][data-aos-duration="2550"],body[data-aos-duration="2550"] [data-aos]{transition-duration:2.55s}[data-aos][data-aos][data-aos-delay="2550"],body[data-aos-delay="2550"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2550"].aos-animate,body[data-aos-delay="2550"] [data-aos].aos-animate{transition-delay:2.55s}[data-aos][data-aos][data-aos-duration="2600"],body[data-aos-duration="2600"] [data-aos]{transition-duration:2.6s}[data-aos][data-aos][data-aos-delay="2600"],body[data-aos-delay="2600"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2600"].aos-animate,body[data-aos-delay="2600"] [data-aos].aos-animate{transition-delay:2.6s}[data-aos][data-aos][data-aos-duration="2650"],body[data-aos-duration="2650"] [data-aos]{transition-duration:2.65s}[data-aos][data-aos][data-aos-delay="2650"],body[data-aos-delay="2650"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2650"].aos-animate,body[data-aos-delay="2650"] [data-aos].aos-animate{transition-delay:2.65s}[data-aos][data-aos][data-aos-duration="2700"],body[data-aos-duration="2700"] [data-aos]{transition-duration:2.7s}[data-aos][data-aos][data-aos-delay="2700"],body[data-aos-delay="2700"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2700"].aos-animate,body[data-aos-delay="2700"] [data-aos].aos-animate{transition-delay:2.7s}[data-aos][data-aos][data-aos-duration="2750"],body[data-aos-duration="2750"] [data-aos]{transition-duration:2.75s}[data-aos][data-aos][data-aos-delay="2750"],body[data-aos-delay="2750"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2750"].aos-animate,body[data-aos-delay="2750"] [data-aos].aos-animate{transition-delay:2.75s}[data-aos][data-aos][data-aos-duration="2800"],body[data-aos-duration="2800"] [data-aos]{transition-duration:2.8s}[data-aos][data-aos][data-aos-delay="2800"],body[data-aos-delay="2800"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2800"].aos-animate,body[data-aos-delay="2800"] [data-aos].aos-animate{transition-delay:2.8s}[data-aos][data-aos][data-aos-duration="2850"],body[data-aos-duration="2850"] [data-aos]{transition-duration:2.85s}[data-aos][data-aos][data-aos-delay="2850"],body[data-aos-delay="2850"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2850"].aos-animate,body[data-aos-delay="2850"] [data-aos].aos-animate{transition-delay:2.85s}[data-aos][data-aos][data-aos-duration="2900"],body[data-aos-duration="2900"] [data-aos]{transition-duration:2.9s}[data-aos][data-aos][data-aos-delay="2900"],body[data-aos-delay="2900"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2900"].aos-animate,body[data-aos-delay="2900"] [data-aos].aos-animate{transition-delay:2.9s}[data-aos][data-aos][data-aos-duration="2950"],body[data-aos-duration="2950"] [data-aos]{transition-duration:2.95s}[data-aos][data-aos][data-aos-delay="2950"],body[data-aos-delay="2950"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2950"].aos-animate,body[data-aos-delay="2950"] [data-aos].aos-animate{transition-delay:2.95s}[data-aos][data-aos][data-aos-duration="3000"],body[data-aos-duration="3000"] [data-aos]{transition-duration:3s}[data-aos][data-aos][data-aos-delay="3000"],body[data-aos-delay="3000"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="3000"].aos-animate,body[data-aos-delay="3000"] [data-aos].aos-animate{transition-delay:3s}[data-aos][data-aos][data-aos-easing=linear],body[data-aos-easing=linear] [data-aos]{transition-timing-function:cubic-bezier(.25,.25,.75,.75)}[data-aos][data-aos][data-aos-easing=ease],body[data-aos-easing=ease] [data-aos]{transition-timing-function:ease}[data-aos][data-aos][data-aos-easing=ease-in],body[data-aos-easing=ease-in] [data-aos]{transition-timing-function:ease-in}[data-aos][data-aos][data-aos-easing=ease-out],body[data-aos-easing=ease-out] [data-aos]{transition-timing-function:ease-out}[data-aos][data-aos][data-aos-easing=ease-in-out],body[data-aos-easing=ease-in-out] [data-aos]{transition-timing-function:ease-in-out}[data-aos][data-aos][data-aos-easing=ease-in-back],body[data-aos-easing=ease-in-back] [data-aos]{transition-timing-function:cubic-bezier(.6,-.28,.735,.045)}[data-aos][data-aos][data-aos-easing=ease-out-back],body[data-aos-easing=ease-out-back] [data-aos]{transition-timing-function:cubic-bezier(.175,.885,.32,1.275)}[data-aos][data-aos][data-aos-easing=ease-in-out-back],body[data-aos-easing=ease-in-out-back] [data-aos]{transition-timing-function:cubic-bezier(.68,-.55,.265,1.55)}[data-aos][data-aos][data-aos-easing=ease-in-sine],body[data-aos-easing=ease-in-sine] [data-aos]{transition-timing-function:cubic-bezier(.47,0,.745,.715)}[data-aos][data-aos][data-aos-easing=ease-out-sine],body[data-aos-easing=ease-out-sine] [data-aos]{transition-timing-function:cubic-bezier(.39,.575,.565,1)}[data-aos][data-aos][data-aos-easing=ease-in-out-sine],body[data-aos-easing=ease-in-out-sine] [data-aos]{transition-timing-function:cubic-bezier(.445,.05,.55,.95)}[data-aos][data-aos][data-aos-easing=ease-in-quad],body[data-aos-easing=ease-in-quad] [data-aos]{transition-timing-function:cubic-bezier(.55,.085,.68,.53)}[data-aos][data-aos][data-aos-easing=ease-out-quad],body[data-aos-easing=ease-out-quad] [data-aos]{transition-timing-function:cubic-bezier(.25,.46,.45,.94)}[data-aos][data-aos][data-aos-easing=ease-in-out-quad],body[data-aos-easing=ease-in-out-quad] [data-aos]{transition-timing-function:cubic-bezier(.455,.03,.515,.955)}[data-aos][data-aos][data-aos-easing=ease-in-cubic],body[data-aos-easing=ease-in-cubic] [data-aos]{transition-timing-function:cubic-bezier(.55,.085,.68,.53)}[data-aos][data-aos][data-aos-easing=ease-out-cubic],body[data-aos-easing=ease-out-cubic] [data-aos]{transition-timing-function:cubic-bezier(.25,.46,.45,.94)}[data-aos][data-aos][data-aos-easing=ease-in-out-cubic],body[data-aos-easing=ease-in-out-cubic] [data-aos]{transition-timing-function:cubic-bezier(.455,.03,.515,.955)}[data-aos][data-aos][data-aos-easing=ease-in-quart],body[data-aos-easing=ease-in-quart] [data-aos]{transition-timing-function:cubic-bezier(.55,.085,.68,.53)}[data-aos][data-aos][data-aos-easing=ease-out-quart],body[data-aos-easing=ease-out-quart] [data-aos]{transition-timing-function:cubic-bezier(.25,.46,.45,.94)}[data-aos][data-aos][data-aos-easing=ease-in-out-quart],body[data-aos-easing=ease-in-out-quart] [data-aos]{transition-timing-function:cubic-bezier(.455,.03,.515,.955)}[data-aos^=fade][data-aos^=fade]{opacity:0;transition-property:opacity,transform}[data-aos^=fade][data-aos^=fade].aos-animate{opacity:1;transform:translateZ(0)}[data-aos=fade-up]{transform:translate3d(0,100px,0)}[data-aos=fade-down]{transform:translate3d(0,-100px,0)}[data-aos=fade-right]{transform:translate3d(-100px,0,0)}[data-aos=fade-left]{transform:translate3d(100px,0,0)}[data-aos=fade-up-right]{transform:translate3d(-100px,100px,0)}[data-aos=fade-up-left]{transform:translate3d(100px,100px,0)}[data-aos=fade-down-right]{transform:translate3d(-100px,-100px,0)}[data-aos=fade-down-left]{transform:translate3d(100px,-100px,0)}[data-aos^=zoom][data-aos^=zoom]{opacity:0;transition-property:opacity,transform}[data-aos^=zoom][data-aos^=zoom].aos-animate{opacity:1;transform:translateZ(0) scale(1)}[data-aos=zoom-in]{transform:scale(.6)}[data-aos=zoom-in-up]{transform:translate3d(0,100px,0) scale(.6)}[data-aos=zoom-in-down]{transform:translate3d(0,-100px,0) scale(.6)}[data-aos=zoom-in-right]{transform:translate3d(-100px,0,0) scale(.6)}[data-aos=zoom-in-left]{transform:translate3d(100px,0,0) scale(.6)}[data-aos=zoom-out]{transform:scale(1.2)}[data-aos=zoom-out-up]{transform:translate3d(0,100px,0) scale(1.2)}[data-aos=zoom-out-down]{transform:translate3d(0,-100px,0) scale(1.2)}[data-aos=zoom-out-right]{transform:translate3d(-100px,0,0) scale(1.2)}[data-aos=zoom-out-left]{transform:translate3d(100px,0,0) scale(1.2)}[data-aos^=slide][data-aos^=slide]{transition-property:transform}[data-aos^=slide][data-aos^=slide].aos-animate{transform:translateZ(0)}[data-aos=slide-up]{transform:translate3d(0,100%,0)}[data-aos=slide-down]{transform:translate3d(0,-100%,0)}[data-aos=slide-right]{transform:translate3d(-100%,0,0)}[data-aos=slide-left]{transform:translate3d(100%,0,0)}[data-aos^=flip][data-aos^=flip]{backface-visibility:hidden;transition-property:transform}[data-aos=flip-left]{transform:perspective(2500px) rotateY(-100deg)}[data-aos=flip-left].aos-animate{transform:perspective(2500px) rotateY(0)}[data-aos=flip-right]{transform:perspective(2500px) rotateY(100deg)}[data-aos=flip-right].aos-animate{transform:perspective(2500px) rotateY(0)}[data-aos=flip-up]{transform:perspective(2500px) rotateX(-100deg)}[data-aos=flip-up].aos-animate{transform:perspective(2500px) rotateX(0)}[data-aos=flip-down]{transform:perspective(2500px) rotateX(100deg)}[data-aos=flip-down].aos-animate{transform:perspective(2500px) rotateX(0)} /*endregion*/ </style> <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /> <style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>  <title>Stopping Serial Killer: Catching the Next Strike - Check Point Research</title> <link rel="canonical" href="https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/" /> <meta property="og:locale" content="en_US" /> <meta property="og:type" content="article" /> <meta property="og:title" content="Stopping Serial Killer: Catching the Next Strike - Check Point Research" /> <meta property="og:description" content="Brief When we look at a prevalent malware family, we give credit to its authors regarding the established malicious infrastructure. New malicious activity is flowing smoothly, command-and-control servers appear, everything works like Swiss watch. Are there any weak points in such a construction? To answer this question we may think about a race car. It’s […]" /> <meta property="og:url" content="https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/" /> <meta property="og:site_name" content="Check Point Research" /> <meta property="article:publisher" content="https://www.facebook.com/checkpointresearch/" /> <meta property="article:published_time" content="2021-01-04T10:08:31+00:00" /> <meta property="article:modified_time" content="2021-01-14T08:45:34+00:00" /> <meta property="og:image" content="https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg" /> <meta property="og:image:width" content="1200" /> <meta property="og:image:height" content="628" /> <meta property="og:image:type" content="image/jpeg" /> <meta name="author" content="ramanl" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:creator" content="@_cpresearch_" /> <meta name="twitter:site" content="@_cpresearch_" /> <meta name="twitter:label1" content="Written by" /> <meta name="twitter:data1" content="ramanl" /> <meta name="twitter:label2" content="Est. reading time" /> <meta name="twitter:data2" content="17 minutes" /> <script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#article","isPartOf":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"},"author":{"name":"ramanl","@id":"https://research.checkpoint.com/#/schema/person/514da870cbdcd10b88bfb87a899ff1b9"},"headline":"Stopping Serial Killer: Catching the Next Strike","datePublished":"2021-01-04T10:08:31+00:00","dateModified":"2021-01-14T08:45:34+00:00","mainEntityOfPage":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"},"wordCount":3471,"commentCount":0,"publisher":{"@id":"https://research.checkpoint.com/#organization"},"image":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#primaryimage"},"thumbnailUrl":"https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg","articleSection":["Check Point Research Publications"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/","name":"Stopping Serial Killer: Catching the Next Strike - Check Point Research","isPartOf":{"@id":"https://research.checkpoint.com/#website"},"primaryImageOfPage":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#primaryimage"},"image":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#primaryimage"},"thumbnailUrl":"https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg","datePublished":"2021-01-04T10:08:31+00:00","dateModified":"2021-01-14T08:45:34+00:00","breadcrumb":{"@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#primaryimage","url":"https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg","contentUrl":"https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://research.checkpoint.com/"},{"@type":"ListItem","position":2,"name":"Stopping Serial Killer: Catching the Next Strike"}]},{"@type":"WebSite","@id":"https://research.checkpoint.com/#website","url":"https://research.checkpoint.com/","name":"Check Point Research","description":"Latest Research by our Team","publisher":{"@id":"https://research.checkpoint.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://research.checkpoint.com/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https://research.checkpoint.com/#organization","name":"Check Point Research","url":"https://research.checkpoint.com/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://research.checkpoint.com/#/schema/logo/image/","url":"https://research.checkpoint.com/wp-content/uploads/2018/07/CPR_Logo_168x77_blackbackground_proof-01.png","contentUrl":"https://research.checkpoint.com/wp-content/uploads/2018/07/CPR_Logo_168x77_blackbackground_proof-01.png","width":164,"height":77,"caption":"Check Point Research"},"image":{"@id":"https://research.checkpoint.com/#/schema/logo/image/"},"sameAs":["https://www.facebook.com/checkpointresearch/","https://x.com/_cpresearch_"]},{"@type":"Person","@id":"https://research.checkpoint.com/#/schema/person/514da870cbdcd10b88bfb87a899ff1b9","name":"ramanl","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://research.checkpoint.com/#/schema/person/image/","url":"https://secure.gravatar.com/avatar/d5f69ca61264e88eefb5f506b1a4fee8?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/d5f69ca61264e88eefb5f506b1a4fee8?s=96&d=mm&r=g","caption":"ramanl"},"url":"https://research.checkpoint.com/author/ramanl/"}]}</script>  <script type="text/javascript"> /* <![CDATA[ */ window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/research.checkpoint.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); /* ]]> */ </script> <style id='wp-emoji-styles-inline-css' type='text/css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='https://research.checkpoint.com/wp-content/plugins/gutenberg/build/block-library/style.css?ver=20.3.0' type='text/css' media='all' /> <style id='classic-theme-styles-inline-css' type='text/css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <link rel='stylesheet' id='contact-form-7-css' href='https://research.checkpoint.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.4' type='text/css' media='all' /> <link rel='stylesheet' id='email-subscribers-css' href='https://research.checkpoint.com/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public.css?ver=5.7.52' type='text/css' media='all' /> <style id='global-styles-inline-css' type='text/css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} </style> <link rel='stylesheet' id='stylemain-css' href='https://research.checkpoint.com/wp-content/themes/research-th/css/style.css?ver=1.08' type='text/css' media='all' /> <link rel='stylesheet' id='nav-css' href='https://research.checkpoint.com/wp-content/themes/research-th/css/style-nav.css?ver=1.08' type='text/css' media='all' /> <link rel='stylesheet' id='header-css' href='https://research.checkpoint.com/wp-content/themes/research-th/css/style-header.css?ver=1.08' type='text/css' media='all' /> <link rel='stylesheet' id='footer-css' href='https://research.checkpoint.com/wp-content/themes/research-th/css/style-footer.css?ver=1.08' type='text/css' media='all' /> <link rel='stylesheet' id='bloga-css' href='https://research.checkpoint.com/wp-content/themes/research-th/css/style-blog.css?ver=1.08' type='text/css' media='all' /> <link rel='stylesheet' id='enlighterjs-css' href='https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=lB++6JpXuZRbV9F' type='text/css' media='all' /> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/gutenberg/build/hooks/index.min.js?ver=84e753e2b66eb7028d38" id="wp-hooks-js"></script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=bd5a2533e717a1043151" id="wp-i18n-js"></script> <script type="text/javascript" id="wp-i18n-js-after"> /* <![CDATA[ */ wp.i18n.setLocaleData( { 'text direction\u0004ltr': [ 'ltr' ] } ); /* ]]> */ </script> <script type="text/javascript" src="https://research.checkpoint.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script> <script type="text/javascript" src="https://research.checkpoint.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://research.checkpoint.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fstopping-serial-killer-catching-the-next-strike%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://research.checkpoint.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fstopping-serial-killer-catching-the-next-strike%2F&format=xml" />  <script type="text/javascript"> var ajaxurl = "https://research.checkpoint.com/wp-admin/admin-ajax.php"; var siteurl = "https://research.checkpoint.com"; </script><link rel="icon" href="https://research.checkpoint.com/wp-content/uploads/2022/10/cropped-pavicon_CPR-03-e1666694691376-32x32.png" sizes="32x32" /> <link rel="icon" href="https://research.checkpoint.com/wp-content/uploads/2022/10/cropped-pavicon_CPR-03-e1666694691376-192x192.png" sizes="192x192" /> <link rel="apple-touch-icon" href="https://research.checkpoint.com/wp-content/uploads/2022/10/cropped-pavicon_CPR-03-e1666694691376-180x180.png" /> <meta name="msapplication-TileImage" content="https://research.checkpoint.com/wp-content/uploads/2022/10/cropped-pavicon_CPR-03-e1666694691376-270x270.png" /> <style type="text/css" id="wp-custom-css"> #cookies-notice { display: none !important; } #toc_container { width: 100%; margin-bottom: 20px; margin-top: 20px; } </style>  <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-5JCRGP');</script>  </head> <body class="post-template-default single single-post postid-24476 single-format-standard"> <nav role="navigation" class="navbar-top-wrap"> <div class="navbar-top no-header-image"> <div class="container container-wide"> <div class="row desktop-view"> <div class="nav-logo"> <a href="https://research.checkpoint.com"><img src="https://research.checkpoint.com/wp-content/uploads/2024/06/CPR-by-Check-Point-logo.svg" alt="" class="img-responsive" /></a> </div> <div class="nav-top-right flex-row"> <div class="top-menu-wrap desktop-lg"> <div class="nav-menu nav-wrap"> <div class="navbar-nav-collapse"><ul id="menu-top-menuu" class="nav navbar-nav"><li id="menu-item-29295" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29295"><a href="https://research.checkpoint.com/contact/">CONTACT US</a></li> <li id="menu-item-27016" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-27016"><a href="https://research.checkpoint.com/disclosure-policy/">DISCLOSURE POLICY</a></li> <li id="menu-item-26970" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26970"><a target="_blank" href="https://www.checkpoint.com/">CHECKPOINT.COM</a></li> <li id="menu-item-26971" class="nav-button menu-item menu-item-type-custom menu-item-object-custom menu-item-26971"><a href="https://www.checkpoint.com/about-us/contact-incident-response/">UNDER ATTACK?</a></li> </ul></div> </div> </div> <div class="social-media-wrapper"> <div class="social-icons"> <a href="https://www.linkedin.com/company/check-point-software-technologies/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_801_"> <path id="XMLID_802_" d="M72.16,99.73H9.927c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5H72.16c2.762,0,5-2.238,5-5V104.73 C77.16,101.969,74.922,99.73,72.16,99.73z"/> <path id="XMLID_803_" d="M41.066,0.341C18.422,0.341,0,18.743,0,41.362C0,63.991,18.422,82.4,41.066,82.4 c22.626,0,41.033-18.41,41.033-41.038C82.1,18.743,63.692,0.341,41.066,0.341z"/> <path id="XMLID_804_" d="M230.454,94.761c-24.995,0-43.472,10.745-54.679,22.954V104.73c0-2.761-2.238-5-5-5h-59.599 c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5h62.097c2.762,0,5-2.238,5-5v-98.918c0-33.333,9.054-46.319,32.29-46.319 c25.306,0,27.317,20.818,27.317,48.034v97.204c0,2.762,2.238,5,5,5H305c2.762,0,5-2.238,5-5V194.995 C310,145.43,300.549,94.761,230.454,94.761z"/></g></svg></a> <a href="https://twitter.com/_cpresearch_" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="https://www.w3.org/2000/svg" xmlns:xlink="https://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_826_"> <path id="XMLID_827_" d="M302.973,57.388c-4.87,2.16-9.877,3.983-14.993,5.463c6.057-6.85,10.675-14.91,13.494-23.73 c0.632-1.977-0.023-4.141-1.648-5.434c-1.623-1.294-3.878-1.449-5.665-0.39c-10.865,6.444-22.587,11.075-34.878,13.783 c-12.381-12.098-29.197-18.983-46.581-18.983c-36.695,0-66.549,29.853-66.549,66.547c0,2.89,0.183,5.764,0.545,8.598 C101.163,99.244,58.83,76.863,29.76,41.204c-1.036-1.271-2.632-1.956-4.266-1.825c-1.635,0.128-3.104,1.05-3.93,2.467 c-5.896,10.117-9.013,21.688-9.013,33.461c0,16.035,5.725,31.249,15.838,43.137c-3.075-1.065-6.059-2.396-8.907-3.977 c-1.529-0.851-3.395-0.838-4.914,0.033c-1.52,0.871-2.473,2.473-2.513,4.224c-0.007,0.295-0.007,0.59-0.007,0.889 c0,23.935,12.882,45.484,32.577,57.229c-1.692-0.169-3.383-0.414-5.063-0.735c-1.732-0.331-3.513,0.276-4.681,1.597 c-1.17,1.32-1.557,3.16-1.018,4.84c7.29,22.76,26.059,39.501,48.749,44.605c-18.819,11.787-40.34,17.961-62.932,17.961 c-4.714,0-9.455-0.277-14.095-0.826c-2.305-0.274-4.509,1.087-5.294,3.279c-0.785,2.193,0.047,4.638,2.008,5.895 c29.023,18.609,62.582,28.445,97.047,28.445c67.754,0,110.139-31.95,133.764-58.753c29.46-33.421,46.356-77.658,46.356-121.367 c0-1.826-0.028-3.67-0.084-5.508c11.623-8.757,21.63-19.355,29.773-31.536c1.237-1.85,1.103-4.295-0.33-5.998 C307.394,57.037,305.009,56.486,302.973,57.388z"/></g></svg></a> <a href="https://www.facebook.com/checkpointresearch/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><path id="XMLID_835_" d="M81.703,165.106h33.981V305c0,2.762,2.238,5,5,5h57.616c2.762,0,5-2.238,5-5V165.765h39.064 c2.54,0,4.677-1.906,4.967-4.429l5.933-51.502c0.163-1.417-0.286-2.836-1.234-3.899c-0.949-1.064-2.307-1.673-3.732-1.673h-44.996 V71.978c0-9.732,5.24-14.667,15.576-14.667c1.473,0,29.42,0,29.42,0c2.762,0,5-2.239,5-5V5.037c0-2.762-2.238-5-5-5h-40.545 C187.467,0.023,186.832,0,185.896,0c-7.035,0-31.488,1.381-50.804,19.151c-21.402,19.692-18.427,43.27-17.716,47.358v37.752H81.703 c-2.762,0-5,2.238-5,5v50.844C76.703,162.867,78.941,165.106,81.703,165.106z"/></svg></a> </div> </div> </div> </div> <div class="row bottom-menu-wrapper"> <div class="nav-menu-wrapper"> <div class="nav-logo mobile-view"> <a href="https://research.checkpoint.com"><img src="https://research.checkpoint.com/wp-content/uploads/2024/06/CPR-by-Check-Point-logo.svg" alt="" class="img-responsive" /></a> </div> <button type="button" class="nav-icon navbar-toggle"><span></span><span></span><span></span><span></span></button> <div class="nav-menu nav-wrap"> <div class="navbar-nav-collapse"><ul id="menu-main-menu" class="nav navbar-nav"><li id="menu-item-26652" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-26652"><a href="https://research.checkpoint.com/latest-publications/">Latest Publications</a></li> <li id="menu-item-26651" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-26651"><a href="https://research.checkpoint.com/cpr-podcast-channel/">CPR Podcast Channel</a></li> <li id="menu-item-29296" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29296"><a href="https://research.checkpoint.com/category/web3/">Web 3.0 Security</a></li> <li id="menu-item-26650" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-26650"><a href="https://research.checkpoint.com/intelligence-reports/">Intelligence Reports</a></li> <li id="menu-item-26944" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-26944"><a>Resources</a> <ul class="sub-menu"> <li id="menu-item-26940" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26940"><a href="https://www.checkpoint.com/ai/">ThreatCloud AI</a></li> <li id="menu-item-26879" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26879"><a target="_blank" href="https://www.checkpoint.com/solutions/threat-intelligence-research/">Threat Intelligence & Research</a></li> <li id="menu-item-26880" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26880"><a target="_blank" href="https://www.checkpoint.com/infinity/zero-day-protection/">Zero Day Protection</a></li> <li id="menu-item-27006" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-27006"><a href="http://threatemulation.checkpoint.com/">Sandblast File Analysis</a></li> </ul> </li> <li id="menu-item-26639" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-26639"><a href="https://research.checkpoint.com/about-us/">About Us</a></li> <li id="menu-item-26989" class="nav-button menu-item menu-item-type-post_type menu-item-object-page menu-item-26989"><a href="https://research.checkpoint.com/subscription/">SUBSCRIBE</a></li> </ul></div> <div class="mobile-view"> <div class="social-media-wrapper"> <div class="social-icons"> <a href="https://www.linkedin.com/company/check-point-software-technologies/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_801_"> <path id="XMLID_802_" d="M72.16,99.73H9.927c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5H72.16c2.762,0,5-2.238,5-5V104.73 C77.16,101.969,74.922,99.73,72.16,99.73z"/> <path id="XMLID_803_" d="M41.066,0.341C18.422,0.341,0,18.743,0,41.362C0,63.991,18.422,82.4,41.066,82.4 c22.626,0,41.033-18.41,41.033-41.038C82.1,18.743,63.692,0.341,41.066,0.341z"/> <path id="XMLID_804_" d="M230.454,94.761c-24.995,0-43.472,10.745-54.679,22.954V104.73c0-2.761-2.238-5-5-5h-59.599 c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5h62.097c2.762,0,5-2.238,5-5v-98.918c0-33.333,9.054-46.319,32.29-46.319 c25.306,0,27.317,20.818,27.317,48.034v97.204c0,2.762,2.238,5,5,5H305c2.762,0,5-2.238,5-5V194.995 C310,145.43,300.549,94.761,230.454,94.761z"/></g></svg></a> <a href="https://twitter.com/_cpresearch_" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="https://www.w3.org/2000/svg" xmlns:xlink="https://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_826_"> <path id="XMLID_827_" d="M302.973,57.388c-4.87,2.16-9.877,3.983-14.993,5.463c6.057-6.85,10.675-14.91,13.494-23.73 c0.632-1.977-0.023-4.141-1.648-5.434c-1.623-1.294-3.878-1.449-5.665-0.39c-10.865,6.444-22.587,11.075-34.878,13.783 c-12.381-12.098-29.197-18.983-46.581-18.983c-36.695,0-66.549,29.853-66.549,66.547c0,2.89,0.183,5.764,0.545,8.598 C101.163,99.244,58.83,76.863,29.76,41.204c-1.036-1.271-2.632-1.956-4.266-1.825c-1.635,0.128-3.104,1.05-3.93,2.467 c-5.896,10.117-9.013,21.688-9.013,33.461c0,16.035,5.725,31.249,15.838,43.137c-3.075-1.065-6.059-2.396-8.907-3.977 c-1.529-0.851-3.395-0.838-4.914,0.033c-1.52,0.871-2.473,2.473-2.513,4.224c-0.007,0.295-0.007,0.59-0.007,0.889 c0,23.935,12.882,45.484,32.577,57.229c-1.692-0.169-3.383-0.414-5.063-0.735c-1.732-0.331-3.513,0.276-4.681,1.597 c-1.17,1.32-1.557,3.16-1.018,4.84c7.29,22.76,26.059,39.501,48.749,44.605c-18.819,11.787-40.34,17.961-62.932,17.961 c-4.714,0-9.455-0.277-14.095-0.826c-2.305-0.274-4.509,1.087-5.294,3.279c-0.785,2.193,0.047,4.638,2.008,5.895 c29.023,18.609,62.582,28.445,97.047,28.445c67.754,0,110.139-31.95,133.764-58.753c29.46-33.421,46.356-77.658,46.356-121.367 c0-1.826-0.028-3.67-0.084-5.508c11.623-8.757,21.63-19.355,29.773-31.536c1.237-1.85,1.103-4.295-0.33-5.998 C307.394,57.037,305.009,56.486,302.973,57.388z"/></g></svg></a> <a href="https://www.facebook.com/checkpointresearch/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><path id="XMLID_835_" d="M81.703,165.106h33.981V305c0,2.762,2.238,5,5,5h57.616c2.762,0,5-2.238,5-5V165.765h39.064 c2.54,0,4.677-1.906,4.967-4.429l5.933-51.502c0.163-1.417-0.286-2.836-1.234-3.899c-0.949-1.064-2.307-1.673-3.732-1.673h-44.996 V71.978c0-9.732,5.24-14.667,15.576-14.667c1.473,0,29.42,0,29.42,0c2.762,0,5-2.239,5-5V5.037c0-2.762-2.238-5-5-5h-40.545 C187.467,0.023,186.832,0,185.896,0c-7.035,0-31.488,1.381-50.804,19.151c-21.402,19.692-18.427,43.27-17.716,47.358v37.752H81.703 c-2.762,0-5,2.238-5,5v50.844C76.703,162.867,78.941,165.106,81.703,165.106z"/></svg></a> </div> <button class="button background-skyblue font-white skyblue-border" onclick="openPopup('subscribe-us-popup')">SUBSCRIBE</button> </div> </div> </div> </div> <div class="nav-search-wrapper"> <div role="search--" method="get--" id="searchform" class="searchform inc-search" action=""> <input type="text" value="" name="s" id="s" placeholder="SEARCH"/> <button type="submit--" id="searchsubmit"> <svg xmlns="http://www.w3.org/2000/svg" width="22.225" height="21.19" viewBox="0 0 22.225 21.19"> <path id="search_left-_1504_" data-name="search_left-[#1504]" d="M264,138.586,262.515,140l-4.455-4.242,1.485-1.415ZM251.4,134a6.007,6.007,0,1,1,6.3-6,6.162,6.162,0,0,1-6.3,6Zm0-14a8.01,8.01,0,1,0,8.4,8,8.208,8.208,0,0,0-8.4-8Z" transform="translate(-242.5 -119.5)" fill="#202020" stroke="#cbcbcb" stroke-width="1" fill-rule="evenodd"/> </svg> </button> </div> </div> </div> </div> </div> </nav><header class="site-header">  </header> <style type="text/css"> .blog-post-wrap h1.h3{color:white; font-size:1.4rem} .wp-block-image figcaption {text-align:center;} .wp-block-heading{color:#FFF;} strong { font-weight: bold; color:white;} .wp-block-table thead{border-bottom:4px solid #656597} p, ul li, ol li, .text, .text a {color:#ddd} .blog-post-wrapper.single-blog-wrapper .text p, .blog-post-wrapper.single-blog-wrapper .text li, .blog-post-wrapper.single-blog-wrapper .text p a {color:#ddd} .wp-block-table td, .wp-block-table th { border:2px solid #656597;} .blog-post-wrapper.single-blog-wrapper .text p a, .text a { color: #748ad8; } code { background: #ad2963; word-wrap: break-word; padding: 0rem 0.2rem 0rem; border-radius: 0.2rem; } </style> <div class="container container-wide"> <div class="mobile-categories-nav"> <div class="sidebar-post-categories"> <div class="text font-blue"> <h2>CATEGORIES</h2> </div> <ul class="post-category"> <li> <a href="https://research.checkpoint.com/category/android-malware/" onclick="location.href = 'https://research.checkpoint.com/category/android-malware/';"> <input type="checkbox" id="10457" class="cat-filter" value="10457"> <label for="10457"> Android Malware</label> <span>23</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/artificial-intelligence-2/" onclick="location.href = 'https://research.checkpoint.com/category/artificial-intelligence-2/';"> <input type="checkbox" id="10621" class="cat-filter" value="10621"> <label for="10621"> Artificial Intelligence</label> <span>4</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/chatgpt/" onclick="location.href = 'https://research.checkpoint.com/category/chatgpt/';"> <input type="checkbox" id="10637" class="cat-filter" value="10637"> <label for="10637"> ChatGPT</label> <span>3</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/threat-research/" onclick="location.href = 'https://research.checkpoint.com/category/threat-research/';"> <input type="checkbox" id="10441" class="cat-filter" value="10441"> <label for="10441"> Check Point Research Publications</label> <span>397</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/cloud-security/" onclick="location.href = 'https://research.checkpoint.com/category/cloud-security/';"> <input type="checkbox" id="10634" class="cat-filter" value="10634"> <label for="10634"> Cloud Security</label> <span>1</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/cpradio/" onclick="location.href = 'https://research.checkpoint.com/category/cpradio/';"> <input type="checkbox" id="10539" class="cat-filter" value="10539"> <label for="10539"> CPRadio</label> <span>44</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/crypto/" onclick="location.href = 'https://research.checkpoint.com/category/crypto/';"> <input type="checkbox" id="10655" class="cat-filter" value="10655"> <label for="10655"> Crypto</label> <span>2</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/data-threat-intelligence/" onclick="location.href = 'https://research.checkpoint.com/category/data-threat-intelligence/';"> <input type="checkbox" id="10643" class="cat-filter" value="10643"> <label for="10643"> Data & Threat Intelligence</label> <span>1</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/data-analysis/" onclick="location.href = 'https://research.checkpoint.com/category/data-analysis/';"> <input type="checkbox" id="10645" class="cat-filter" value="10645"> <label for="10645"> Data Analysis</label> <span>0</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/demos/" onclick="location.href = 'https://research.checkpoint.com/category/demos/';"> <input type="checkbox" id="10062" class="cat-filter" value="10062"> <label for="10062"> Demos</label> <span>22</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/threat-intelligence-reports/" onclick="location.href = 'https://research.checkpoint.com/category/threat-intelligence-reports/';"> <input type="checkbox" id="10060" class="cat-filter" value="10060"> <label for="10060"> Global Cyber Attack Reports</label> <span>343</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/how-to-guides/" onclick="location.href = 'https://research.checkpoint.com/category/how-to-guides/';"> <input type="checkbox" id="10475" class="cat-filter" value="10475"> <label for="10475"> How To Guides</label> <span>13</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/ransomware/" onclick="location.href = 'https://research.checkpoint.com/category/ransomware/';"> <input type="checkbox" id="10622" class="cat-filter" value="10622"> <label for="10622"> Ransomware</label> <span>2</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/russo-ukrainian-war/" onclick="location.href = 'https://research.checkpoint.com/category/russo-ukrainian-war/';"> <input type="checkbox" id="10624" class="cat-filter" value="10624"> <label for="10624"> Russo-Ukrainian War</label> <span>1</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/security-report/" onclick="location.href = 'https://research.checkpoint.com/category/security-report/';"> <input type="checkbox" id="10656" class="cat-filter" value="10656"> <label for="10656"> Security Report</label> <span>1</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/threat-and-data-analysis/" onclick="location.href = 'https://research.checkpoint.com/category/threat-and-data-analysis/';"> <input type="checkbox" id="10644" class="cat-filter" value="10644"> <label for="10644"> Threat and data analysis</label> <span>0</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/threat-research-2/" onclick="location.href = 'https://research.checkpoint.com/category/threat-research-2/';"> <input type="checkbox" id="10458" class="cat-filter" value="10458"> <label for="10458"> Threat Research</label> <span>172</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/web3/" onclick="location.href = 'https://research.checkpoint.com/category/web3/';"> <input type="checkbox" id="10653" class="cat-filter" value="10653"> <label for="10653"> Web 3.0 Security</label> <span>9</span> </a> </li> <li> <a href="https://research.checkpoint.com/category/wipers/" onclick="location.href = 'https://research.checkpoint.com/category/wipers/';"> <input type="checkbox" id="10623" class="cat-filter" value="10623"> <label for="10623"> Wipers</label> <span>0</span> </a> </li> </ul> </div> </div> </div> <section id="single-post" class="blog-post-wrapper single-blog-wrapper section-padding background-blue "> <div class="container container-wide"> <div class="flex-row align-items-start"> <div class="flex-8 font-white"> <div class="blog-post-wrap"> <div class="flex-row"> <div class="flex-12"> <div class="image"> <img src="https://research.checkpoint.com/wp-content/uploads/2020/12/DRIDEX-BANNER.jpg" alt=""/> </div> </div> <div class="flex-9"> <div class="text"> <h1 class="h3">Stopping Serial Killer: Catching the Next Strike</h1> <div class="date"> <svg xmlns="http://www.w3.org/2000/svg" width="14.012" height="14.012" viewBox="0 0 14.012 14.012"><path id="Path_149" data-name="Path 149" d="M1.752,4.379v7.882H12.261V4.379Zm9.634-2.627h1.752a.827.827,0,0,1,.876.876V13.137a.827.827,0,0,1-.876.876H.876A.827.827,0,0,1,0,13.137V2.627a.827.827,0,0,1,.876-.876H2.627V.876A.827.827,0,0,1,3.5,0a.827.827,0,0,1,.876.876v.876H9.634V.876a.876.876,0,1,1,1.752,0Zm-.876,8.758H8.758V8.758h1.752Zm-2.627,0H6.13V8.758H7.882Zm2.627-2.627H8.758V6.13h1.752Zm-2.627,0H6.13V6.13H7.882ZM5.255,10.509H3.5V8.758H5.255Z" fill="#fff" fill-rule="evenodd"/></svg> January 4, 2021 </div> </div> </div> <div class="flex-3"> <div class="social-button"> <div class="icon-sharing-links"> <a target="_blank" href="https://www.linkedin.com/shareArticle?mini=true&url=https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/ - https://research.checkpoint.com/?p=24476;source=LinkedIn" title="Share on LinkedIn!" ><svg style="fill: currentColor;" id="Group_185773" data-name="Group 185773" xmlns="http://www.w3.org/2000/svg" width="15.863" height="15.697" viewBox="0 0 15.863 15.697"><path id="Path_28" data-name="Path 28" d="M41.342,107.835H38.107V97.622c2.039-.532,2.921-.341,3.249.629a10.413,10.413,0,0,1,2.275-1.038c2.6-.5,4.128.657,4.565,3.306a7.793,7.793,0,0,1,.128,1.212c.014,1.986.006,3.973.006,6.07H45.04c0-1.073,0-2.147,0-3.22,0-.724.016-1.449-.015-2.173-.075-1.7-.606-2.4-1.771-2.4-1.211.006-1.861.8-1.9,2.469C41.31,104.241,41.342,106,41.342,107.835Z" transform="translate(-32.47 -92.138)" fill="currentColor"/><path id="Path_29" data-name="Path 29" d="M31.482,97.555h3.156v10.359H31.482Z" transform="translate(-31.164 -92.228)" fill="currentColor"/> <path id="Path_30" data-name="Path 30" d="M32.993,94.694a1.862,1.862,0,0,1-1.907-1.862,1.891,1.891,0,0,1,1.88-1.912,1.867,1.867,0,0,1,1.889,1.885A1.816,1.816,0,0,1,32.993,94.694Z" transform="translate(-31.086 -90.92)" fill="currentColor"/></svg></a> <a target="blank" href="http://www.facebook.com/sharer.php?u=https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/ - https://research.checkpoint.com/?p=24476 "title="Share on Facebook!"><svg style="fill: currentColor;" id="WKND-icon" xmlns="http://www.w3.org/2000/svg" width="14.347" height="14.347" viewBox="0 0 14.347 14.347"><rect id="background" width="14.347" height="14.347" transform="translate(0 0)" fill="transparent"/><g id="Dribbble-Light-Preview" transform="translate(3.966 0.077)"><g id="icons"><path id="facebook-_176_" data-name="facebook-[#176]" d="M333.867,7253.27v-6.422h1.95l.318-2.854h-2.268V7242.6c0-.735.019-1.465,1.046-1.465h1.04V7239.1a11.584,11.584,0,0,0-1.8-.1c-1.888,0-3.07,1.183-3.07,3.354v1.641H329v2.854h2.086v6.422Z" transform="translate(-329 -7239)" fill="currentColor" fill-rule="evenodd"/> </g></g></svg></a> <a target="blank" href="http://twitter.com/home/?status=Stopping Serial Killer: Catching the Next Strike - https://research.checkpoint.com/?p=24476 via @kenmata "title="Tweet this!"><svg style="fill: currentColor;" id="WKND-icon" xmlns="http://www.w3.org/2000/svg" width="14.515" height="14.347" viewBox="0 0 14.515 14.347"><rect id="background" width="14.347" height="14.347" transform="translate(0 0)" fill="transparent"/><g id="Dribbble-Light-Preview" transform="translate(0.245 1.504)"><g id="icons"><path id="twitter-_154_" data-name="twitter-[#154]" d="M8.488,7372.416a8.206,8.206,0,0,0,8.33-8.2c0-.125,0-.25-.009-.373a5.9,5.9,0,0,0,1.461-1.492,5.926,5.926,0,0,1-1.681.453,2.9,2.9,0,0,0,1.287-1.595,5.9,5.9,0,0,1-1.859.7,2.964,2.964,0,0,0-4.143-.125,2.858,2.858,0,0,0-.847,2.754,8.364,8.364,0,0,1-6.034-3.011,2.857,2.857,0,0,0,.907,3.847,2.942,2.942,0,0,1-1.329-.36v.036a2.9,2.9,0,0,0,2.349,2.825,2.954,2.954,0,0,1-1.321.049,2.924,2.924,0,0,0,2.735,2,5.929,5.929,0,0,1-3.636,1.236,5.847,5.847,0,0,1-.7-.041,8.379,8.379,0,0,0,4.488,1.292" transform="translate(-4 -7361)" fill="currentColor" fill-rule="evenodd"/></g></g></svg></a> <a onclick="copyToClipboard('#24476')" title="Copy this!"><svg style="fill: currentColor;" xmlns="http://www.w3.org/2000/svg" width="18.7" height="18.7" viewBox="0 0 18.7 18.7"><g id="Group_185774" data-name="Group 185774" transform="translate(-591.15 -798.097)"><g id="copy" transform="translate(592 798.947)"><rect id="Rectangle_147602" data-name="Rectangle 147602" width="11" height="11" rx="2" transform="translate(6 6)" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.7"/><path id="Path_83125" data-name="Path 83125" d="M4.542,13.016H3.695A1.7,1.7,0,0,1,2,11.321V3.695A1.7,1.7,0,0,1,3.695,2h7.626a1.7,1.7,0,0,1,1.695,1.695v.847" transform="translate(-2 -2)" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.7"/></g></g></svg></a> <div id="24476" style="display: none;"/>https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/</div> </div> <div class="icon-sharing"></div> </div> </div> </div> <div class="text border-bottom"> <h1 class="wp-block-heading">Brief</h1> <p>When we look at a prevalent malware family, we give credit to its authors regarding the established malicious infrastructure. New malicious activity is flowing smoothly, command-and-control servers appear, everything works like Swiss watch. Are there any weak points in such a construction?</p> <p>To answer this question we may think about a race car. It’s a masterpiece crafted for maximum speed, however, the more speed it has, the less chances it has to make a sharp turn. Malware infrastructure has the same weakness of inertia. When every joint works fine, you should have a strong reason to change something in it.</p> <p>We can use it for our benefit just like movie detectives do. Take a city map, mark the spots of previous crimes ─ and you will likely understand the pattern and even get a probable place of next crime activity, it will likely follow the determined template. In this research we show how to transform these actions to the world of malware. We take one of the most prevalent contemporary botnets called Dridex, mark its previous crime scenes, build the map and draw conclusions helping us to catch the next strike. We show evidence of success of such an approach measured in strict numbers and explain how to use this idea in other real world cases.</p> <h1 class="wp-block-heading">Introduction</h1> <p>The Dridex Banking Trojan first appeared in 2014 and is still one of the most prevalent malware families. In March 2020, Dridex topped the list of <a href="https://www.checkpoint.com/press/2020/march-2020s-most-wanted-malware-dridex-banking-trojan-ranks-on-top-malware-list-for-first-time/">most wanted malware</a>.</p> <p>Dridex was created by a cyber-crime group called “Evil Corp” which has caused an estimated damage of $100 million to the banking system worldwide. A lot of research has been issued already covering different aspects of the malware details and how the cyber-crime group functions.</p> <p>In this article we provide a summary of key details known about Dridex to date. We explore pre-history of Dridex development, give an overview and show its key technical features and methods of spreading. We explain how we can intercept this malware at the earliest stages of the infection chain. We also provide graphs that show evidence of the success of our approach and how our customers are protected against this malware.</p> <h1 class="wp-block-heading">Background</h1> <p>Dridex has a famous lineage. Let’s take a step back in history to find out more about the time period when its earliest version appeared.</p> <p>The key names in this story:</p> <ul class="wp-block-list"> <li><strong>Evgeniy Bogachev</strong> ─ Creator of the infamous <strong><em>ZeuS</em></strong> malware.</li> <li><strong>Maksim Yakubets</strong> ─ Alleged leader of <strong><em>Evil Corp</em></strong> cyber-crime group which is responsible for Dridex operations.</li> </ul> <h2 class="wp-block-heading">Pre-Dridex era – It all starts with ZeuS</h2> <p>Zeus is a Trojan Horse malware. Its capabilities include turning an infected machine into a botnet node, stealing banking credentials, downloading and executing separate malicious modules. The members of cyber crime group attempted to steal around 220 million USD worldwide utilizing ZeuS according to <a href="https://www.bbc.com/news/world-us-canada-11457611">FBI investigation</a>.</p> <p>The timeline below shows key points in ZeuS evolution:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/1.png"><img fetchpriority="high" decoding="async" width="912" height="377" class="wp-image-24477" src="//research.checkpoint.com/wp-content/uploads/2020/12/1.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/1.png 912w, https://research.checkpoint.com/wp-content/uploads/2020/12/1-300x124.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/1-768x317.png 768w" sizes="(max-width: 912px) 100vw, 912px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 1 – Chronology of ZeuS evolution.</sup></em></p> <p>When ZeuS source code was leaked in 2011, various branches of this malware started to appear. It was very popular malware and gave rise to lots of different malware branches. ZeuS versions may be in a <a href="https://zeusmuseum.com/">ZeuS online museum</a>. At the time of this writing, ZeuS was associated with 29 different malware families, featuring around 490 versions in total.</p> <p>In May 2014, the FBI issued a bulletin with description of Evgeniy Bogachev and the promised reward of 3 million USD “for information leading to the arrest and/or conviction.”</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/2.png"><img decoding="async" width="765" height="762" class="wp-image-24479" src="//research.checkpoint.com/wp-content/uploads/2020/12/2.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/2.png 765w, https://research.checkpoint.com/wp-content/uploads/2020/12/2-300x300.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/2-150x150.png 150w" sizes="(max-width: 765px) 100vw, 765px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 2 – Description of Evgeniy Bogachev on the FBI site.</sup></em></p> <h2 class="wp-block-heading">Dridex era</h2> <p>After the botnets of direct ZeuS successors were taken down, Dridex’s time came. This malware is a result of <strong>Bugat</strong> evolution (which appeared in 2010). Bugat v5 was recognized as Dridex in 2014.</p> <p>More names appear on the stage <a href="https://boingboing.net/2019/12/05/feds-charge-evil-corp-russia.html">at this time</a>.</p> <ul class="wp-block-list"> <li>Andrey Ghinkul (from Moldova) was allegedly one of the administrators behind Dridex botnets in 2015.</li> <li>Igor Turashev was allegedly one of the administrators behind Dridex botnets as well.</li> <li>Denis Gusev was one of the key investors behind EvilCorp.</li> </ul> <p>More names connected to Dridex can be found in <a href="https://home.treasury.gov/news/press-releases/sm845">US treasury sanctions statement</a>.</p> <p>The timeline below shows some milestones in Dridex evolution:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/3.png"><img decoding="async" width="788" height="377" class="wp-image-24480" src="//research.checkpoint.com/wp-content/uploads/2020/12/3.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/3.png 788w, https://research.checkpoint.com/wp-content/uploads/2020/12/3-300x144.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/3-768x367.png 768w" sizes="(max-width: 788px) 100vw, 788px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 3 – Chronology of Dridex evolution.</sup></em></p> <p>Dridex in turn gave rise to a number of ransomwares starting with <strong><em>Bitpaymer</em></strong> in 2017. This branch continued with <strong><em>DoppelPaymer</em></strong>, which was developed in 2019, and <strong><em>WastedLocker</em></strong>, which was developed in 2020.</p> <h2 class="wp-block-heading">Recent past</h2> <p>In 2019, Dridex had at least 14 active botnets, some of which had already been spotted previously, and others newly developed. Botnets are differentiated by their ID numbers. These are among the most active at this time: 10111, 10222, 10444, 40200, 40300.</p> <p>At the end of 2019, the FBI issued a bulletin with a description of the author of Dridex and a promised reward of 5 million USD (compared with 3 million USD previously for E. Bogachev).</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/4.jpg"><img loading="lazy" decoding="async" width="769" height="630" class="wp-image-24481" src="//research.checkpoint.com/wp-content/uploads/2020/12/4.jpg" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/4.jpg 769w, https://research.checkpoint.com/wp-content/uploads/2020/12/4-300x246.jpg 300w" sizes="auto, (max-width: 769px) 100vw, 769px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 4 – Description of Maksim Yakubets on the FBI site.</sup></em></p> <p>There is also evidence of <a href="https://www.businessinsider.com/millionaire-russian-hackers-evil-corp-car-pictures-video-2019-12">Maksim’s luxurious lifestyle</a>, undoubtedly due to income from his malicious activities.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/5.png"><img loading="lazy" decoding="async" width="720" height="405" class="wp-image-24482" src="//research.checkpoint.com/wp-content/uploads/2020/12/5.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/5.png 720w, https://research.checkpoint.com/wp-content/uploads/2020/12/5-300x169.png 300w" sizes="auto, (max-width: 720px) 100vw, 720px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 5 – Cars, girls, money; the luxurious lifestyle of Maksim Yakubets.</sup></em></p> <p>To date, Maksim Yakubets has not been apprehended by law enforcement.</p> <p>As mentioned previously, in 2020, Dridex topped the lists of the most prevalent malware families in the world.</p> <h1 class="wp-block-heading">Infection chain</h1> <p>Before we start the analysis of Dridex samples themselves, we want to understand the infrastructure behind the malware. How is it delivered? What are the targets? What is the initial detection rate of supporting files? We will find the answers to all of these questions below.</p> <h2 class="wp-block-heading">Flow</h2> <p>When the operators want to spread Dridex, they use established spambots from different cyber-crime groups to send malicious documents attached to handily crafted e-mails. At different times of the Dridex lifecycle, <strong><em>Necurs</em></strong>, <strong><em>Cutwail</em></strong> and <strong><em>Andromeda</em></strong> botnets have all been involved in spreading Dridex.</p> <p>When a user downloads and opens such a document (it may be Word or Excel), the embedded macros are launched with the aim of downloading and executing the Dridex payload.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/6.png"><img loading="lazy" decoding="async" width="828" height="369" class="wp-image-24483" src="//research.checkpoint.com/wp-content/uploads/2020/12/6.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/6.png 828w, https://research.checkpoint.com/wp-content/uploads/2020/12/6-300x134.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/6-768x342.png 768w" sizes="auto, (max-width: 828px) 100vw, 828px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 6 – Dridex infection chain execution flow.</sup></em></p> <h2 class="wp-block-heading">Targets</h2> <p>Dridex targets different high-profile entities from various parts of the world:</p> <ul class="wp-block-list"> <li>U.S. bank accounts.</li> <li>U.S. credit card companies.</li> <li>U.S. financial investment corporations.</li> <li>European bank accounts.</li> <li>Governmental agencies in Saudi Arabia, Qatar, Oman.</li> </ul> <h2 class="wp-block-heading">Lures</h2> <p>To increase the successful rate at which Dridex is spread, malicious actors disguise their spam e-mails to look like legitimate ones. We can name examples of UPS, FedEx and DHL as companies whose logos and mailing style are used as bait in such e-mails.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/7.png"><img loading="lazy" decoding="async" width="843" height="365" class="wp-image-24484" src="//research.checkpoint.com/wp-content/uploads/2020/12/7.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/7.png 843w, https://research.checkpoint.com/wp-content/uploads/2020/12/7-300x130.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/7-768x333.png 768w" sizes="auto, (max-width: 843px) 100vw, 843px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 7 – Examples of lures.</sup></em></p> <p>When the victim clicks the link, either the archive with the malicious document or the malicious document itself is opened.</p> <h2 class="wp-block-heading">Initial detection rate</h2> <p>When first seen in the wild, Dridex delivery files show a very low detection rate. In the screenshot below we see the initial detection rate of the Excel document which delivers Dridex:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/8.png"><img loading="lazy" decoding="async" width="1024" height="370" class="wp-image-24485" src="//research.checkpoint.com/wp-content/uploads/2020/12/8-1024x370.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/8-1024x370.png 1024w, https://research.checkpoint.com/wp-content/uploads/2020/12/8-300x108.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/8-768x278.png 768w, https://research.checkpoint.com/wp-content/uploads/2020/12/8.png 1397w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 8 – Initial detection rate of the Dridex delivery file.</sup></em></p> <p>The same is true for other delivery files.</p> <h1 class="wp-block-heading">Loader and Payload</h1> <p>The Dridex sample consists of the loader and the payload. We discuss key points of each part below.</p> <h2 class="wp-block-heading">Anti-debug technique</h2> <p>The Dridex loader utilizes the <strong>OutputDebugStringW</strong> function to make malware analysis more difficult. Different loaders produce different outputs (with the “Installing…” string being very popular) but the idea is the same everywhere: making a long loop that contains a lot of meaningless debug messages. In the figure below, we see the example of such a loop with an iteration of around 200 million:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/9.png"><img loading="lazy" decoding="async" width="702" height="290" class="wp-image-24486" src="//research.checkpoint.com/wp-content/uploads/2020/12/9.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/9.png 702w, https://research.checkpoint.com/wp-content/uploads/2020/12/9-300x124.png 300w" sizes="auto, (max-width: 702px) 100vw, 702px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 9 – Loop with 0xBEBBE7C (around 200 million) iterations calling <strong>OutputDebugStringW.</strong></sup></em></p> <p>The output looks like this in the log:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/10-1.png"><img loading="lazy" decoding="async" width="625" height="494" class="wp-image-24487" src="//research.checkpoint.com/wp-content/uploads/2020/12/10-1.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/10-1.png 625w, https://research.checkpoint.com/wp-content/uploads/2020/12/10-1-300x237.png 300w" sizes="auto, (max-width: 625px) 100vw, 625px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 10 – Dridex debug messages that overwhelm the analysis log.</sup></em></p> <h2 class="wp-block-heading">Obfuscation</h2> <p>The payload is heavily obfuscated; almost no function is called directly. Call resolutions are performed with the help of hash values identifying the library and the function it contains. An example of such a resolution is shown in the screenshot below:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/11.png"><img loading="lazy" decoding="async" width="574" height="165" class="wp-image-24488" src="//research.checkpoint.com/wp-content/uploads/2020/12/11.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/11.png 574w, https://research.checkpoint.com/wp-content/uploads/2020/12/11-300x86.png 300w" sizes="auto, (max-width: 574px) 100vw, 574px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 11 – Example of the call resolution in the Dridex payload.</sup></em></p> <p>All the functions important for key Dridex’ tasks are called this way.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/12.png"><img loading="lazy" decoding="async" width="528" height="164" class="wp-image-24489" src="//research.checkpoint.com/wp-content/uploads/2020/12/12.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/12.png 528w, https://research.checkpoint.com/wp-content/uploads/2020/12/12-300x93.png 300w" sizes="auto, (max-width: 528px) 100vw, 528px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 12 – Example of resolved calls to Internet functions.</sup></em></p> <p>We used the <a href="https://research.checkpoint.com/2018/labeless-an-introduction/">Labeless tool</a> to resolve obfuscated function calls.</p> <p>Strings in the malware are obfuscated using the RC4 algorithm and the decryption key stored inside the sample.</p> <h2 class="wp-block-heading">Configuration</h2> <p>The main point of interest inside the payload is its configuration. It contains the following important details:</p> <ul class="wp-block-list"> <li>Bot ID.</li> <li>Number of C&C servers.</li> <li>List of the C&C servers themselves.</li> </ul> <p>An example of the configuration:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/13.png"><img loading="lazy" decoding="async" width="803" height="83" class="wp-image-24490" src="//research.checkpoint.com/wp-content/uploads/2020/12/13.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/13.png 803w, https://research.checkpoint.com/wp-content/uploads/2020/12/13-300x31.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/13-768x79.png 768w" sizes="auto, (max-width: 803px) 100vw, 803px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 13 – Example of the Dridex configuration inside the payload.</sup></em></p> <p>The bot ID in this example is 12333. The Command and Control servers are:</p> <ul class="wp-block-list"> <li>92.222.216.44:443</li> <li>69.55.238.203:3389</li> <li>66.228.47.181:443</li> <li>198.199.106.229:5900</li> <li>104.247.221.104:443</li> <li>178.254.38.200:884</li> <li>152.46.8.148:884</li> </ul> <h2 class="wp-block-heading">Network activity</h2> <p>Dridex sends POST requests to the servers from the configuration to get further commands, waiting for 200 OK responses. Please note that these servers are not real C&C servers but rather proxies for connecting to the real ones.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/14.png"><img loading="lazy" decoding="async" width="759" height="461" class="wp-image-24491" src="//research.checkpoint.com/wp-content/uploads/2020/12/14.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/14.png 759w, https://research.checkpoint.com/wp-content/uploads/2020/12/14-300x182.png 300w" sizes="auto, (max-width: 759px) 100vw, 759px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 14 – The Dridex botnet infrastructure.</sup></em></p> <p>The information which is sent by the malware to the C&C servers contains the following data:</p> <ul class="wp-block-list"> <li>Computer name</li> <li>Botnet ID number</li> <li>Type of request</li> <li>OS architecture</li> <li>List of installed software</li> </ul> <p>This data is encrypted with the RC4 algorithm, the key for which is stored among encrypted strings inside the malware.</p> <p>There are at least 6 different types of request; among them are the following ones:</p> <ul class="wp-block-list"> <li>“list” – gets configuration</li> <li>“bot” – receives bot module</li> </ul> <h1 class="wp-block-heading">Putting IOCs together</h1> <p>The earlier the infection is caught, the better the chances of mitigation. To catch the infection as quickly as possible while spending the minimum amount of resources, we want to focus on the initial delivery stage.</p> <p>However, detection is only one aspect. We may confidently say that something is malicious, but we also want to classify the threat. To do so, we have to be sure that this particular malware is indeed Dridex.</p> <p>Let’s take a look at the Dridex infection chain again and determine the different stages which we can use for its detection and identification:</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/15.png"><img loading="lazy" decoding="async" width="848" height="378" class="wp-image-24492" src="//research.checkpoint.com/wp-content/uploads/2020/12/15.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/15.png 848w, https://research.checkpoint.com/wp-content/uploads/2020/12/15-300x134.png 300w, https://research.checkpoint.com/wp-content/uploads/2020/12/15-768x342.png 768w" sizes="auto, (max-width: 848px) 100vw, 848px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 15 – Different stages of Dridex detection.</sup></em></p> <p>At different stages of the Dridex infection, we can use the following indicators for its detection.</p> <ul class="wp-block-list"> <li>1<sup>st</sup> stage, malicious documents: <ul> <li>Hashes of the documents</li> </ul> <ul> <li>Images inside documents</li> </ul> <ul> <li>Internal structure of the document</li> </ul> <ul> <li>Macros used inside</li> </ul> </li> <li>2<sup>nd</sup> stage, servers: <ul> <li>Domains</li> </ul> <ul> <li>URLs</li> </ul> </li> <li>3<sup>rd</sup> stage, loaders and payloads: <ul> <li>Hashes of the samples</li> </ul> <ul> <li>IP addresses in the configuration file</li> </ul> </li> </ul> <h2 class="wp-block-heading">Why are so many factors important?</h2> <p>We have seen a correlation between infrastructures and indicators of <strong>Dridex</strong> and other prevalent malware families such as <strong>Emotet</strong> and <strong>Ursnif</strong>. Malicious documents share common indicators when used for the delivery of all the malware mentioned above. Some C2 servers – or to be precise, proxy servers – are used both by Dridex and Emotet, though ports and connection types are different.</p> <p>That’s why we have to analyze a lot of details before we draw a conclusion of what malware we’re dealing with. The more unique factors related to a particular botnet we have, the easier it is to say if another attack has the same patterns.</p> <p>The ideal way to classify malware is of course getting and analyzing the final payload: if it’s Dridex, then everything that was launched before it is classified as Dridex as well. However, it may take some time (sometimes a significant amount after the initial malicious document is obtained) before the result is known. We can do the classification faster, with high confidence, by analyzing all the indicators we get at the earliest stages of infection chain.</p> <h2 class="wp-block-heading">IP addresses to draw a map</h2> <p>Another interesting note is utilizing the same network for downloading Dridex samples. We analyzed domains used for this purpose, resolved their IPs and discovered that quite a few of them reside in the same network <strong>84.38.180.0/22 </strong>with less than 1024 addresses available in total. Network belongs to Russian ASN Selectel that rarely takes down the malicious content or spam.</p> <p>We saw the following IP addresses linked to Dridex domains in the <strong>84.38.180.0/22 </strong>network (and other networks within the same ASN). Dates show the first time the Dridex domain pointed to the corresponding IPs:</p> <figure class="wp-block-table"> <table> <thead> <tr> <th>IPs</th> <th>Date</th> <th>Domains</th> </tr> </thead> <tbody> <tr> <td>84.38.182.248</td> <td>May 10</td> <td>rokadorc.com<br />nrokadorc.com</td> </tr> <tr> <td>84.38.183.77</td> <td>June 17</td> <td>juneusdousigninc.com<br />usdousigninc.com</td> </tr> <tr> <td>84.38.182.236<br />84.38.183.213</td> <td>June 22</td> <td>marutoba.com<br />terrasimonad.com<br />enterassimonad.com</td> </tr> <tr> <td>84.38.181.195</td> <td>June 28</td> <td>caranatrium.com</td> </tr> <tr> <td>84.38.183.114<br />84.38.183.237</td> <td>July 06</td> <td>menodlap.com<br />turendong.com<br />madustag.com</td> </tr> </tbody> </table> </figure> <p>While this factor alone is not enough to identify Dridex, this is a good auxiliary detail to refer to when dealing with Dridex IOCs.</p> <h2 class="wp-block-heading">Detection</h2> <p>The graphs below show Dridex spikes on different dates when we caught the incoming threats at its earliest stages.</p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/16.png"><img loading="lazy" decoding="async" width="250" height="276" class="wp-image-24493" src="//research.checkpoint.com/wp-content/uploads/2020/12/16.png" alt="" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 16 – Dridex infection spike on June 29.</sup></em></p> <div class="wp-block-image"> <figure class="aligncenter size-large"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/17.png"><img loading="lazy" decoding="async" width="380" height="276" class="wp-image-24494" src="//research.checkpoint.com/wp-content/uploads/2020/12/17.png" alt="" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/17.png 380w, https://research.checkpoint.com/wp-content/uploads/2020/12/17-300x218.png 300w" sizes="auto, (max-width: 380px) 100vw, 380px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 17 – <em>Dridex infection spike between July 6 – July 8.</em></sup></em></p> <p>It is crucial to be able to intercept Dridex infection as early as possible. In many cases, if the spam is not being sent for several days consecutively, like it was between July 6 and July 8, the botnet activity slows down the next day and we do not get as many IOC matches as during its spike. Given that new infections appear at around afternoon UTC+3, we have less than 12 hours to react to the incoming threat.</p> <h1 class="wp-block-heading">Dridex development</h1> <p>Since July 22 we haven’t observed any fresh Dridex spam samples. Dridex made a re-appearance on September 7, showing a massive increase in its activity spike for 2 consecutive days:</p> <div class="wp-block-image"> <figure class="aligncenter size-large is-resized"><a href="//research.checkpoint.com/wp-content/uploads/2020/12/18.png"><img loading="lazy" decoding="async" class="wp-image-24495" src="//research.checkpoint.com/wp-content/uploads/2020/12/18.png" alt="" width="376" height="280" srcset="https://research.checkpoint.com/wp-content/uploads/2020/12/18.png 376w, https://research.checkpoint.com/wp-content/uploads/2020/12/18-300x223.png 300w" sizes="auto, (max-width: 376px) 100vw, 376px" /></a></figure> </div> <p class="has-text-align-center"><em><sup>Figure 18 – Recent September spike in Dridex activity.</sup></em></p> <p>Dridex operators updated the 1<sup>st</sup> stage of Dridex execution: they have added more URLs from where payload may be downloaded – as opposed to the single URL in the earliest versions of malicious documents. Now their number may be as high as 50 within the single document.</p> <p>We’re constantly monitoring this botnet and detecting its payload at different stages of execution.</p> <p>We hope this publication provided useful insights on different variants and methods to deal with this threat. We also believe that these methods may be applied when encountering other threats as well.</p> <p> </p> <p>As cyber attacks become increasingly evasive, more controls are added, making security more complicated and tedious to the point that user workflows are affected. Until now.</p> <p class="elementor-heading-title elementor-size-default">Fueled by the Power of ThreatCloud, the Most Powerful Threat Intelligence and AI technologies to prevent unknown cyber threats <br />SandBlast Network <a href="https://www.checkpoint.com/products/advanced-network-threat-prevention/">provides</a> the best zero-day protection while reducing security overhead and ensuring business productivity.</p> <p> </p> <h1>Protection signatures</h1> <p>Banker.Win.Dridex.A<br />Banker.Win.Dridex.B<br />Banker.Win.Dridex.С</p> <p>Banker.Win.Dridex.D</p> <p>Banker.Win.Dridex.E</p> <p>Banker.Win.Dridex.F</p> <p>Banker.Win.Dridex.gl.H</p> <p>Banker.Win.Dridex.J</p> <p>Banker.Win.Dridex.K</p> <h1 class="wp-block-heading">IOCs</h1> <p>Below we list some of the indicators linked to Dridex. Please note that the list is not full by any means.</p> <p>Domains:</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>rokadorc[.com</td> </tr> <tr> <td>nrokadorc[.com</td> </tr> <tr> <td>juneusdousigninc[.com</td> </tr> <tr> <td>usdousigninc[.com</td> </tr> <tr> <td>marutoba[.com</td> </tr> <tr> <td>terrasimonad[.com</td> </tr> <tr> <td>enterassimonad[.com</td> </tr> <tr> <td>caranatrium[.com</td> </tr> <tr> <td>menodlap[.com</td> </tr> <tr> <td>turendong[.com</td> </tr> <tr> <td>madustag[.com</td> </tr> <tr> <td>fattnumdelordine[.com</td> </tr> <tr> <td>armomaq[.com</td> </tr> <tr> <td>caissefamilylaw[.com</td> </tr> <tr> <td>secretpath[.xyz</td> </tr> </tbody> </table> </figure> <p>IP addresses:</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>84[.38.181.195</td> </tr> <tr> <td>84[.38.182.236</td> </tr> <tr> <td>84[.38.182.248</td> </tr> <tr> <td>84[.38.183.77</td> </tr> <tr> <td>84[.38.183.114</td> </tr> <tr> <td>84[.38.183.213</td> </tr> <tr> <td>84[.38.183.237</td> </tr> </tbody> </table> </figure> <p>Dridex 1<sup>st</sup> layer proxy C&C servers:</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>https://45.79.8.25[:443</td> </tr> <tr> <td>https://185.201.9.197[:9443</td> </tr> <tr> <td>https://217.160.78.166[:4664</td> </tr> <tr> <td>https://108.175.9.22[:33443</td> </tr> <tr> <td>https://51.38.124.206[:443/</td> </tr> <tr> <td>https://207.180.230.218[:3389/</td> </tr> <tr> <td>https://2.58.16.87[:8443/</td> </tr> <tr> <td>https://45.177.120.36[:691/</td> </tr> <tr> <td>https://52.114.132.73[:443</td> </tr> <tr> <td>https://192.232.251.32[:443</td> </tr> <tr> <td>https://162.144.41.190[:443</td> </tr> <tr> <td>https://40.122.160.14[:443</td> </tr> <tr> <td>https://67.213.75.205[:443</td> </tr> <tr> <td>https://217.160.78.166[:4664</td> </tr> <tr> <td>https://108.175.9.22[:33443</td> </tr> <tr> <td>https://185.201.9.197[:9443</td> </tr> </tbody> </table> </figure> <p>URLs:</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>https:[//discuss.ojowa.com/themes/wowonder/javascript/tinymce/js/dkfjgbji.gif</td> </tr> <tr> <td>https:[//sjoeberg.nu/a/jdfggo.rar</td> </tr> <tr> <td>https:[//greatstr.com/webadmin/djfhgeh.pdf</td> </tr> <tr> <td>https:[//axalta.grupojenrab.mx/wp-admin/ssfisjgniwerg.pdf</td> </tr> <tr> <td>https:[//bombshellshow.me/wp-content/jdfggo.rar</td> </tr> <tr> <td>https:[//amaimaging.net/wp-content/rjkthgowertgoiwe.zip</td> </tr> <tr> <td>https:[//pharmacy.binarybizz.com/vendor/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//construtorahabite.com.br/wpadmin/rjkthgowertgoiwe.zip</td> </tr> <tr> <td>https:[//drinkangola.com/wp-content/plugins/wordpress-seo/config/composer/dkfjgbji.gif</td> </tr> <tr> <td>https:[//mcciorar.iglesiamcci.cl/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//eduserve.sezibwa.com/images/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//idklearningcentre.com.ng/wp/wp-content/plugins/jetpack/3rd-party/dkfjgbji.gif</td> </tr> <tr> <td>https:[//agencia.fal.cl/wp-includes/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//sweepegy.com/djfhgeh.pdf</td> </tr> <tr> <td>https:[//tallermecanicoyllantera.grupojenrab.mx/wp-admin/rjkthgowertgoiwe.zip</td> </tr> <tr> <td>https:[//neocuboarquitetura.com.br/viewer/ssfisjgniwerg.pdf</td> </tr> <tr> <td>https:[//vyvanse.co/auth14/zxc.zip</td> </tr> <tr> <td>https:[//minsann.se/NewFolder/ad/style/theme/upload/84348fh34hf.pdf</td> </tr> <tr> <td>https:[//admin.grandoceanvilla.com/pug/includes/css/84348fh34hf.pdf</td> </tr> <tr> <td>https:[//glowtank.in/js/ssfisjgniwerg.pdf</td> </tr> <tr> <td>https:[//leandrokblo.com/wp-content/plugins/w3-total-cache/ini/apache_conf/dkfjgbji.gif</td> </tr> <tr> <td>https:[//medszoo.in/jdfggo.rar</td> </tr> <tr> <td>https:[//properties.igpublica.com.br/excelPo/rjkthgowertgoiwe.zip</td> </tr> <tr> <td>https:[//coomiponal.com/simulador/zxc.zip</td> </tr> <tr> <td>https:[//inkrites.com/wp-content/themes/zerif-lite/ti-prevdem/img/84348fh34hf.pdf</td> </tr> <tr> <td>https:[//manogyam.com/storage/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//radiantmso.com/wp-content/plugins/smart-slider-3/library/media/dkfjgbji.gif</td> </tr> <tr> <td>https:[//etsp.org.pk/uploads/jdfggo.rar</td> </tr> <tr> <td>https:[//tmpartners-gh.com/djfhgeh.pdf</td> </tr> <tr> <td>https:[//heraldfashion.store/wp-admin/zxc.zip</td> </tr> <tr> <td>https:[//danojowacollection.com/djfhgeh.pdf</td> </tr> <tr> <td>https:[//leboudoirstquayportrieux.fr/image/ssfisjgniwerg.pdf</td> </tr> <tr> <td>https:[//quiz.walkprints.com/wp-includes/js/tinymce/themes/inlite/84348fh34hf.pdf</td> </tr> <tr> <td>https:[//siebuhr.com/pmosker/zxc.zip</td> </tr> <tr> <td>https:[//karyagrafis.com/njdfhgeroig.rar</td> </tr> <tr> <td>https:[//businessquest.com.my/schedule/jdfggo.rar</td> </tr> <tr> <td>https:[//maisaquihost.com.br/teste/rjkthgowertgoiwe.zip</td> </tr> <tr> <td>https:[//getsolar4zerodown.info/djfhgeh.pdf</td> </tr> <tr> <td>https:[//emyhope.com/wp-content/plugins/jetpack/_inc/blocks/84348fh34hf.pdf</td> </tr> <tr> <td>https:[//igpublica.com.br/asset/zxc.zip</td> </tr> <tr> <td>https:[//speakerpedia.in/images/zxc.zip</td> </tr> <tr> <td>https:[//timamollo.co.za/sitepro/jdfggo.rar</td> </tr> <tr> <td>https:[//eb3tly.online/njdfhgeroig.rar</td> </tr> </tbody> </table> </figure> <p>Hashes (malicious documents):</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>15d3edcf37b1e4d03a5c61c1c7752130a9899b978c94f80d8dabc45f416fc253</td> </tr> <tr> <td>16b98e2156fb721a760cd3d4e5c1a8c18dee54f795c6d8624339e25c5e33c2b1</td> </tr> <tr> <td>97defc4fa68d6d3d76226b2ab02c8c3c0544b4d035083057b52d101f5884cbf1</td> </tr> <tr> <td>99842250e5da8f987227c22d864ea6552cbf176710cd5c45f430bc2765cbf534</td> </tr> <tr> <td>9a54d7a8551641f3c77a6f2743890f30e5d5ed4854fcadb25fc1a45bf928cefb</td> </tr> <tr> <td>a633110b7d2f045d88b43c95838372d556de7bf9d2543149b9e5a984f9377539</td> </tr> <tr> <td>cbbb3ffd6f20060d8176954afb0f26fb220a281fd0e49facd02be8f597f24645</td> </tr> <tr> <td>d3e9f6933d519b6bd1514ceaaa14df64722214c0c6c2a60a6924c92f284b3c08</td> </tr> <tr> <td>d77234374d79b24022c26ecdd16a684ae7e94efba502422d74852b0eddd4f1b4</td> </tr> <tr> <td>d943478cb08756734a766eb5da189eef45577c29d33cbd679976e5cb97f2c9f2</td> </tr> </tbody> </table> </figure> <p>Hashes (malware samples):</p> <figure class="wp-block-table"> <table> <tbody> <tr> <td>84d3573747fbdf7ca822fd5a48726484c8b617e74a920dc2a68dd039b8f576fd</td> </tr> <tr> <td>a633e85176faf87dfa99e89e559e3be3f2854592a3adb9f6ea6aab88c06dd198</td> </tr> <tr> <td>ad4d2f9fcadce231e18e50de3bb58028ae13eaf76a9c085d0073230e0fa17a9e</td> </tr> <tr> <td>b0699861417da2e3626eb78d62d305b7ca5e03f06e5e6bfd0eea99d64306495e</td> </tr> <tr> <td>b5b71c61a29f80c667772f5d008789816e0c7a53193536fc660a6f72009b23de</td> </tr> <tr> <td>b66a5d391335b6dc827225b6531f172151d8a87c7514de789bcaf1999b0645ff</td> </tr> <tr> <td>c37accc1f995cb32235edbea877813109627eca4b209f060bee357489c6bb31b</td> </tr> <tr> <td>c6de2ef240cdca97e8d5d6fdcfc7bfd8d5c81a47204d268bd08e4b963d66a64b</td> </tr> <tr> <td>c8cca37f43f4aa66b4bfbf811931c57971d2f1571cfebbb7d24235c07e108f26</td> </tr> <tr> <td>cc33c8c4eb3588fdd48ddb081f77040283c2f6b8c37777f8202b858b64a5952b</td> </tr> <tr> <td>d18d211cf75fbc048d785af92b76a1aa7a01e381313b1a5e66e9cf564cbe78d4</td> </tr> <tr> <td>f8c974a6572fd522a64d22da3bf36db7e912ccb700bd41623ed286f1e8b0e939</td> </tr> <tr> <td>fa61c3c9e2089deb3f2b40333f5ee0860177692c436c50b07eef85993a1dbfa9</td> </tr> <tr> <td>fcc0db0ce710f68915b4d73274d69bb5765012b02631bb737c66a32a9a708aab</td> </tr> </tbody> </table> </figure> <h1 class="wp-block-heading">Referred Sources</h1> <ol class="wp-block-list" type="1"> <li>The Malware Dridex: Origins and Uses // <a href="https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf">https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf</a></li> <li>Chasing cybercrime: network insights of Dyre and Dridex Trojan bankers //<br /><a href="https://www.blueliv.com/downloads/documentation/reports/Network_insights_of_Dyre_and_Dridex_Trojan_bankers.pdf">https://www.blueliv.com/downloads/documentation/reports/Network_insights_of_Dyre_and_Dridex_Trojan_bankers.pdf</a></li> <li>Dridex: A History of Evolution // <a href="https://securelist.com/dridex-a-history-of-evolution/78531/">https://securelist.com/dridex-a-history-of-evolution/78531/</a></li> <li>Evolution of the GOLD EVERGREEN Threat Group //<br /><a href="https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group">https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group</a></li> <li>Dridex (Bugat v5) Botnet Takeover Operation //<br /><a href="https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation">https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation</a></li> <li>ZeuS Virus // <a href="https://usa.kaspersky.com/resource-center/threats/zeus-virus">https://usa.kaspersky.com/resource-center/threats/zeus-virus</a></li> <li>ZeuS versions // <a href="https://zeusmuseum.com/">https://zeusmuseum.com/</a></li> <li>More than 100 arrests, as FBI uncovers cyber crime ring // <a href="https://www.bbc.com/news/world-us-canada-11457611">https://www.bbc.com/news/world-us-canada-11457611</a></li> <li>Evgeniy Bogachev // <a href="https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev">https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev</a></li> <li>Maksim Yakubets // <a href="https://www.fbi.gov/wanted/cyber/maksim-viktorovich-yakubets">https://www.fbi.gov/wanted/cyber/maksim-viktorovich-yakubets</a></li> <li>Bugat Botnet Administrator Arrested and Malware Disabled // <a href="https://www.fbi.gov/contact-us/field-offices/pittsburgh/news/press-releases/bugat-botnet-administrator-arrested-and-malware-disabled">https://www.fbi.gov/contact-us/field-offices/pittsburgh/news/press-releases/bugat-botnet-administrator-arrested-and-malware-disabled</a></li> <li>Two Russians Indicted Over $100M Dridex Malware Thefts // <a href="https://www.bankinfosecurity.com/two-russians-indicted-over-100m-dridex-malware-thefts-a-13473">https://www.bankinfosecurity.com/two-russians-indicted-over-100m-dridex-malware-thefts-a-13473</a></li> <li>Dridex Banking Trojan Makes a Resurgence, Targets US // <a href="https://www.bankinfosecurity.com/dridex-banking-trojan-makes-resurgence-targets-us-a-9079">https://www.bankinfosecurity.com/dridex-banking-trojan-makes-resurgence-targets-us-a-9079</a></li> <li>TA505 group updates tactics and expands the list of targets // <a href="https://securityaffairs.co/wordpress/90472/cyber-crime/ta505-recent-campaigns.html">https://securityaffairs.co/wordpress/90472/cyber-crime/ta505-recent-campaigns.html</a></li> <li>Email scam aims to drop Dridex on machines by impersonating FedEx, UPS // <a href="https://www.cyberscoop.com/fedex-ups-dridex-email-scam-votiro/">https://www.cyberscoop.com/fedex-ups-dridex-email-scam-votiro/</a></li> <li>Process Injection and Manipulation // <a href="https://www.deepinstinct.com/2019/09/15/malware-evasion-techniques-part-1-process-injection-and-manipulation/">https://www.deepinstinct.com/2019/09/15/malware-evasion-techniques-part-1-process-injection-and-manipulation/</a></li> <li>Dridex’s Bag of Tricks: An Analysis of its Masquerading and Code Injection Techniques // <a href="https://securityboulevard.com/2019/07/dridexs-bag-of-tricks-an-analysis-of-its-masquerading-and-code-injection-techniques/">https://securityboulevard.com/2019/07/dridexs-bag-of-tricks-an-analysis-of-its-masquerading-and-code-injection-techniques/</a></li> <li>Dridex – From Word to Domain Dominance // <a href="https://thedfirreport.com/2020/08/03/dridex-from-word-to-domain-dominance/">https://thedfirreport.com/2020/08/03/dridex-from-word-to-domain-dominance/</a></li> <li>Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware // <a href="https://home.treasury.gov/news/press-releases/sm845">https://home.treasury.gov/news/press-releases/sm845</a></li> <li>The FSB’s personal hackers // <a href="https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-hackers">https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-hackers</a></li> <li>Malware Analysis of Dridex, BitPaymer and DoppelPaymer Campaigns // <a href="https://lifars.com/2019/11/analysis-of-dridex-bitpaymer-and-doppelpaymer-campaign/">https://lifars.com/2019/11/analysis-of-dridex-bitpaymer-and-doppelpaymer-campaign/</a></li> <li>BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0 // <a href="https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/">https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/</a></li> <li>WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group // <a href="https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/">https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/</a></li> <li>Reverse Engineering Dridex And Automating IOC Extraction // <a href="https://www.appgate.com/blog/reverse-engineering-dridex-and-automating-ioc-extraction">https://www.appgate.com/blog/reverse-engineering-dridex-and-automating-ioc-extraction</a></li> </ol> </div> </div> <div class="back-to-top"> <a href="#single-post"> <div class="image center"> <img src="https://research.checkpoint.com/wp-content/uploads/2022/10/back_arrow.svg" alt="" /> </div> GO UP </a> </div> <div class="button-wrap center"> <a class="button background-skyblue font-white skyblue-border" href="/latest-publications/">BACK TO ALL POSTS</a> </div> </div> <div class="flex-4"> <div class="sidebar-post-wrapper"> <div class="sidebar-post-inner"> </div> <div class="sidebar-post-categories popular"> <div class="aside-box"> <h2>POPULAR POSTS</h2> <div class="blog-most-popular font-white"> <div class="blog-most-popular-row relative"> <a class="background-image" href="https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/"> <img src="https://research.checkpoint.com/wp-content/uploads/2023/01/AI-1059x529-copy.jpg" alt=""/> </a> <div class="title"> <ul class="top-content category-wraper"> <li>Artificial Intelligence</li> <li>ChatGPT</li> <li>Check Point Research Publications</li> </ul> <a href="https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/">OPWNAI : Cybercriminals Starting to Use ChatGPT</a> </div> </div> <div class="blog-most-popular-row relative"> <a class="background-image" href="https://research.checkpoint.com/2019/hacking-fortnite/"> <img src="https://research.checkpoint.com/wp-content/uploads/2019/01/Fortnite_1021x580.jpg" alt=""/> </a> <div class="title"> <ul class="top-content category-wraper"> <li>Check Point Research Publications</li> <li>Threat Research</li> </ul> <a href="https://research.checkpoint.com/2019/hacking-fortnite/">Hacking Fortnite Accounts</a> </div> </div> <div class="blog-most-popular-row relative"> <a class="background-image" href="https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/"> <img src="https://research.checkpoint.com/wp-content/uploads/2022/12/OpenAIchatGPT_header.jpg" alt=""/> </a> <div class="title"> <ul class="top-content category-wraper"> <li>Artificial Intelligence</li> <li>ChatGPT</li> <li>Check Point Research Publications</li> </ul> <a href="https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/">OpwnAI: AI That Can Save the Day or HACK it Away</a> </div> </div> </div> </div> </div> </div> </div> </div> </div> <div class="aside-box"> <div class="container container-wide"> <div class="text font-blue-- section-title"> <h3>BLOGS AND PUBLICATIONS</h3> </div> </div> <div class="blog-most-recent font-white"> <div class="blog-slide"> <div class="box relative"> <a class="image background-image--" href="https://research.checkpoint.com/2020/the-turkish-rat-distributes-evolved-adwind-in-a-massive-ongoing-phishing-campaign/" style="background-image: url('https://research.checkpoint.com/wp-content/uploads/2020/02/CheckPointResearchTurkishRat_blog_header.jpg')"> <img src="https://research.checkpoint.com/wp-content/uploads/2020/02/CheckPointResearchTurkishRat_blog_header.jpg" alt=""/> </a> <ul class="top-content category-wraper"> <li>Check Point Research Publications</li> <li>Global Cyber Attack Reports</li> <li>Threat Research</li> </ul> <div class="text" onclick="location.href = 'https://research.checkpoint.com/2020/the-turkish-rat-distributes-evolved-adwind-in-a-massive-ongoing-phishing-campaign/';" > <span class="date small-font">February 17, 2020</span> <h3>“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign</h3> </div> </div> </div> <div class="blog-slide"> <div class="box relative"> <a class="image background-image--" href="https://research.checkpoint.com/2017/the-next-wannacry-vulnerability-is-here/" style="background-image: url('https://research.checkpoint.com/wp-content/uploads/2017/08/WannaCry-Post-No-Image-1021x450.jpg')"> <img src="https://research.checkpoint.com/wp-content/uploads/2017/08/WannaCry-Post-No-Image-1021x450.jpg" alt=""/> </a> <ul class="top-content category-wraper"> <li>Check Point Research Publications</li> </ul> <div class="text" onclick="location.href = 'https://research.checkpoint.com/2017/the-next-wannacry-vulnerability-is-here/';" > <span class="date small-font">August 11, 2017</span> <h3>“The Next WannaCry” Vulnerability is Here</h3> </div> </div> </div> <div class="blog-slide"> <div class="box relative"> <a class="image background-image--" href="https://research.checkpoint.com/2018/rubyminer-cryptominer-affects-30-ww-networks/" style="background-image: url('https://research.checkpoint.com/wp-content/uploads/2018/01/rubyminer.jpg')"> <img src="https://research.checkpoint.com/wp-content/uploads/2018/01/rubyminer.jpg" alt=""/> </a> <ul class="top-content category-wraper"> <li>Check Point Research Publications</li> </ul> <div class="text" onclick="location.href = 'https://research.checkpoint.com/2018/rubyminer-cryptominer-affects-30-ww-networks/';" > <span class="date small-font">January 11, 2018</span> <h3>‘RubyMiner’ Cryptominer Affects 30% of WW Networks</h3> </div> </div> </div> </div> <div class="progress blog-most-recent-bar" role="progressbar" aria-valuemin="0" aria-valuemax="100"> <span class="slider__label sr-only blog-recent-bar"> </span> </div> </div> </section> <footer class="footer section-padding background-skyblue"> <div class="footer-top margin-bottom"> <div class="container container-wide"> <div class="flex-row footer-content"> <div class="flex-2 box left"> <a href="https://research.checkpoint.com"><img src="https://research.checkpoint.com/wp-content/uploads/2022/12/CheckPointResearchLogo_white-1-e1671590634727.png" alt="" class="img-responsive" /></a> <div class="social-media-wrapper"> <div class="social-icons"> <a href="https://www.linkedin.com/company/check-point-software-technologies/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_801_"> <path id="XMLID_802_" d="M72.16,99.73H9.927c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5H72.16c2.762,0,5-2.238,5-5V104.73 C77.16,101.969,74.922,99.73,72.16,99.73z"/> <path id="XMLID_803_" d="M41.066,0.341C18.422,0.341,0,18.743,0,41.362C0,63.991,18.422,82.4,41.066,82.4 c22.626,0,41.033-18.41,41.033-41.038C82.1,18.743,63.692,0.341,41.066,0.341z"/> <path id="XMLID_804_" d="M230.454,94.761c-24.995,0-43.472,10.745-54.679,22.954V104.73c0-2.761-2.238-5-5-5h-59.599 c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5h62.097c2.762,0,5-2.238,5-5v-98.918c0-33.333,9.054-46.319,32.29-46.319 c25.306,0,27.317,20.818,27.317,48.034v97.204c0,2.762,2.238,5,5,5H305c2.762,0,5-2.238,5-5V194.995 C310,145.43,300.549,94.761,230.454,94.761z"/></g></svg></a> <a href="https://twitter.com/_cpresearch_" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="https://www.w3.org/2000/svg" xmlns:xlink="https://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><g id="XMLID_826_"> <path id="XMLID_827_" d="M302.973,57.388c-4.87,2.16-9.877,3.983-14.993,5.463c6.057-6.85,10.675-14.91,13.494-23.73 c0.632-1.977-0.023-4.141-1.648-5.434c-1.623-1.294-3.878-1.449-5.665-0.39c-10.865,6.444-22.587,11.075-34.878,13.783 c-12.381-12.098-29.197-18.983-46.581-18.983c-36.695,0-66.549,29.853-66.549,66.547c0,2.89,0.183,5.764,0.545,8.598 C101.163,99.244,58.83,76.863,29.76,41.204c-1.036-1.271-2.632-1.956-4.266-1.825c-1.635,0.128-3.104,1.05-3.93,2.467 c-5.896,10.117-9.013,21.688-9.013,33.461c0,16.035,5.725,31.249,15.838,43.137c-3.075-1.065-6.059-2.396-8.907-3.977 c-1.529-0.851-3.395-0.838-4.914,0.033c-1.52,0.871-2.473,2.473-2.513,4.224c-0.007,0.295-0.007,0.59-0.007,0.889 c0,23.935,12.882,45.484,32.577,57.229c-1.692-0.169-3.383-0.414-5.063-0.735c-1.732-0.331-3.513,0.276-4.681,1.597 c-1.17,1.32-1.557,3.16-1.018,4.84c7.29,22.76,26.059,39.501,48.749,44.605c-18.819,11.787-40.34,17.961-62.932,17.961 c-4.714,0-9.455-0.277-14.095-0.826c-2.305-0.274-4.509,1.087-5.294,3.279c-0.785,2.193,0.047,4.638,2.008,5.895 c29.023,18.609,62.582,28.445,97.047,28.445c67.754,0,110.139-31.95,133.764-58.753c29.46-33.421,46.356-77.658,46.356-121.367 c0-1.826-0.028-3.67-0.084-5.508c11.623-8.757,21.63-19.355,29.773-31.536c1.237-1.85,1.103-4.295-0.33-5.998 C307.394,57.037,305.009,56.486,302.973,57.388z"/></g></svg></a> <a href="https://www.facebook.com/checkpointresearch/" target="_blank"><svg style="fill: currentColor;" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 310 310" style="enable-background:new 0 0 310 310;" xml:space="preserve"><path id="XMLID_835_" d="M81.703,165.106h33.981V305c0,2.762,2.238,5,5,5h57.616c2.762,0,5-2.238,5-5V165.765h39.064 c2.54,0,4.677-1.906,4.967-4.429l5.933-51.502c0.163-1.417-0.286-2.836-1.234-3.899c-0.949-1.064-2.307-1.673-3.732-1.673h-44.996 V71.978c0-9.732,5.24-14.667,15.576-14.667c1.473,0,29.42,0,29.42,0c2.762,0,5-2.239,5-5V5.037c0-2.762-2.238-5-5-5h-40.545 C187.467,0.023,186.832,0,185.896,0c-7.035,0-31.488,1.381-50.804,19.151c-21.402,19.692-18.427,43.27-17.716,47.358v37.752H81.703 c-2.762,0-5,2.238-5,5v50.844C76.703,162.867,78.941,165.106,81.703,165.106z"/></svg></a> </div> </div> </div> <div class="flex-6 desktop-view"> <div class="footer-menu-wrapper menu-wrap"> <div class="nav-menu"> <div class="nav-footer-wrap"><ul id="menu-footer-menus" class="nav-footer"><li id="menu-item-26658" class="blod menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-26658"><a href="#">Publications</a> <ul class="sub-menu"> <li id="menu-item-26659" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26659"><a href="/category/threat-intelligence-reports/">Global cyber attack reports</a></li> <li id="menu-item-26660" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26660"><a href="/category/threat-research/">Research publications</a></li> <li id="menu-item-26661" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26661"><a href="https://advisories.checkpoint.com/advisories/">IPS advisories</a></li> <li id="menu-item-26662" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26662"><a href="https://blog.checkpoint.com/">Check point blog</a></li> <li id="menu-item-26663" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26663"><a href="/category/demos/">Demos</a></li> </ul> </li> <li id="menu-item-26664" class="blod menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-26664"><a href="#">Tools</a> <ul class="sub-menu"> <li id="menu-item-26665" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26665"><a href="http://threatemulation.checkpoint.com/">Sandblast file analysis</a></li> <li id="menu-item-26667" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26667"><a href="https://www.checkpoint.com/infinity/threatcloud/">ThreatCloud</a></li> <li id="menu-item-27018" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-27018"><a href="https://www.checkpoint.com/solutions/threat-intelligence-research/">Threat Intelligence</a></li> <li id="menu-item-27019" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-27019"><a href="https://www.checkpoint.com/infinity/zero-day-protection/">Zero day protection</a></li> <li id="menu-item-26668" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26668"><a href="https://threatmap.checkpoint.com/">Live threat map</a></li> </ul> </li> <li id="menu-item-26669" class="blod menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-26669"><a href="https://research.checkpoint.com/about-us/">About Us</a> <ul class="sub-menu"> <li id="menu-item-26670" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-26670"><a href="https://research.checkpoint.com/contact/">Contact Us</a></li> </ul> </li> </ul></div> </div> </div> </div> <div class="flex-4 box right"> <div class="text font-blue text-black"> <h3>Let’s get in touch</h3> <p>Subscribe for cpr blogs, news and more</p> <p><a href="/subscription/" style="color:#fff; font-weight: bold; text-decoration: underline;">Subscribe Now</a></p> </div> </div> </div> </div> </div> <div class="footer-bottom font-white"> <div class="container container-wide"> <div class="flex-row footer-content"> <div class="flex-6 box-left"><div class="display-flex align-items-center"><p>© 1994-2024 Check Point Software Technologies LTD. All rights reserved.</p> </div></div> <div class="flex-6"> <div class="footer-bottom-right"> <div class="box padding-right"><p>Property of <a href="https://www.checkpoint.com/">CheckPoint.com</a></p> </div> <div class="box"><p><a href="/privacy-policy/">Privacy Policy</a></p> </div> </div> </div> </div> </div> </div> </footer><script> /* slick slider */ !function(b){"function"==typeof define&&define.amd?define(["jquery"],b):"undefined"!=typeof exports?module.exports=b(require("jquery")):b(jQuery)}(function(d){var c=window.Slick||{};c=function(){function e(i,h){var b,g=this;g.defaults={accessibility:!0,adaptiveHeight:!1,appendArrows:d(i),appendDots:d(i),arrows:!0,asNavFor:null,prevArrow:'<button type="button" data-role="none" class="slick-prev" aria-label="Previous" tabindex="0" role="button">Previous</button>',nextArrow:'<button type="button" data-role="none" class="slick-next" aria-label="Next" tabindex="0" role="button">Next</button>',autoplay:!1,autoplaySpeed:3000,centerMode:!1,centerPadding:"50px",cssEase:"ease",customPaging:function(f,j){return d('<button type="button" data-role="none" role="button" tabindex="0" />').text(j+1)},dots:!1,dotsClass:"slick-dots",draggable:!0,easing:"linear",edgeFriction:0.35,fade:!1,focusOnSelect:!1,infinite:!0,initialSlide:0,lazyLoad:"ondemand",mobileFirst:!1,pauseOnHover:!0,pauseOnFocus:!0,pauseOnDotsHover:!1,respondTo:"window",responsive:null,rows:1,rtl:!1,slide:"",slidesPerRow:1,slidesToShow:1,slidesToScroll:1,speed:500,swipe:!0,swipeToSlide:!1,touchMove:!0,touchThreshold:5,useCSS:!0,useTransform:!0,variableWidth:!1,vertical:!1,verticalSwiping:!1,waitForAnimate:!0,zIndex:1000},g.initials={animating:!1,dragging:!1,autoPlayTimer:null,currentDirection:0,currentLeft:null,currentSlide:0,direction:1,$dots:null,listWidth:null,listHeight:null,loadIndex:0,$nextArrow:null,$prevArrow:null,slideCount:null,slideWidth:null,$slideTrack:null,$slides:null,sliding:!1,slideOffset:0,swipeLeft:null,$list:null,touchObject:{},transformsEnabled:!1,unslicked:!1},d.extend(g,g.initials),g.activeBreakpoint=null,g.animType=null,g.animProp=null,g.breakpoints=[],g.breakpointSettings=[],g.cssTransitions=!1,g.focussed=!1,g.interrupted=!1,g.hidden="hidden",g.paused=!0,g.positionProp=null,g.respondTo=null,g.rowCount=1,g.shouldClick=!0,g.$slider=d(i),g.$slidesCache=null,g.transformType=null,g.transitionType=null,g.visibilityChange="visibilitychange",g.windowWidth=0,g.windowTimer=null,b=d(i).data("slick")||{},g.options=d.extend({},g.defaults,h,b),g.currentSlide=g.options.initialSlide,g.originalSettings=g.options,"undefined"!=typeof document.mozHidden?(g.hidden="mozHidden",g.visibilityChange="mozvisibilitychange"):"undefined"!=typeof document.webkitHidden&&(g.hidden="webkitHidden",g.visibilityChange="webkitvisibilitychange"),g.autoPlay=d.proxy(g.autoPlay,g),g.autoPlayClear=d.proxy(g.autoPlayClear,g),g.autoPlayIterator=d.proxy(g.autoPlayIterator,g),g.changeSlide=d.proxy(g.changeSlide,g),g.clickHandler=d.proxy(g.clickHandler,g),g.selectHandler=d.proxy(g.selectHandler,g),g.setPosition=d.proxy(g.setPosition,g),g.swipeHandler=d.proxy(g.swipeHandler,g),g.dragHandler=d.proxy(g.dragHandler,g),g.keyHandler=d.proxy(g.keyHandler,g),g.instanceUid=a++,g.htmlExpr=/^(?:\s*(<[\w\W]+>)[^>]*)$/,g.registerBreakpoints(),g.init(!0)}var a=0;return e}(),c.prototype.activateADA=function(){var b=this;b.$slideTrack.find(".slick-active").attr({"aria-hidden":"false"}).find("a, input, button, select").attr({tabindex:"0"})},c.prototype.addSlide=c.prototype.slickAdd=function(a,h,g){var f=this;if("boolean"==typeof h){g=h,h=null}else{if(0>h||h>=f.slideCount){return !1}}f.unload(),"number"==typeof h?0===h&&0===f.$slides.length?d(a).appendTo(f.$slideTrack):g?d(a).insertBefore(f.$slides.eq(h)):d(a).insertAfter(f.$slides.eq(h)):g===!0?d(a).prependTo(f.$slideTrack):d(a).appendTo(f.$slideTrack),f.$slides=f.$slideTrack.children(this.options.slide),f.$slideTrack.children(this.options.slide).detach(),f.$slideTrack.append(f.$slides),f.$slides.each(function(e,i){d(i).attr("data-slick-index",e)}),f.$slidesCache=f.$slides,f.reinit()},c.prototype.animateHeight=function(){var f=this;if(1===f.options.slidesToShow&&f.options.adaptiveHeight===!0&&f.options.vertical===!1){var e=f.$slides.eq(f.currentSlide).outerHeight(!0);f.$list.animate({height:e},f.options.speed)}},c.prototype.animateSlide=function(a,h){var g={},f=this;f.animateHeight(),f.options.rtl===!0&&f.options.vertical===!1&&(a=-a),f.transformsEnabled===!1?f.options.vertical===!1?f.$slideTrack.animate({left:a},f.options.speed,f.options.easing,h):f.$slideTrack.animate({top:a},f.options.speed,f.options.easing,h):f.cssTransitions===!1?(f.options.rtl===!0&&(f.currentLeft=-f.currentLeft),d({animStart:f.currentLeft}).animate({animStart:a},{duration:f.options.speed,easing:f.options.easing,step:function(b){b=Math.ceil(b),f.options.vertical===!1?(g[f.animType]="translate("+b+"px, 0px)",f.$slideTrack.css(g)):(g[f.animType]="translate(0px,"+b+"px)",f.$slideTrack.css(g))},complete:function(){h&&h.call()}})):(f.applyTransition(),a=Math.ceil(a),f.options.vertical===!1?g[f.animType]="translate3d("+a+"px, 0px, 0px)":g[f.animType]="translate3d(0px,"+a+"px, 0px)",f.$slideTrack.css(g),h&&setTimeout(function(){f.disableTransition(),h.call()},f.options.speed))},c.prototype.getNavTarget=function(){var a=this,e=a.options.asNavFor;return e&&null!==e&&(e=d(e).not(a.$slider)),e},c.prototype.asNavFor=function(a){var f=this,e=f.getNavTarget();null!==e&&"object"==typeof e&&e.each(function(){var b=d(this).slick("getSlick");b.unslicked||b.slideHandler(a,!0)})},c.prototype.applyTransition=function(f){var e=this,g={};e.options.fade===!1?g[e.transitionType]=e.transformType+" "+e.options.speed+"ms "+e.options.cssEase:g[e.transitionType]="opacity "+e.options.speed+"ms "+e.options.cssEase,e.options.fade===!1?e.$slideTrack.css(g):e.$slides.eq(f).css(g)},c.prototype.autoPlay=function(){var b=this;b.autoPlayClear(),b.slideCount>b.options.slidesToShow&&(b.autoPlayTimer=setInterval(b.autoPlayIterator,b.options.autoplaySpeed))},c.prototype.autoPlayClear=function(){var b=this;b.autoPlayTimer&&clearInterval(b.autoPlayTimer)},c.prototype.autoPlayIterator=function(){var f=this,e=f.currentSlide+f.options.slidesToScroll;f.paused||f.interrupted||f.focussed||(f.options.infinite===!1&&(1===f.direction&&f.currentSlide+1===f.slideCount-1?f.direction=0:0===f.direction&&(e=f.currentSlide-f.options.slidesToScroll,f.currentSlide-1===0&&(f.direction=1))),f.slideHandler(e))},c.prototype.buildArrows=function(){var a=this;a.options.arrows===!0&&(a.$prevArrow=d(a.options.prevArrow).addClass("slick-arrow"),a.$nextArrow=d(a.options.nextArrow).addClass("slick-arrow"),a.slideCount>a.options.slidesToShow?(a.$prevArrow.removeClass("slick-hidden").removeAttr("aria-hidden tabindex"),a.$nextArrow.removeClass("slick-hidden").removeAttr("aria-hidden tabindex"),a.htmlExpr.test(a.options.prevArrow)&&a.$prevArrow.prependTo(a.options.appendArrows),a.htmlExpr.test(a.options.nextArrow)&&a.$nextArrow.appendTo(a.options.appendArrows),a.options.infinite!==!0&&a.$prevArrow.addClass("slick-disabled").attr("aria-disabled","true")):a.$prevArrow.add(a.$nextArrow).addClass("slick-hidden").attr({"aria-disabled":"true",tabindex:"-1"}))},c.prototype.buildDots=function(){var f,e,a=this;if(a.options.dots===!0&&a.slideCount>a.options.slidesToShow){for(a.$slider.addClass("slick-dotted"),e=d("<ul />").addClass(a.options.dotsClass),f=0;f<=a.getDotCount();f+=1){e.append(d("<li />").append(a.options.customPaging.call(this,a,f)))}a.$dots=e.appendTo(a.options.appendDots),a.$dots.find("li").first().addClass("slick-active").attr("aria-hidden","false")}},c.prototype.buildOut=function(){var a=this;a.$slides=a.$slider.children(a.options.slide+":not(.slick-cloned)").addClass("slick-slide"),a.slideCount=a.$slides.length,a.$slides.each(function(e,f){d(f).attr("data-slick-index",e).data("originalStyling",d(f).attr("style")||"")}),a.$slider.addClass("slick-slider"),a.$slideTrack=0===a.slideCount?d('<div class="slick-track"/>').appendTo(a.$slider):a.$slides.wrapAll('<div class="slick-track"/>').parent(),a.$list=a.$slideTrack.wrap('<div aria-live="polite" class="slick-list"/>').parent(),a.$slideTrack.css("opacity",0),(a.options.centerMode===!0||a.options.swipeToSlide===!0)&&(a.options.slidesToScroll=1),d("img[data-lazy]",a.$slider).not("[src]").addClass("slick-loading"),a.setupInfinite(),a.buildArrows(),a.buildDots(),a.updateDots(),a.setSlideClasses("number"==typeof a.currentSlide?a.currentSlide:0),a.options.draggable===!0&&a.$list.addClass("draggable")},c.prototype.buildRows=function(){var u,t,s,r,q,p,o,v=this;if(r=document.createDocumentFragment(),p=v.$slider.children(),v.options.rows>1){for(o=v.options.slidesPerRow*v.options.rows,q=Math.ceil(p.length/o),u=0;q>u;u++){var n=document.createElement("div");for(t=0;t<v.options.rows;t++){var m=document.createElement("div");for(s=0;s<v.options.slidesPerRow;s++){var l=u*o+(t*v.options.slidesPerRow+s);p.get(l)&&m.appendChild(p.get(l))}n.appendChild(m)}r.appendChild(n)}v.$slider.empty().append(r),v.$slider.children().children().children().css({width:100/v.options.slidesPerRow+"%",display:"inline-block"})}},c.prototype.checkResponsive=function(r,q){var o,n,m,p=this,l=!1,k=p.$slider.width(),a=window.innerWidth||d(window).width();if("window"===p.respondTo?m=a:"slider"===p.respondTo?m=k:"min"===p.respondTo&&(m=Math.min(a,k)),p.options.responsive&&p.options.responsive.length&&null!==p.options.responsive){n=null;for(o in p.breakpoints){p.breakpoints.hasOwnProperty(o)&&(p.originalSettings.mobileFirst===!1?m<p.breakpoints[o]&&(n=p.breakpoints[o]):m>p.breakpoints[o]&&(n=p.breakpoints[o]))}null!==n?null!==p.activeBreakpoint?(n!==p.activeBreakpoint||q)&&(p.activeBreakpoint=n,"unslick"===p.breakpointSettings[n]?p.unslick(n):(p.options=d.extend({},p.originalSettings,p.breakpointSettings[n]),r===!0&&(p.currentSlide=p.options.initialSlide),p.refresh(r)),l=n):(p.activeBreakpoint=n,"unslick"===p.breakpointSettings[n]?p.unslick(n):(p.options=d.extend({},p.originalSettings,p.breakpointSettings[n]),r===!0&&(p.currentSlide=p.options.initialSlide),p.refresh(r)),l=n):null!==p.activeBreakpoint&&(p.activeBreakpoint=null,p.options=p.originalSettings,r===!0&&(p.currentSlide=p.options.initialSlide),p.refresh(r),l=n),r||l===!1||p.$slider.trigger("breakpoint",[p,l])}},c.prototype.changeSlide=function(a,p){var m,l,k,o=this,n=d(a.currentTarget);switch(n.is("a")&&a.preventDefault(),n.is("li")||(n=n.closest("li")),k=o.slideCount%o.options.slidesToScroll!==0,m=k?0:(o.slideCount-o.currentSlide)%o.options.slidesToScroll,a.data.message){case"previous":l=0===m?o.options.slidesToScroll:o.options.slidesToShow-m,o.slideCount>o.options.slidesToShow&&o.slideHandler(o.currentSlide-l,!1,p);break;case"next":l=0===m?o.options.slidesToScroll:m,o.slideCount>o.options.slidesToShow&&o.slideHandler(o.currentSlide+l,!1,p);break;case"index":var j=0===a.data.index?0:a.data.index||n.index()*o.options.slidesToScroll;o.slideHandler(o.checkNavigable(j),!1,p),n.children().trigger("focus");break;default:return}},c.prototype.checkNavigable=function(g){var j,i,f=this;if(j=f.getNavigableIndexes(),i=0,g>j[j.length-1]){g=j[j.length-1]}else{for(var h in j){if(g<j[h]){g=i;break}i=j[h]}}return g},c.prototype.cleanUpEvents=function(){var a=this;a.options.dots&&null!==a.$dots&&d("li",a.$dots).off("click.slick",a.changeSlide).off("mouseenter.slick",d.proxy(a.interrupt,a,!0)).off("mouseleave.slick",d.proxy(a.interrupt,a,!1)),a.$slider.off("focus.slick blur.slick"),a.options.arrows===!0&&a.slideCount>a.options.slidesToShow&&(a.$prevArrow&&a.$prevArrow.off("click.slick",a.changeSlide),a.$nextArrow&&a.$nextArrow.off("click.slick",a.changeSlide)),a.$list.off("touchstart.slick mousedown.slick",a.swipeHandler),a.$list.off("touchmove.slick mousemove.slick",a.swipeHandler),a.$list.off("touchend.slick mouseup.slick",a.swipeHandler),a.$list.off("touchcancel.slick mouseleave.slick",a.swipeHandler),a.$list.off("click.slick",a.clickHandler),d(document).off(a.visibilityChange,a.visibility),a.cleanUpSlideEvents(),a.options.accessibility===!0&&a.$list.off("keydown.slick",a.keyHandler),a.options.focusOnSelect===!0&&d(a.$slideTrack).children().off("click.slick",a.selectHandler),d(window).off("orientationchange.slick.slick-"+a.instanceUid,a.orientationChange),d(window).off("resize.slick.slick-"+a.instanceUid,a.resize),d("[draggable!=true]",a.$slideTrack).off("dragstart",a.preventDefault),d(window).off("load.slick.slick-"+a.instanceUid,a.setPosition),d(document).off("ready.slick.slick-"+a.instanceUid,a.setPosition)},c.prototype.cleanUpSlideEvents=function(){var a=this;a.$list.off("mouseenter.slick",d.proxy(a.interrupt,a,!0)),a.$list.off("mouseleave.slick",d.proxy(a.interrupt,a,!1))},c.prototype.cleanUpRows=function(){var e,f=this;f.options.rows>1&&(e=f.$slides.children().children(),e.removeAttr("style"),f.$slider.empty().append(e))},c.prototype.clickHandler=function(f){var e=this;e.shouldClick===!1&&(f.stopImmediatePropagation(),f.stopPropagation(),f.preventDefault())},c.prototype.destroy=function(a){var e=this;e.autoPlayClear(),e.touchObject={},e.cleanUpEvents(),d(".slick-cloned",e.$slider).detach(),e.$dots&&e.$dots.remove(),e.$prevArrow&&e.$prevArrow.length&&(e.$prevArrow.removeClass("slick-disabled slick-arrow slick-hidden").removeAttr("aria-hidden aria-disabled tabindex").css("display",""),e.htmlExpr.test(e.options.prevArrow)&&e.$prevArrow.remove()),e.$nextArrow&&e.$nextArrow.length&&(e.$nextArrow.removeClass("slick-disabled slick-arrow slick-hidden").removeAttr("aria-hidden aria-disabled tabindex").css("display",""),e.htmlExpr.test(e.options.nextArrow)&&e.$nextArrow.remove()),e.$slides&&(e.$slides.removeClass("slick-slide slick-active slick-center slick-visible slick-current").removeAttr("aria-hidden").removeAttr("data-slick-index").each(function(){d(this).attr("style",d(this).data("originalStyling"))}),e.$slideTrack.children(this.options.slide).detach(),e.$slideTrack.detach(),e.$list.detach(),e.$slider.append(e.$slides)),e.cleanUpRows(),e.$slider.removeClass("slick-slider"),e.$slider.removeClass("slick-initialized"),e.$slider.removeClass("slick-dotted"),e.unslicked=!0,a||e.$slider.trigger("destroy",[e])},c.prototype.disableTransition=function(f){var e=this,g={};g[e.transitionType]="",e.options.fade===!1?e.$slideTrack.css(g):e.$slides.eq(f).css(g)},c.prototype.fadeSlide=function(f,e){var g=this;g.cssTransitions===!1?(g.$slides.eq(f).css({zIndex:g.options.zIndex}),g.$slides.eq(f).animate({opacity:1},g.options.speed,g.options.easing,e)):(g.applyTransition(f),g.$slides.eq(f).css({opacity:1,zIndex:g.options.zIndex}),e&&setTimeout(function(){g.disableTransition(f),e.call()},g.options.speed))},c.prototype.fadeSlideOut=function(f){var e=this;e.cssTransitions===!1?e.$slides.eq(f).animate({opacity:0,zIndex:e.options.zIndex-2},e.options.speed,e.options.easing):(e.applyTransition(f),e.$slides.eq(f).css({opacity:0,zIndex:e.options.zIndex-2}))},c.prototype.filterSlides=c.prototype.slickFilter=function(f){var e=this;null!==f&&(e.$slidesCache=e.$slides,e.unload(),e.$slideTrack.children(this.options.slide).detach(),e.$slidesCache.filter(f).appendTo(e.$slideTrack),e.reinit())},c.prototype.focusHandler=function(){var a=this;a.$slider.off("focus.slick blur.slick").on("focus.slick blur.slick","*:not(.slick-arrow)",function(e){e.stopImmediatePropagation();var b=d(this);setTimeout(function(){a.options.pauseOnFocus&&(a.focussed=b.is(":focus"),a.autoPlay())},0)})},c.prototype.getCurrent=c.prototype.slickCurrentSlide=function(){var b=this;return b.currentSlide},c.prototype.getDotCount=function(){var f=this,e=0,h=0,g=0;if(f.options.infinite===!0){for(;e<f.slideCount;){++g,e=h+f.options.slidesToScroll,h+=f.options.slidesToScroll<=f.options.slidesToShow?f.options.slidesToScroll:f.options.slidesToShow}}else{if(f.options.centerMode===!0){g=f.slideCount}else{if(f.options.asNavFor){for(;e<f.slideCount;){++g,e=h+f.options.slidesToScroll,h+=f.options.slidesToScroll<=f.options.slidesToShow?f.options.slidesToScroll:f.options.slidesToShow}}else{g=1+Math.ceil((f.slideCount-f.options.slidesToShow)/f.options.slidesToScroll)}}}return g-1},c.prototype.getLeft=function(h){var l,k,i,g=this,j=0;return g.slideOffset=0,k=g.$slides.first().outerHeight(!0),g.options.infinite===!0?(g.slideCount>g.options.slidesToShow&&(g.slideOffset=g.slideWidth*g.options.slidesToShow*-1,j=k*g.options.slidesToShow*-1),g.slideCount%g.options.slidesToScroll!==0&&h+g.options.slidesToScroll>g.slideCount&&g.slideCount>g.options.slidesToShow&&(h>g.slideCount?(g.slideOffset=(g.options.slidesToShow-(h-g.slideCount))*g.slideWidth*-1,j=(g.options.slidesToShow-(h-g.slideCount))*k*-1):(g.slideOffset=g.slideCount%g.options.slidesToScroll*g.slideWidth*-1,j=g.slideCount%g.options.slidesToScroll*k*-1))):h+g.options.slidesToShow>g.slideCount&&(g.slideOffset=(h+g.options.slidesToShow-g.slideCount)*g.slideWidth,j=(h+g.options.slidesToShow-g.slideCount)*k),g.slideCount<=g.options.slidesToShow&&(g.slideOffset=0,j=0),g.options.centerMode===!0&&g.options.infinite===!0?g.slideOffset+=g.slideWidth*Math.floor(g.options.slidesToShow/2)-g.slideWidth:g.options.centerMode===!0&&(g.slideOffset=0,g.slideOffset+=g.slideWidth*Math.floor(g.options.slidesToShow/2)),l=g.options.vertical===!1?h*g.slideWidth*-1+g.slideOffset:h*k*-1+j,g.options.variableWidth===!0&&(i=g.slideCount<=g.options.slidesToShow||g.options.infinite===!1?g.$slideTrack.children(".slick-slide").eq(h):g.$slideTrack.children(".slick-slide").eq(h+g.options.slidesToShow),l=g.options.rtl===!0?i[0]?-1*(g.$slideTrack.width()-i[0].offsetLeft-i.width()):0:i[0]?-1*i[0].offsetLeft:0,g.options.centerMode===!0&&(i=g.slideCount<=g.options.slidesToShow||g.options.infinite===!1?g.$slideTrack.children(".slick-slide").eq(h):g.$slideTrack.children(".slick-slide").eq(h+g.options.slidesToShow+1),l=g.options.rtl===!0?i[0]?-1*(g.$slideTrack.width()-i[0].offsetLeft-i.width()):0:i[0]?-1*i[0].offsetLeft:0,l+=(g.$list.width()-i.outerWidth())/2)),l},c.prototype.getOption=c.prototype.slickGetOption=function(f){var e=this;return e.options[f]},c.prototype.getNavigableIndexes=function(){var h,g=this,f=0,j=0,i=[];for(g.options.infinite===!1?h=g.slideCount:(f=-1*g.options.slidesToScroll,j=-1*g.options.slidesToScroll,h=2*g.slideCount);h>f;){i.push(f),f=j+g.options.slidesToScroll,j+=g.options.slidesToScroll<=g.options.slidesToShow?g.options.slidesToScroll:g.options.slidesToShow}return i},c.prototype.getSlick=function(){return this},c.prototype.getSlideCount=function(){var h,g,f,a=this;return f=a.options.centerMode===!0?a.slideWidth*Math.floor(a.options.slidesToShow/2):0,a.options.swipeToSlide===!0?(a.$slideTrack.find(".slick-slide").each(function(e,b){return b.offsetLeft-f+d(b).outerWidth()/2>-1*a.swipeLeft?(g=b,!1):void 0}),h=Math.abs(d(g).attr("data-slick-index")-a.currentSlide)||1):a.options.slidesToScroll},c.prototype.goTo=c.prototype.slickGoTo=function(f,e){var g=this;g.changeSlide({data:{message:"index",index:parseInt(f)}},e)},c.prototype.init=function(a){var e=this;d(e.$slider).hasClass("slick-initialized")||(d(e.$slider).addClass("slick-initialized"),e.buildRows(),e.buildOut(),e.setProps(),e.startLoad(),e.loadSlider(),e.initializeEvents(),e.updateArrows(),e.updateDots(),e.checkResponsive(!0),e.focusHandler()),a&&e.$slider.trigger("init",[e]),e.options.accessibility===!0&&e.initADA(),e.options.autoplay&&(e.paused=!1,e.autoPlay())},c.prototype.initADA=function(){var a=this;a.$slides.add(a.$slideTrack.find(".slick-cloned")).attr({"aria-hidden":"true",tabindex:"-1"}).find("a, input, button, select").attr({tabindex:"-1"}),a.$slideTrack.attr("role","listbox"),a.$slides.not(a.$slideTrack.find(".slick-cloned")).each(function(b){d(this).attr({role:"option","aria-describedby":"slick-slide"+a.instanceUid+b})}),null!==a.$dots&&a.$dots.attr("role","tablist").find("li").each(function(b){d(this).attr({role:"presentation","aria-selected":"false","aria-controls":"navigation"+a.instanceUid+b,id:"slick-slide"+a.instanceUid+b})}).first().attr("aria-selected","true").end().find("button").attr("role","button").end().closest("div").attr("role","toolbar"),a.activateADA()},c.prototype.initArrowEvents=function(){var b=this;b.options.arrows===!0&&b.slideCount>b.options.slidesToShow&&(b.$prevArrow.off("click.slick").on("click.slick",{message:"previous"},b.changeSlide),b.$nextArrow.off("click.slick").on("click.slick",{message:"next"},b.changeSlide))},c.prototype.initDotEvents=function(){var a=this;a.options.dots===!0&&a.slideCount>a.options.slidesToShow&&d("li",a.$dots).on("click.slick",{message:"index"},a.changeSlide),a.options.dots===!0&&a.options.pauseOnDotsHover===!0&&d("li",a.$dots).on("mouseenter.slick",d.proxy(a.interrupt,a,!0)).on("mouseleave.slick",d.proxy(a.interrupt,a,!1))},c.prototype.initSlideEvents=function(){var a=this;a.options.pauseOnHover&&(a.$list.on("mouseenter.slick",d.proxy(a.interrupt,a,!0)),a.$list.on("mouseleave.slick",d.proxy(a.interrupt,a,!1)))},c.prototype.initializeEvents=function(){var a=this;a.initArrowEvents(),a.initDotEvents(),a.initSlideEvents(),a.$list.on("touchstart.slick mousedown.slick",{action:"start"},a.swipeHandler),a.$list.on("touchmove.slick mousemove.slick",{action:"move"},a.swipeHandler),a.$list.on("touchend.slick mouseup.slick",{action:"end"},a.swipeHandler),a.$list.on("touchcancel.slick mouseleave.slick",{action:"end"},a.swipeHandler),a.$list.on("click.slick",a.clickHandler),d(document).on(a.visibilityChange,d.proxy(a.visibility,a)),a.options.accessibility===!0&&a.$list.on("keydown.slick",a.keyHandler),a.options.focusOnSelect===!0&&d(a.$slideTrack).children().on("click.slick",a.selectHandler),d(window).on("orientationchange.slick.slick-"+a.instanceUid,d.proxy(a.orientationChange,a)),d(window).on("resize.slick.slick-"+a.instanceUid,d.proxy(a.resize,a)),d("[draggable!=true]",a.$slideTrack).on("dragstart",a.preventDefault),d(window).on("load.slick.slick-"+a.instanceUid,a.setPosition),d(document).on("ready.slick.slick-"+a.instanceUid,a.setPosition)},c.prototype.initUI=function(){var b=this;b.options.arrows===!0&&b.slideCount>b.options.slidesToShow&&(b.$prevArrow.show(),b.$nextArrow.show()),b.options.dots===!0&&b.slideCount>b.options.slidesToShow&&b.$dots.show()},c.prototype.keyHandler=function(f){var e=this;f.target.tagName.match("TEXTAREA|INPUT|SELECT")||(37===f.keyCode&&e.options.accessibility===!0?e.changeSlide({data:{message:e.options.rtl===!0?"next":"previous"}}):39===f.keyCode&&e.options.accessibility===!0&&e.changeSlide({data:{message:e.options.rtl===!0?"previous":"next"}}))},c.prototype.lazyLoad=function(){function h(b){d("img[data-lazy]",b).each(function(){var m=d(this),g=d(this).attr("data-lazy"),f=document.createElement("img");f.onload=function(){m.animate({opacity:0},100,function(){m.attr("src",g).animate({opacity:1},200,function(){m.removeAttr("data-lazy").removeClass("slick-loading")}),a.$slider.trigger("lazyLoaded",[a,m,g])})},f.onerror=function(){m.removeAttr("data-lazy").removeClass("slick-loading").addClass("slick-lazyload-error"),a.$slider.trigger("lazyLoadError",[a,m,g])},f.src=g})}var l,k,j,i,a=this;a.options.centerMode===!0?a.options.infinite===!0?(j=a.currentSlide+(a.options.slidesToShow/2+1),i=j+a.options.slidesToShow+2):(j=Math.max(0,a.currentSlide-(a.options.slidesToShow/2+1)),i=2+(a.options.slidesToShow/2+1)+a.currentSlide):(j=a.options.infinite?a.options.slidesToShow+a.currentSlide:a.currentSlide,i=Math.ceil(j+a.options.slidesToShow),a.options.fade===!0&&(j>0&&j--,i<=a.slideCount&&i++)),l=a.$slider.find(".slick-slide").slice(j,i),h(l),a.slideCount<=a.options.slidesToShow?(k=a.$slider.find(".slick-slide"),h(k)):a.currentSlide>=a.slideCount-a.options.slidesToShow?(k=a.$slider.find(".slick-cloned").slice(0,a.options.slidesToShow),h(k)):0===a.currentSlide&&(k=a.$slider.find(".slick-cloned").slice(-1*a.options.slidesToShow),h(k))},c.prototype.loadSlider=function(){var b=this;b.setPosition(),b.$slideTrack.css({opacity:1}),b.$slider.removeClass("slick-loading"),b.initUI(),"progressive"===b.options.lazyLoad&&b.progressiveLazyLoad()},c.prototype.next=c.prototype.slickNext=function(){var b=this;b.changeSlide({data:{message:"next"}})},c.prototype.orientationChange=function(){var b=this;b.checkResponsive(),b.setPosition()},c.prototype.pause=c.prototype.slickPause=function(){var b=this;b.autoPlayClear(),b.paused=!0},c.prototype.play=c.prototype.slickPlay=function(){var b=this;b.autoPlay(),b.options.autoplay=!0,b.paused=!1,b.focussed=!1,b.interrupted=!1},c.prototype.postSlide=function(f){var e=this;e.unslicked||(e.$slider.trigger("afterChange",[e,f]),e.animating=!1,e.setPosition(),e.swipeLeft=null,e.options.autoplay&&e.autoPlay(),e.options.accessibility===!0&&e.initADA())},c.prototype.prev=c.prototype.slickPrev=function(){var b=this;b.changeSlide({data:{message:"previous"}})},c.prototype.preventDefault=function(b){b.preventDefault()},c.prototype.progressiveLazyLoad=function(a){a=a||1;var j,i,h,l=this,k=d("img[data-lazy]",l.$slider);k.length?(j=k.first(),i=j.attr("data-lazy"),h=document.createElement("img"),h.onload=function(){j.attr("src",i).removeAttr("data-lazy").removeClass("slick-loading"),l.options.adaptiveHeight===!0&&l.setPosition(),l.$slider.trigger("lazyLoaded",[l,j,i]),l.progressiveLazyLoad()},h.onerror=function(){3>a?setTimeout(function(){l.progressiveLazyLoad(a+1)},500):(j.removeAttr("data-lazy").removeClass("slick-loading").addClass("slick-lazyload-error"),l.$slider.trigger("lazyLoadError",[l,j,i]),l.progressiveLazyLoad())},h.src=i):l.$slider.trigger("allImagesLoaded",[l])},c.prototype.refresh=function(a){var g,f,h=this;f=h.slideCount-h.options.slidesToShow,!h.options.infinite&&h.currentSlide>f&&(h.currentSlide=f),h.slideCount<=h.options.slidesToShow&&(h.currentSlide=0),g=h.currentSlide,h.destroy(!0),d.extend(h,h.initials,{currentSlide:g}),h.init(),a||h.changeSlide({data:{message:"index",index:g}},!1)},c.prototype.registerBreakpoints=function(){var j,i,h,a=this,g=a.options.responsive||null;if("array"===d.type(g)&&g.length){a.respondTo=a.options.respondTo||"window";for(j in g){if(h=a.breakpoints.length-1,i=g[j].breakpoint,g.hasOwnProperty(j)){for(;h>=0;){a.breakpoints[h]&&a.breakpoints[h]===i&&a.breakpoints.splice(h,1),h--}a.breakpoints.push(i),a.breakpointSettings[i]=g[j].settings}}a.breakpoints.sort(function(b,e){return a.options.mobileFirst?b-e:e-b})}},c.prototype.reinit=function(){var a=this;a.$slides=a.$slideTrack.children(a.options.slide).addClass("slick-slide"),a.slideCount=a.$slides.length,a.currentSlide>=a.slideCount&&0!==a.currentSlide&&(a.currentSlide=a.currentSlide-a.options.slidesToScroll),a.slideCount<=a.options.slidesToShow&&(a.currentSlide=0),a.registerBreakpoints(),a.setProps(),a.setupInfinite(),a.buildArrows(),a.updateArrows(),a.initArrowEvents(),a.buildDots(),a.updateDots(),a.initDotEvents(),a.cleanUpSlideEvents(),a.initSlideEvents(),a.checkResponsive(!1,!0),a.options.focusOnSelect===!0&&d(a.$slideTrack).children().on("click.slick",a.selectHandler),a.setSlideClasses("number"==typeof a.currentSlide?a.currentSlide:0),a.setPosition(),a.focusHandler(),a.paused=!a.options.autoplay,a.autoPlay(),a.$slider.trigger("reInit",[a])},c.prototype.resize=function(){var a=this;d(window).width()!==a.windowWidth&&(clearTimeout(a.windowDelay),a.windowDelay=window.setTimeout(function(){a.windowWidth=d(window).width(),a.checkResponsive(),a.unslicked||a.setPosition()},50))},c.prototype.removeSlide=c.prototype.slickRemove=function(f,e,h){var g=this;return"boolean"==typeof f?(e=f,f=e===!0?0:g.slideCount-1):f=e===!0?--f:f,g.slideCount<1||0>f||f>g.slideCount-1?!1:(g.unload(),h===!0?g.$slideTrack.children().remove():g.$slideTrack.children(this.options.slide).eq(f).remove(),g.$slides=g.$slideTrack.children(this.options.slide),g.$slideTrack.children(this.options.slide).detach(),g.$slideTrack.append(g.$slides),g.$slidesCache=g.$slides,void g.reinit())},c.prototype.setCSS=function(g){var i,h,f=this,j={};f.options.rtl===!0&&(g=-g),i="left"==f.positionProp?Math.ceil(g)+"px":"0px",h="top"==f.positionProp?Math.ceil(g)+"px":"0px",j[f.positionProp]=g,f.transformsEnabled===!1?f.$slideTrack.css(j):(j={},f.cssTransitions===!1?(j[f.animType]="translate("+i+", "+h+")",f.$slideTrack.css(j)):(j[f.animType]="translate3d("+i+", "+h+", 0px)",f.$slideTrack.css(j)))},c.prototype.setDimensions=function(){var f=this;f.options.vertical===!1?f.options.centerMode===!0&&f.$list.css({padding:"0px "+f.options.centerPadding}):(f.$list.height(f.$slides.first().outerHeight(!0)*f.options.slidesToShow),f.options.centerMode===!0&&f.$list.css({padding:f.options.centerPadding+" 0px"})),f.listWidth=f.$list.width(),f.listHeight=f.$list.height(),f.options.vertical===!1&&f.options.variableWidth===!1?(f.slideWidth=Math.ceil(f.listWidth/f.options.slidesToShow),f.$slideTrack.width(Math.ceil(f.slideWidth*f.$slideTrack.children(".slick-slide").length))):f.options.variableWidth===!0?f.$slideTrack.width(5000*f.slideCount):(f.slideWidth=Math.ceil(f.listWidth),f.$slideTrack.height(Math.ceil(f.$slides.first().outerHeight(!0)*f.$slideTrack.children(".slick-slide").length)));var e=f.$slides.first().outerWidth(!0)-f.$slides.first().width();f.options.variableWidth===!1&&f.$slideTrack.children(".slick-slide").width(f.slideWidth-e)},c.prototype.setFade=function(){var e,a=this;a.$slides.each(function(f,b){e=a.slideWidth*f*-1,a.options.rtl===!0?d(b).css({position:"relative",right:e,top:0,zIndex:a.options.zIndex-2,opacity:0}):d(b).css({position:"relative",left:e,top:0,zIndex:a.options.zIndex-2,opacity:0})}),a.$slides.eq(a.currentSlide).css({zIndex:a.options.zIndex-1,opacity:1})},c.prototype.setHeight=function(){var f=this;if(1===f.options.slidesToShow&&f.options.adaptiveHeight===!0&&f.options.vertical===!1){var e=f.$slides.eq(f.currentSlide).outerHeight(!0);f.$list.css("height",e)}},c.prototype.setOption=c.prototype.slickSetOption=function(){var n,m,l,k,i,a=this,j=!1;if("object"===d.type(arguments[0])?(l=arguments[0],j=arguments[1],i="multiple"):"string"===d.type(arguments[0])&&(l=arguments[0],k=arguments[1],j=arguments[2],"responsive"===arguments[0]&&"array"===d.type(arguments[1])?i="responsive":"undefined"!=typeof arguments[1]&&(i="single")),"single"===i){a.options[l]=k}else{if("multiple"===i){d.each(l,function(b,e){a.options[b]=e})}else{if("responsive"===i){for(m in k){if("array"!==d.type(a.options.responsive)){a.options.responsive=[k[m]]}else{for(n=a.options.responsive.length-1;n>=0;){a.options.responsive[n].breakpoint===k[m].breakpoint&&a.options.responsive.splice(n,1),n--}a.options.responsive.push(k[m])}}}}}j&&(a.unload(),a.reinit())},c.prototype.setPosition=function(){var b=this;b.setDimensions(),b.setHeight(),b.options.fade===!1?b.setCSS(b.getLeft(b.currentSlide)):b.setFade(),b.$slider.trigger("setPosition",[b])},c.prototype.setProps=function(){var f=this,e=document.body.style;f.positionProp=f.options.vertical===!0?"top":"left","top"===f.positionProp?f.$slider.addClass("slick-vertical"):f.$slider.removeClass("slick-vertical"),(void 0!==e.WebkitTransition||void 0!==e.MozTransition||void 0!==e.msTransition)&&f.options.useCSS===!0&&(f.cssTransitions=!0),f.options.fade&&("number"==typeof f.options.zIndex?f.options.zIndex<3&&(f.options.zIndex=3):f.options.zIndex=f.defaults.zIndex),void 0!==e.OTransform&&(f.animType="OTransform",f.transformType="-o-transform",f.transitionType="OTransition",void 0===e.perspectiveProperty&&void 0===e.webkitPerspective&&(f.animType=!1)),void 0!==e.MozTransform&&(f.animType="MozTransform",f.transformType="-moz-transform",f.transitionType="MozTransition",void 0===e.perspectiveProperty&&void 0===e.MozPerspective&&(f.animType=!1)),void 0!==e.webkitTransform&&(f.animType="webkitTransform",f.transformType="-webkit-transform",f.transitionType="webkitTransition",void 0===e.perspectiveProperty&&void 0===e.webkitPerspective&&(f.animType=!1)),void 0!==e.msTransform&&(f.animType="msTransform",f.transformType="-ms-transform",f.transitionType="msTransition",void 0===e.msTransform&&(f.animType=!1)),void 0!==e.transform&&f.animType!==!1&&(f.animType="transform",f.transformType="transform",f.transitionType="transition"),f.transformsEnabled=f.options.useTransform&&null!==f.animType&&f.animType!==!1},c.prototype.setSlideClasses=function(h){var l,k,j,i,g=this;k=g.$slider.find(".slick-slide").removeClass("slick-active slick-center slick-current").attr("aria-hidden","true"),g.$slides.eq(h).addClass("slick-current"),g.options.centerMode===!0?(l=Math.floor(g.options.slidesToShow/2),g.options.infinite===!0&&(h>=l&&h<=g.slideCount-1-l?g.$slides.slice(h-l,h+l+1).addClass("slick-active").attr("aria-hidden","false"):(j=g.options.slidesToShow+h,k.slice(j-l+1,j+l+2).addClass("slick-active").attr("aria-hidden","false")),0===h?k.eq(k.length-1-g.options.slidesToShow).addClass("slick-center"):h===g.slideCount-1&&k.eq(g.options.slidesToShow).addClass("slick-center")),g.$slides.eq(h).addClass("slick-center")):h>=0&&h<=g.slideCount-g.options.slidesToShow?g.$slides.slice(h,h+g.options.slidesToShow).addClass("slick-active").attr("aria-hidden","false"):k.length<=g.options.slidesToShow?k.addClass("slick-active").attr("aria-hidden","false"):(i=g.slideCount%g.options.slidesToShow,j=g.options.infinite===!0?g.options.slidesToShow+h:h,g.options.slidesToShow==g.options.slidesToScroll&&g.slideCount-h<g.options.slidesToShow?k.slice(j-(g.options.slidesToShow-i),j+i).addClass("slick-active").attr("aria-hidden","false"):k.slice(j,j+g.options.slidesToShow).addClass("slick-active").attr("aria-hidden","false")),"ondemand"===g.options.lazyLoad&&g.lazyLoad()},c.prototype.setupInfinite=function(){var h,g,f,a=this;if(a.options.fade===!0&&(a.options.centerMode=!1),a.options.infinite===!0&&a.options.fade===!1&&(g=null,a.slideCount>a.options.slidesToShow)){for(f=a.options.centerMode===!0?a.options.slidesToShow+1:a.options.slidesToShow,h=a.slideCount;h>a.slideCount-f;h-=1){g=h-1,d(a.$slides[g]).clone(!0).attr("id","").attr("data-slick-index",g-a.slideCount).prependTo(a.$slideTrack).addClass("slick-cloned")}for(h=0;f>h;h+=1){g=h,d(a.$slides[g]).clone(!0).attr("id","").attr("data-slick-index",g+a.slideCount).appendTo(a.$slideTrack).addClass("slick-cloned")}a.$slideTrack.find(".slick-cloned").find("[id]").each(function(){d(this).attr("id","")})}},c.prototype.interrupt=function(f){var e=this;f||e.autoPlay(),e.interrupted=f},c.prototype.selectHandler=function(a){var h=this,g=d(a.target).is(".slick-slide")?d(a.target):d(a.target).parents(".slick-slide"),f=parseInt(g.attr("data-slick-index"));return f||(f=0),h.slideCount<=h.options.slidesToShow?(h.setSlideClasses(f),void h.asNavFor(f)):void h.slideHandler(f)},c.prototype.slideHandler=function(t,s,r){var q,p,o,n,k,m=null,l=this;return s=s||!1,l.animating===!0&&l.options.waitForAnimate===!0||l.options.fade===!0&&l.currentSlide===t||l.slideCount<=l.options.slidesToShow?void 0:(s===!1&&l.asNavFor(t),q=t,m=l.getLeft(q),n=l.getLeft(l.currentSlide),l.currentLeft=null===l.swipeLeft?n:l.swipeLeft,l.options.infinite===!1&&l.options.centerMode===!1&&(0>t||t>l.getDotCount()*l.options.slidesToScroll)?void (l.options.fade===!1&&(q=l.currentSlide,r!==!0?l.animateSlide(n,function(){l.postSlide(q)}):l.postSlide(q))):l.options.infinite===!1&&l.options.centerMode===!0&&(0>t||t>l.slideCount-l.options.slidesToScroll)?void (l.options.fade===!1&&(q=l.currentSlide,r!==!0?l.animateSlide(n,function(){l.postSlide(q)}):l.postSlide(q))):(l.options.autoplay&&clearInterval(l.autoPlayTimer),p=0>q?l.slideCount%l.options.slidesToScroll!==0?l.slideCount-l.slideCount%l.options.slidesToScroll:l.slideCount+q:q>=l.slideCount?l.slideCount%l.options.slidesToScroll!==0?0:q-l.slideCount:q,l.animating=!0,l.$slider.trigger("beforeChange",[l,l.currentSlide,p]),o=l.currentSlide,l.currentSlide=p,l.setSlideClasses(l.currentSlide),l.options.asNavFor&&(k=l.getNavTarget(),k=k.slick("getSlick"),k.slideCount<=k.options.slidesToShow&&k.setSlideClasses(l.currentSlide)),l.updateDots(),l.updateArrows(),l.options.fade===!0?(r!==!0?(l.fadeSlideOut(o),l.fadeSlide(p,function(){l.postSlide(p)})):l.postSlide(p),void l.animateHeight()):void (r!==!0?l.animateSlide(m,function(){l.postSlide(p)}):l.postSlide(p))))},c.prototype.startLoad=function(){var b=this;b.options.arrows===!0&&b.slideCount>b.options.slidesToShow&&(b.$prevArrow.hide(),b.$nextArrow.hide()),b.options.dots===!0&&b.slideCount>b.options.slidesToShow&&b.$dots.hide(),b.$slider.addClass("slick-loading")},c.prototype.swipeDirection=function(){var g,f,j,i,h=this;return g=h.touchObject.startX-h.touchObject.curX,f=h.touchObject.startY-h.touchObject.curY,j=Math.atan2(f,g),i=Math.round(180*j/Math.PI),0>i&&(i=360-Math.abs(i)),45>=i&&i>=0?h.options.rtl===!1?"left":"right":360>=i&&i>=315?h.options.rtl===!1?"left":"right":i>=135&&225>=i?h.options.rtl===!1?"right":"left":h.options.verticalSwiping===!0?i>=35&&135>=i?"down":"up":"vertical"},c.prototype.swipeEnd=function(f){var h,g,e=this;if(e.dragging=!1,e.interrupted=!1,e.shouldClick=e.touchObject.swipeLength>10?!1:!0,void 0===e.touchObject.curX){return !1}if(e.touchObject.edgeHit===!0&&e.$slider.trigger("edge",[e,e.swipeDirection()]),e.touchObject.swipeLength>=e.touchObject.minSwipe){switch(g=e.swipeDirection()){case"left":case"down":h=e.options.swipeToSlide?e.checkNavigable(e.currentSlide+e.getSlideCount()):e.currentSlide+e.getSlideCount(),e.currentDirection=0;break;case"right":case"up":h=e.options.swipeToSlide?e.checkNavigable(e.currentSlide-e.getSlideCount()):e.currentSlide-e.getSlideCount(),e.currentDirection=1}"vertical"!=g&&(e.slideHandler(h),e.touchObject={},e.$slider.trigger("swipe",[e,g]))}else{e.touchObject.startX!==e.touchObject.curX&&(e.slideHandler(e.currentSlide),e.touchObject={})}},c.prototype.swipeHandler=function(f){var e=this;if(!(e.options.swipe===!1||"ontouchend" in document&&e.options.swipe===!1||e.options.draggable===!1&&-1!==f.type.indexOf("mouse"))){switch(e.touchObject.fingerCount=f.originalEvent&&void 0!==f.originalEvent.touches?f.originalEvent.touches.length:1,e.touchObject.minSwipe=e.listWidth/e.options.touchThreshold,e.options.verticalSwiping===!0&&(e.touchObject.minSwipe=e.listHeight/e.options.touchThreshold),f.data.action){case"start":e.swipeStart(f);break;case"move":e.swipeMove(f);break;case"end":e.swipeEnd(f)}}},c.prototype.swipeMove=function(j){var o,n,m,l,k,i=this;return k=void 0!==j.originalEvent?j.originalEvent.touches:null,!i.dragging||k&&1!==k.length?!1:(o=i.getLeft(i.currentSlide),i.touchObject.curX=void 0!==k?k[0].pageX:j.clientX,i.touchObject.curY=void 0!==k?k[0].pageY:j.clientY,i.touchObject.swipeLength=Math.round(Math.sqrt(Math.pow(i.touchObject.curX-i.touchObject.startX,2))),i.options.verticalSwiping===!0&&(i.touchObject.swipeLength=Math.round(Math.sqrt(Math.pow(i.touchObject.curY-i.touchObject.startY,2)))),n=i.swipeDirection(),"vertical"!==n?(void 0!==j.originalEvent&&i.touchObject.swipeLength>4&&j.preventDefault(),l=(i.options.rtl===!1?1:-1)*(i.touchObject.curX>i.touchObject.startX?1:-1),i.options.verticalSwiping===!0&&(l=i.touchObject.curY>i.touchObject.startY?1:-1),m=i.touchObject.swipeLength,i.touchObject.edgeHit=!1,i.options.infinite===!1&&(0===i.currentSlide&&"right"===n||i.currentSlide>=i.getDotCount()&&"left"===n)&&(m=i.touchObject.swipeLength*i.options.edgeFriction,i.touchObject.edgeHit=!0),i.options.vertical===!1?i.swipeLeft=o+m*l:i.swipeLeft=o+m*(i.$list.height()/i.listWidth)*l,i.options.verticalSwiping===!0&&(i.swipeLeft=o+m*l),i.options.fade===!0||i.options.touchMove===!1?!1:i.animating===!0?(i.swipeLeft=null,!1):void i.setCSS(i.swipeLeft)):void 0)},c.prototype.swipeStart=function(f){var g,e=this;return e.interrupted=!0,1!==e.touchObject.fingerCount||e.slideCount<=e.options.slidesToShow?(e.touchObject={},!1):(void 0!==f.originalEvent&&void 0!==f.originalEvent.touches&&(g=f.originalEvent.touches[0]),e.touchObject.startX=e.touchObject.curX=void 0!==g?g.pageX:f.clientX,e.touchObject.startY=e.touchObject.curY=void 0!==g?g.pageY:f.clientY,void (e.dragging=!0))},c.prototype.unfilterSlides=c.prototype.slickUnfilter=function(){var b=this;null!==b.$slidesCache&&(b.unload(),b.$slideTrack.children(this.options.slide).detach(),b.$slidesCache.appendTo(b.$slideTrack),b.reinit())},c.prototype.unload=function(){var a=this;d(".slick-cloned",a.$slider).remove(),a.$dots&&a.$dots.remove(),a.$prevArrow&&a.htmlExpr.test(a.options.prevArrow)&&a.$prevArrow.remove(),a.$nextArrow&&a.htmlExpr.test(a.options.nextArrow)&&a.$nextArrow.remove(),a.$slides.removeClass("slick-slide slick-active slick-visible slick-current").attr("aria-hidden","true").css("width","")},c.prototype.unslick=function(f){var e=this;e.$slider.trigger("unslick",[e,f]),e.destroy()},c.prototype.updateArrows=function(){var e,f=this;e=Math.floor(f.options.slidesToShow/2),f.options.arrows===!0&&f.slideCount>f.options.slidesToShow&&!f.options.infinite&&(f.$prevArrow.removeClass("slick-disabled").attr("aria-disabled","false"),f.$nextArrow.removeClass("slick-disabled").attr("aria-disabled","false"),0===f.currentSlide?(f.$prevArrow.addClass("slick-disabled").attr("aria-disabled","true"),f.$nextArrow.removeClass("slick-disabled").attr("aria-disabled","false")):f.currentSlide>=f.slideCount-f.options.slidesToShow&&f.options.centerMode===!1?(f.$nextArrow.addClass("slick-disabled").attr("aria-disabled","true"),f.$prevArrow.removeClass("slick-disabled").attr("aria-disabled","false")):f.currentSlide>=f.slideCount-1&&f.options.centerMode===!0&&(f.$nextArrow.addClass("slick-disabled").attr("aria-disabled","true"),f.$prevArrow.removeClass("slick-disabled").attr("aria-disabled","false")))},c.prototype.updateDots=function(){var b=this;null!==b.$dots&&(b.$dots.find("li").removeClass("slick-active").attr("aria-hidden","true"),b.$dots.find("li").eq(Math.floor(b.currentSlide/b.options.slidesToScroll)).addClass("slick-active").attr("aria-hidden","false"))},c.prototype.visibility=function(){var b=this;b.options.autoplay&&(document[b.hidden]?b.interrupted=!0:b.interrupted=!1)},d.fn.slick=function(){var i,h,b=this,l=arguments[0],k=Array.prototype.slice.call(arguments,1),j=b.length;for(i=0;j>i;i++){if("object"==typeof l||"undefined"==typeof l?b[i].slick=new c(b[i],l):h=b[i].slick[l].apply(b[i].slick,k),"undefined"!=typeof h){return h}}return b}}); /*! lazysizes - v4.1.7 https://github.com/aFarkas/lazysizes */ !function(e,d){var f=d(e,e.document);e.lazySizes=f,"object"==typeof module&&module.exports&&(module.exports=f)}(window,function(al,ak){if(ak.getElementsByClassName){var aj,ai,ah=ak.documentElement,ag=al.Date,af=al.HTMLPictureElement,ae="addEventListener",ad="getAttribute",ac=al[ae],ab=al.setTimeout,aa=al.requestAnimationFrame||ab,Z=al.requestIdleCallback,Y=/^picture$/i,X=["load","error","lazyincluded","_lazyloaded"],W={},U=Array.prototype.forEach,S=function(d,c){return W[c]||(W[c]=new RegExp("(\\s|^)"+c+"(\\s|$)")),W[c].test(d[ad]("class")||"")&&W[c]},Q=function(d,c){S(d,c)||d.setAttribute("class",(d[ad]("class")||"").trim()+" "+c)},O=function(e,d){var f;(f=S(e,d))&&e.setAttribute("class",(e[ad]("class")||"").replace(f," "))},M=function(f,e,h){var g=h?ae:"removeEventListener";h&&M(f,e),X.forEach(function(a){f[g](a,e)})},K=function(b,l,k,j,i){var c=ak.createEvent("Event");return k||(k={}),k.instance=aj,c.initEvent(l,!j,!i),c.detail=k,b.dispatchEvent(c),c},J=function(a,f){var d;!af&&(d=al.picturefill||ai.pf)?(f&&f.src&&!a[ad]("srcset")&&a.setAttribute("srcset",f.src),d({reevaluate:!0,elements:[a]})):f&&f.src&&(a.src=f.src)},I=function(d,c){return(getComputedStyle(d,null)||{})[c]},H=function(e,d,f){for(f=f||e.offsetWidth;f<ai.minSize&&d&&!e._lazysizesWidth;){f=d.offsetWidth,d=d.parentNode}return f},G=function(){var b,n,m=[],l=[],k=m,j=function(){var a=k;for(k=m.length?l:m,b=!0,n=!1;a.length;){a.shift()()}b=!1},i=function(c,a){b&&!a?c.apply(this,arguments):(k.push(c),n||(n=!0,(ak.hidden?ab:aa)(j)))};return i._lsFlush=j,i}(),V=function(d,c){return c?function(){G(d)}:function(){var a=this,e=arguments;G(function(){d.apply(a,e)})}},T=function(f){var d,n=0,m=ai.throttleDelay,l=ai.ricTimeout,k=function(){d=!1,n=ag.now(),f()},j=Z&&l>49?function(){Z(k,{timeout:l}),l!==ai.ricTimeout&&(l=ai.ricTimeout)}:V(function(){ab(k)},!0);return function(b){var c;(b=!0===b)&&(l=33),d||(d=!0,c=m-(ag.now()-n),c<0&&(c=0),b||c<9?j():ab(j,c))}},R=function(h){var f,l,k=99,j=function(){f=null,h()},i=function(){var b=ag.now()-l;b<k?ab(i,k-b):(Z||j)(j)};return function(){l=ag.now(),f||(f=ab(i,k))}};!function(){var a,d={lazyClass:"lazyload",loadedClass:"lazyloaded",loadingClass:"lazyloading",preloadClass:"lazypreload",errorClass:"lazyerror",autosizesClass:"lazyautosizes",srcAttr:"data-src",srcsetAttr:"data-srcset",sizesAttr:"data-sizes",minSize:40,customMedia:{},init:!0,expFactor:1.5,hFac:0.8,loadMode:2,loadHidden:!0,ricTimeout:0,throttleDelay:125};ai=al.lazySizesConfig||al.lazysizesConfig||{};for(a in d){a in ai||(ai[a]=d[a])}al.lazySizesConfig=ai,ab(function(){ai.init&&L()})}();var P=function(){var ar,aq,ap,ao,an,z,am,E,C,B,A,x,w=/^img$/i,v=/^iframe$/i,u="onscroll" in al&&!/(gle|ing)bot/.test(navigator.userAgent),t=0,s=0,r=0,n=-1,k=function(g){r--,(!g||r<0||!g.target)&&(r=0)},j=function(g){return null==x&&(x="hidden"==I(ak.body,"visibility")),x||"hidden"!=I(g.parentNode,"visibility")&&"hidden"!=I(g,"visibility")},h=function(l,y){var p,o=l,m=j(l);for(E-=y,A+=y,C-=y,B+=y;m&&(o=o.offsetParent)&&o!=ak.body&&o!=ah;){(m=(I(o,"opacity")||1)>0)&&"visible"!=I(o,"overflow")&&(p=o.getBoundingClientRect(),m=B>p.left&&C<p.right&&A>p.top-1&&E<p.bottom+1)}return m},f=function(){var ay,ax,aw,av,F,D,y,o,l,g,aB,aA,az=aj.elements;if((ao=ai.loadMode)&&r<8&&(ay=az.length)){for(ax=0,n++,g=!ai.expand||ai.expand<1?ah.clientHeight>500&&ah.clientWidth>500?500:370:ai.expand,aj._defEx=g,aB=g*ai.expFactor,aA=ai.hFac,x=null,s<aB&&r<1&&n>2&&ao>2&&!ak.hidden?(s=aB,n=0):s=ao>1&&n>1&&r<6?g:t;ax<ay;ax++){if(az[ax]&&!az[ax]._lazyRace){if(u){if((o=az[ax][ad]("data-expand"))&&(D=1*o)||(D=s),l!==D&&(z=innerWidth+D*aA,am=innerHeight+D,y=-1*D,l=D),aw=az[ax].getBoundingClientRect(),(A=aw.bottom)>=y&&(E=aw.top)<=am&&(B=aw.right)>=y*aA&&(C=aw.left)<=z&&(A||B||C||E)&&(ai.loadHidden||j(az[ax]))&&(aq&&r<3&&!o&&(ao<3||n<4)||h(az[ax],D))){if(at(az[ax]),F=!0,r>9){break}}else{!F&&aq&&!av&&r<4&&n<4&&ao>2&&(ar[0]||ai.preloadAfterLoad)&&(ar[0]||!o&&(A||B||C||E||"auto"!=az[ax][ad](ai.sizesAttr)))&&(av=ar[0]||az[ax])}}else{at(az[ax])}}}av&&!F&&at(av)}},e=T(f),d=function(l){var g=l.target;if(g._lazyCache){return void delete g._lazyCache}k(l),Q(g,ai.loadedClass),O(g,ai.loadingClass),M(g,b),K(g,"lazyloaded")},c=V(d),b=function(g){c({target:g.target})},a=function(l,g){try{l.contentWindow.location.replace(g)}catch(m){l.src=g}},i=function(l){var g,m=l[ad](ai.srcsetAttr);(g=ai.customMedia[l[ad]("data-media")||l[ad]("media")])&&l.setAttribute("media",g),m&&l.setAttribute("srcset",m)},au=V(function(aB,aA,az,ay,ax){var aw,av,F,D,y,m;(y=K(aB,"lazybeforeunveil",aA)).defaultPrevented||(ay&&(az?Q(aB,ai.autosizesClass):aB.setAttribute("sizes",ay)),av=aB[ad](ai.srcsetAttr),aw=aB[ad](ai.srcAttr),ax&&(F=aB.parentNode,D=F&&Y.test(F.nodeName||"")),m=aA.firesLoad||"src" in aB&&(av||aw||D),y={target:aB},Q(aB,ai.loadingClass),m&&(clearTimeout(ap),ap=ab(k,2500),M(aB,b,!0)),D&&U.call(F.getElementsByTagName("source"),i),av?aB.setAttribute("srcset",av):aw&&!D&&(v.test(aB.nodeName)?a(aB,aw):aB.src=aw),ax&&(av||D)&&J(aB,{src:aw})),aB._lazyRace&&delete aB._lazyRace,O(aB,ai.lazyClass),G(function(){(!m||aB.complete&&aB.naturalWidth>1)&&(d(y),aB._lazyCache=!0,ab(function(){"_lazyCache" in aB&&delete aB._lazyCache},9))},!0)}),at=function(l){var g,p=w.test(l.nodeName),o=p&&(l[ad](ai.sizesAttr)||l[ad]("sizes")),m="auto"==o;(!m&&aq||!p||!l[ad]("src")&&!l.srcset||l.complete||S(l,ai.errorClass)||!S(l,ai.lazyClass))&&(g=K(l,"lazyunveilread").detail,m&&N.updateElem(l,!0,l.offsetWidth),l._lazyRace=!0,r++,au(l,g,m,o,p))},q=function(){if(!aq){if(ag.now()-an<999){return void ab(q,999)}var g=R(function(){ai.loadMode=3,e()});aq=!0,ai.loadMode=3,e(),ac("scroll",function(){3==ai.loadMode&&(ai.loadMode=2),g()},!0)}};return{_:function(){an=ag.now(),aj.elements=ak.getElementsByClassName(ai.lazyClass),ar=ak.getElementsByClassName(ai.lazyClass+" "+ai.preloadClass),ac("scroll",e,!0),ac("resize",e,!0),al.MutationObserver?new MutationObserver(e).observe(ah,{childList:!0,subtree:!0,attributes:!0}):(ah[ae]("DOMNodeInserted",e,!0),ah[ae]("DOMAttrModified",e,!0),setInterval(e,999)),ac("hashchange",e,!0),["focus","mouseover","click","load","transitionend","animationend","webkitAnimationEnd"].forEach(function(g){ak[ae](g,e,!0)}),/d$|^c/.test(ak.readyState)?q():(ac("load",q),ak[ae]("DOMContentLoaded",e),ab(q,20000)),aj.elements.length?(f(),G._lsFlush()):e()},checkElems:e,unveil:at}}(),N=function(){var b,j=V(function(l,k,q,p){var o,n,m;if(l._lazysizesWidth=p,p+="px",l.setAttribute("sizes",p),Y.test(k.nodeName||"")){for(o=k.getElementsByTagName("source"),n=0,m=o.length;n<m;n++){o[n].setAttribute("sizes",p)}}q.detail.dataAttr||J(l,q.detail)}),i=function(g,c,m){var l,k=g.parentNode;k&&(m=H(g,k,m),l=K(g,"lazybeforesizes",{width:m,dataAttr:!!c}),l.defaultPrevented||(m=l.detail.width)&&m!==g._lazysizesWidth&&j(g,k,l,m))},h=function(){var a,e=b.length;if(e){for(a=0;a<e;a++){i(b[a])}}},d=R(h);return{_:function(){b=ak.getElementsByClassName(ai.autosizesClass),ac("resize",d)},checkElems:d,updateElem:i}}(),L=function(){L.i||(L.i=!0,N._(),P._())};return aj={cfg:ai,autoSizer:N,loader:P,init:L,uP:J,aC:Q,rC:O,hC:S,fire:K,gW:H,rAF:G}}}); function closePopup(id){ var elements = document.getElementById(id); console.log(elements); elements.classList.remove("active"); } function openPopup(id){ var elements = document.getElementById(id); console.log(elements); addClass(elements,"active"); } function addClass(element, classname){ var currentClassList = (element.className || '').split(/\s+/); currentClassList .push(currentClassList.indexOf(classname) > -1 ? '' : classname); element.className = currentClassList.join(' ').trim(); } /* load new background-image */ /* support for background images: */ document.addEventListener('lazybeforeunveil', function (e) { var bg = e.target.getAttribute('data-bg'); if (bg) e.target.style.backgroundImage = 'url(' + bg + ')'; }); function loadImg(element){ var bg = ''; switch (screenW) { case 'mobile': bg = element.getAttribute('data-bg-mobile'); if(bg) break; case 'tablet': bg = element.getAttribute('data-bg-tablet'); if(bg) break; case 'laptop': bg = element.getAttribute('data-bg-laptop'); if(bg) break; default: bg = element.getAttribute('data-bg'); } if(bg) element.style.backgroundImage = 'url(' + bg + ')'; } /* calc screen wide */ var screenW; var first = true; jQuery(window).on('resize', function(){ calcScreenW(); }); function calcScreenW(){ var screenC = false; curentW= jQuery(window).width(); if ( curentW > 1450 ) { if (screenW != 'desktop'){ screenW = 'desktop'; screenC = true; } } else if (curentW > 973){ if (screenW != 'laptop'){ screenW = 'laptop'; screenC = true; } } else if (curentW >767){ if (screenW != 'tablet'){ screenW = 'tablet'; screenC = true; } } else { if (screenW != 'mobile'){ screenW = 'mobile'; screenC = true; } } if (screenC) { jQuery('.bg-change-done').removeClass('bg-change-done'); screenC = false; animate_elems(); } } /* lazyLoad on scroll after screen width change */ var $elems = jQuery('.responsive-bg'); var winheight = jQuery(window).height(); jQuery(window).scroll(function(){ animate_elems(); }); function animate_elems() { wintop = jQuery(window).scrollTop(); // calculate distance from top of window // loop through each item to check when it animates $elems.each(function(){ $elm = jQuery(this); if($elm.hasClass('lazyload')|| $elm.hasClass('bg-change-done')) { return true; } // if already animated skip to the next item topcoords = $elm.offset().top; // element's distance from top of page in pixels if(wintop > (topcoords - (winheight))) { $elm.addClass('bg-change-done'); loadImg($elm[0]); } }); } </script> <div class="popup" id="subscribe-us-popup" > <div class="bg-for-close-popup" onclick="closePopup('subscribe-us-popup')"></div> <div class="inner"> <div class="box"> <div class="content"> <div class="content-row"> <div class="flex-6 col-image"> <div class="image"> <img src="https://research.checkpoint.com/wp-content/uploads/2022/10/popup-side-image.jpg" alt="" /> </div> </div> <div class="flex-6 col-form text-black"> <div class="popup-form-outer"> <h2 style="text-align: center;">SUBSCRIBE TO CYBER INTELLIGENCE REPORTS</h2> <div class="wpcf7 no-js" id="wpcf7-f26727-o1" lang="en-US" dir="ltr" data-wpcf7-id="26727"> <div class="screen-reader-response"><p role="status" aria-live="polite" aria-atomic="true"></p> <ul></ul></div> <form action="/2021/stopping-serial-killer-catching-the-next-strike/#wpcf7-f26727-o1" method="post" class="wpcf7-form init demo" aria-label="Contact form" novalidate="novalidate" data-status="init"> <div style="display: none;"> <input type="hidden" name="_wpcf7" value="26727" /> <input type="hidden" name="_wpcf7_version" value="6.0.4" /> <input type="hidden" name="_wpcf7_locale" value="en_US" /> <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f26727-o1" /> <input type="hidden" name="_wpcf7_container_post" value="0" /> <input type="hidden" name="_wpcf7_posted_data_hash" value="" /> </div> <div class="contact-form-outer"> <div class="flex-row"> <div class="flex-12"> <div class="col-margin"> <p><label>First Name<span class="wpcf7-form-control-wrap" data-name="your-first-name"><input size="40" maxlength="400" class="wpcf7-form-control wpcf7-text wpcf7-validates-as-required form-control" aria-required="true" aria-invalid="false" value="" type="text" name="your-first-name" /></span></label> </p> </div> </div> <div class="flex-12"> <div class="col-margin"> <p><label>Last Name<span class="wpcf7-form-control-wrap" data-name="your-last-name"><input size="40" maxlength="400" class="wpcf7-form-control wpcf7-text wpcf7-validates-as-required form-control" aria-required="true" aria-invalid="false" value="" type="text" name="your-last-name" /></span></label> </p> </div> </div> <div class="flex-12"> <div class="col-margin"> <p><label>Country<span class="wpcf7-form-control-wrap" data-name="country"><select class="wpcf7-form-control wpcf7-select classform-control" aria-invalid="false" name="country"><option value="">—Please choose an option—</option><option value="China">China</option><option value="India">India</option><option value="United States">United States</option><option value="Indonesia">Indonesia</option><option value="Brazil">Brazil</option><option value="Pakistan">Pakistan</option><option value="Nigeria">Nigeria</option><option value="Bangladesh">Bangladesh</option><option value="Russia">Russia</option><option value="Japan">Japan</option><option value="Mexico">Mexico</option><option value="Philippines">Philippines</option><option value="Vietnam">Vietnam</option><option value="Ethiopia">Ethiopia</option><option value="Egypt">Egypt</option><option value="Germany">Germany</option><option value="Iran">Iran</option><option value="Turkey">Turkey</option><option value="Democratic Republic of the Congo">Democratic Republic of the Congo</option><option value="Thailand">Thailand</option><option value="France">France</option><option value="United Kingdom">United Kingdom</option><option value="Italy">Italy</option><option value="Burma">Burma</option><option value="South Africa">South Africa</option><option value="South Korea">South Korea</option><option value="Colombia">Colombia</option><option value="Spain">Spain</option><option value="Ukraine">Ukraine</option><option value="Tanzania">Tanzania</option><option value="Kenya">Kenya</option><option value="Argentina">Argentina</option><option value="Algeria">Algeria</option><option value="Poland">Poland</option><option value="Sudan">Sudan</option><option value="Uganda">Uganda</option><option value="Canada">Canada</option><option value="Iraq">Iraq</option><option value="Morocco">Morocco</option><option value="Peru">Peru</option><option value="Uzbekistan">Uzbekistan</option><option value="Saudi Arabia">Saudi Arabia</option><option value="Malaysia">Malaysia</option><option value="Venezuela">Venezuela</option><option value="Nepal">Nepal</option><option value="Afghanistan">Afghanistan</option><option value="Yemen">Yemen</option><option value="North Korea">North Korea</option><option value="Ghana">Ghana</option><option value="Mozambique">Mozambique</option><option value="Taiwan">Taiwan</option><option value="Australia">Australia</option><option value="Ivory Coast">Ivory Coast</option><option value="Syria">Syria</option><option value="Madagascar">Madagascar</option><option value="Angola">Angola</option><option value="Cameroon">Cameroon</option><option value="Sri Lanka">Sri Lanka</option><option value="Romania">Romania</option><option value="Burkina Faso">Burkina Faso</option><option value="Niger">Niger</option><option value="Kazakhstan">Kazakhstan</option><option value="Netherlands">Netherlands</option><option value="Chile">Chile</option><option value="Malawi">Malawi</option><option value="Ecuador">Ecuador</option><option value="Guatemala">Guatemala</option><option value="Mali">Mali</option><option value="Cambodia">Cambodia</option><option value="Senegal">Senegal</option><option value="Zambia">Zambia</option><option value="Zimbabwe">Zimbabwe</option><option value="Chad">Chad</option><option value="South Sudan">South Sudan</option><option value="Belgium">Belgium</option><option value="Cuba">Cuba</option><option value="Tunisia">Tunisia</option><option value="Guinea">Guinea</option><option value="Greece">Greece</option><option value="Portugal">Portugal</option><option value="Rwanda">Rwanda</option><option value="Czech Republic">Czech Republic</option><option value="Somalia">Somalia</option><option value="Haiti">Haiti</option><option value="Benin">Benin</option><option value="Burundi">Burundi</option><option value="Bolivia">Bolivia</option><option value="Hungary">Hungary</option><option value="Sweden">Sweden</option><option value="Belarus">Belarus</option><option value="Dominican Republic">Dominican Republic</option><option value="Azerbaijan">Azerbaijan</option><option value="Honduras">Honduras</option><option value="Austria">Austria</option><option value="United Arab Emirates">United Arab Emirates</option><option value="Israel">Israel</option><option value="Switzerland">Switzerland</option><option value="Tajikistan">Tajikistan</option><option value="Bulgaria">Bulgaria</option><option value="Hong Kong (China)">Hong Kong (China)</option><option value="Serbia">Serbia</option><option value="Papua New Guinea">Papua New Guinea</option><option value="Paraguay">Paraguay</option><option value="Laos">Laos</option><option value="Jordan">Jordan</option><option value="El Salvador">El Salvador</option><option value="Eritrea">Eritrea</option><option value="Libya">Libya</option><option value="Togo">Togo</option><option value="Sierra Leone">Sierra Leone</option><option value="Nicaragua">Nicaragua</option><option value="Kyrgyzstan">Kyrgyzstan</option><option value="Denmark">Denmark</option><option value="Finland">Finland</option><option value="Slovakia">Slovakia</option><option value="Singapore">Singapore</option><option value="Turkmenistan">Turkmenistan</option><option value="Norway">Norway</option><option value="Lebanon">Lebanon</option><option value="Costa Rica">Costa Rica</option><option value="Central African Republic">Central African Republic</option><option value="Ireland">Ireland</option><option value="Georgia">Georgia</option><option value="New Zealand">New Zealand</option><option value="Republic of the Congo">Republic of the Congo</option><option value="Palestine">Palestine</option><option value="Liberia">Liberia</option><option value="Croatia">Croatia</option><option value="Oman">Oman</option><option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option><option value="Puerto Rico">Puerto Rico</option><option value="Kuwait">Kuwait</option><option value="Moldov">Moldov</option><option value="Mauritania">Mauritania</option><option value="Panama">Panama</option><option value="Uruguay">Uruguay</option><option value="Armenia">Armenia</option><option value="Lithuania">Lithuania</option><option value="Albania">Albania</option><option value="Mongolia">Mongolia</option><option value="Jamaica">Jamaica</option><option value="Namibia">Namibia</option><option value="Lesotho">Lesotho</option><option value="Qatar">Qatar</option><option value="Macedonia">Macedonia</option><option value="Slovenia">Slovenia</option><option value="Botswana">Botswana</option><option value="Latvia">Latvia</option><option value="Gambia">Gambia</option><option value="Kosovo">Kosovo</option><option value="Guinea-Bissau">Guinea-Bissau</option><option value="Gabon">Gabon</option><option value="Equatorial Guinea">Equatorial Guinea</option><option value="Trinidad and Tobago">Trinidad and Tobago</option><option value="Estonia">Estonia</option><option value="Mauritius">Mauritius</option><option value="Swaziland">Swaziland</option><option value="Bahrain">Bahrain</option><option value="Timor-Leste">Timor-Leste</option><option value="Djibouti">Djibouti</option><option value="Cyprus">Cyprus</option><option value="Fiji">Fiji</option><option value="Reunion (France)">Reunion (France)</option><option value="Guyana">Guyana</option><option value="Comoros">Comoros</option><option value="Bhutan">Bhutan</option><option value="Montenegro">Montenegro</option><option value="Macau (China)">Macau (China)</option><option value="Solomon Islands">Solomon Islands</option><option value="Western Sahara">Western Sahara</option><option value="Luxembourg">Luxembourg</option><option value="Suriname">Suriname</option><option value="Cape Verde">Cape Verde</option><option value="Malta">Malta</option><option value="Guadeloupe (France)">Guadeloupe (France)</option><option value="Martinique (France)">Martinique (France)</option><option value="Brunei">Brunei</option><option value="Bahamas">Bahamas</option><option value="Iceland">Iceland</option><option value="Maldives">Maldives</option><option value="Belize">Belize</option><option value="Barbados">Barbados</option><option value="French Polynesia (France)">French Polynesia (France)</option><option value="Vanuatu">Vanuatu</option><option value="New Caledonia (France)">New Caledonia (France)</option><option value="French Guiana (France)">French Guiana (France)</option><option value="Mayotte (France)">Mayotte (France)</option><option value="Samoa">Samoa</option><option value="Sao Tom and Principe">Sao Tom and Principe</option><option value="Saint Lucia">Saint Lucia</option><option value="Guam (USA)">Guam (USA)</option><option value="Curacao (Netherlands)">Curacao (Netherlands)</option><option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option><option value="Kiribati">Kiribati</option><option value="United States Virgin Islands (USA)">United States Virgin Islands (USA)</option><option value="Grenada">Grenada</option><option value="Tonga">Tonga</option><option value="Aruba (Netherlands)">Aruba (Netherlands)</option><option value="Federated States of Micronesia">Federated States of Micronesia</option><option value="Jersey (UK)">Jersey (UK)</option><option value="Seychelles">Seychelles</option><option value="Antigua and Barbuda">Antigua and Barbuda</option><option value="Isle of Man (UK)">Isle of Man (UK)</option><option value="Andorra">Andorra</option><option value="Dominica">Dominica</option><option value="Bermuda (UK)">Bermuda (UK)</option><option value="Guernsey (UK)">Guernsey (UK)</option><option value="Greenland (Denmark)">Greenland (Denmark)</option><option value="Marshall Islands">Marshall Islands</option><option value="American Samoa (USA)">American Samoa (USA)</option><option value="Cayman Islands (UK)">Cayman Islands (UK)</option><option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option><option value="Northern Mariana Islands (USA)">Northern Mariana Islands (USA)</option><option value="Faroe Islands (Denmark)">Faroe Islands (Denmark)</option><option value="Sint Maarten (Netherlands)">Sint Maarten (Netherlands)</option><option value="Saint Martin (France)">Saint Martin (France)</option><option value="Liechtenstein">Liechtenstein</option><option value="Monaco">Monaco</option><option value="San Marino">San Marino</option><option value="Turks and Caicos Islands (UK)">Turks and Caicos Islands (UK)</option><option value="Gibraltar (UK)">Gibraltar (UK)</option><option value="British Virgin Islands (UK)">British Virgin Islands (UK)</option><option value="Aland Islands (Finland)">Aland Islands (Finland)</option><option value="Caribbean Netherlands (Netherlands)">Caribbean Netherlands (Netherlands)</option><option value="Palau">Palau</option><option value="Cook Islands (NZ)">Cook Islands (NZ)</option><option value="Anguilla (UK)">Anguilla (UK)</option><option value="Wallis and Futuna (France)">Wallis and Futuna (France)</option><option value="Tuvalu">Tuvalu</option><option value="Nauru">Nauru</option><option value="Saint Barthelemy (France)">Saint Barthelemy (France)</option><option value="Saint Pierre and Miquelon (France)">Saint Pierre and Miquelon (France)</option><option value="Montserrat (UK)">Montserrat (UK)</option><option value="Saint Helena, Ascension and Tristan da Cunha (UK)">Saint Helena, Ascension and Tristan da Cunha (UK)</option><option value="Svalbard and Jan Mayen (Norway)">Svalbard and Jan Mayen (Norway)</option><option value="Falkland Islands (UK)">Falkland Islands (UK)</option><option value="Norfolk Island (Australia)">Norfolk Island (Australia)</option><option value="Christmas Island (Australia)">Christmas Island (Australia)</option><option value="Niue (NZ)">Niue (NZ)</option><option value="Tokelau (NZ)">Tokelau (NZ)</option><option value="Vatican City">Vatican City</option><option value="Cocos (Keeling) Islands (Australia)">Cocos (Keeling) Islands (Australia)</option><option value="Pitcairn Islands (UK)">Pitcairn Islands (UK)</option></select></span></label> </p> </div> </div> <div class="flex-12"> <div class="col-margin"> <p><label>Email<span class="wpcf7-form-control-wrap" data-name="your-email"><input size="40" maxlength="400" class="wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email form-control" aria-required="true" aria-invalid="false" value="" type="email" name="your-email" /></span></label> </p> </div> </div> <div class="flex-12"> <div class="col-margin"> <div class="button-wrap center relative"> <p><input class="wpcf7-form-control wpcf7-submit has-spinner button font-white" type="submit" value="SUBMIT" /> </p> </div> </div> </div> </div> </div><div class="wpcf7-response-output" aria-hidden="true"></div> </form> </div> </div> </div> </div> </div> <div class="close-button" onclick="closePopup('subscribe-us-popup')"> <svg style="fill: currentColor;" xmlns="https://www.w3.org/2000/svg" width="11.547" height="11.547" viewBox="0 0 11.547 11.547"> <path id="close" d="M10.557.6l-.6-.6L5.278,4.675.6,0,0,.6,4.675,5.278,0,9.953l.6.6L5.278,5.882l4.675,4.675.6-.6L5.882,5.278Z" transform="translate(0.495 0.495)" fill="#fff" stroke="#fff" stroke-width="0.7"/> </svg> </div> </div> </div> </div> <div id="cookies-notice" class="cookies-notice background-white" style="display:none;"> <div class="container container-wide"> <div class="flex-row"> <div class="flex-8"> <div class="text text-black"><h2>We value your privacy!</h2> <p>BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.</p> </div> </div> <div class="flex-4"> <div class="button-wrap justify-content-end"> <div id="cn-accept-cookies" class="button font-white background-skyblue skyblue-border margin-right">ACCEPT</div> <div class="button transparent cookie-close font-white skyblue-border skyblue-font">REJECT</div> </div> </div> <div class="close-button cookie-close svg"> <svg xmlns="http://www.w3.org/2000/svg" width="16.828" height="16.828" viewBox="0 0 16.828 16.828"> <g id="Group_163304" data-name="Group 163304" transform="translate(1.414 1.414)"><line id="Line_323" data-name="Line 323" x2="14" y2="14" fill="none" stroke="#fff" stroke-linecap="round" stroke-width="2"/><line id="Line_324" data-name="Line 324" x1="14" y2="14" fill="none" stroke="#fff" stroke-linecap="round" stroke-width="2"/></g></svg> </div> </div> </div> </div> </div> <script> /*remove cooki msg*/ jQuery(document).ready(function(){ user=getCookie("username2"); if (user == "") { jQuery('#cookies-notice').show(); } function setCookie(cname,cvalue,exdays) { var d = new Date(); d.setTime(d.getTime() + (exdays*24*60*60*1000)); var expires = "expires=" + d.toGMTString(); document.cookie = cname + "=" + cvalue + ";" + expires + ";path=/"; } function getCookie(cname) { var name = cname + "="; var decodedCookie = decodeURIComponent(document.cookie); var ca = decodedCookie.split(';'); for(var i = 0; i < ca.length; i++) { var c = ca[i]; while (c.charAt(0) == ' ') { c = c.substring(1); } if (c.indexOf(name) == 0) { return c.substring(name.length, c.length); } } return ""; } jQuery('#cn-accept-cookies').click(function(){ user=getCookie("username2"); user = "second visit"; if (user != "" && user != null) { setCookie("username2", user, 30); } jQuery('#cookies-notice').remove(); }); jQuery('.cookie-close').click(function(){ jQuery('#cookies-notice').remove(); }); }); </script><script src="https://cdn.jsdelivr.net/npm/sharer.js@latest/sharer.min.js"></script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.0.4" id="swv-js"></script> <script type="text/javascript" id="contact-form-7-js-before"> /* <![CDATA[ */ var wpcf7 = { "api": { "root": "https:\/\/research.checkpoint.com\/wp-json\/", "namespace": "contact-form-7\/v1" }, "cached": 1 }; /* ]]> */ </script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0.4" id="contact-form-7-js"></script> <script type="text/javascript" id="email-subscribers-js-extra"> /* <![CDATA[ */ var es_data = {"messages":{"es_empty_email_notice":"Please enter email address","es_rate_limit_notice":"You need to wait for some time before subscribing again","es_single_optin_success_message":"Successfully Subscribed.","es_email_exists_notice":"Email Address already exists!","es_unexpected_error_notice":"Oops.. Unexpected error occurred.","es_invalid_email_notice":"Invalid email address","es_try_later_notice":"Please try after some time"},"es_ajax_url":"https:\/\/research.checkpoint.com\/wp-admin\/admin-ajax.php"}; /* ]]> */ </script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.js?ver=5.7.52" id="email-subscribers-js"></script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/themes/research-th/js/main.js?ver=1.08" id="main-js-js"></script> <script type="text/javascript" src="https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=lB++6JpXuZRbV9F" id="enlighterjs-js"></script> <script type="text/javascript" id="enlighterjs-js-after"> /* <![CDATA[ */ !function(e,n){if("undefined"!=typeof EnlighterJS){var o={"selectors":{"block":"pre.EnlighterJSRAW","inline":"code.EnlighterJSRAW"},"options":{"indent":4,"ampersandCleanup":true,"linehover":true,"rawcodeDbclick":false,"textOverflow":"break","linenumbers":true,"theme":"dracula","language":"enlighter","retainCssClasses":false,"collapse":false,"toolbarOuter":"","toolbarTop":"{BTN_RAW}{BTN_COPY}{BTN_WINDOW}{BTN_WEBSITE}","toolbarBottom":""}};(e.EnlighterJSINIT=function(){EnlighterJS.init(o.selectors.block,o.selectors.inline,o.options)})()}else{(n&&(n.error||n.log)||function(){})("Error: EnlighterJS resources not loaded yet!")}}(window,console); /* ]]> */ </script> <style> .text label { color: #fff; } .mktoButtonWrap.mktoCleanGray { margin-left: 120px!important; } .mktoButtonWrap.mktoCleanGray .mktoButton:hover, .mktoButtonWrap.mktoCleanGray .mktoButton:active, .mktoButtonWrap.mktoCleanGray .mktoButton:focus, .mktoButtonWrap.mktoCleanGray .mktoButton { border: 0!important; border-radius: 7px!important; background: #6C6CFF!important; color: #fff!important; font-weight: 400!important; } </style> </body> </html>