Skip to content
You can now search across every topic, entity and event.What's new
Check Point Research
OrganisationIL

Check Point Research

Check Point's threat-research division; gained C2 visibility into The Gentlemen's 1,570+ victim network.

Check Point Research infiltrated a SystemBC command server used by The Gentlemen ransomware group in May 2026, surfacing 1,570 confirmed victims, the most detailed public picture of the group's reach to date.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

Did Check Point Research notify the 1,570 Gentlemen ransomware victims it identified?

Timeline for Check Point Research

#12 2 Aug

Mentioned in: Qilin's own affiliate now outposts it

Cybersecurity: Threats and Defences
#3 19 Apr

Gained visibility on 1,570 Gentlemen ransomware victims via a compromised SystemBC C2 server

Cybersecurity: Threats and Defences: KB5091157, Gentlemen C2 intel, ENISA CNAs: in brief
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

Check Point Research is the threat-intelligence and vulnerability research division of Check Point Software Technologies, one of the oldest publicly traded cybersecurity companies. In May 2026, it identified and monitored a SystemBC command-and-control server operated by The Gentlemen RaaS, gaining visibility into at least 1,570 confirmed victims across the group's global operations, the most comprehensive public picture of that group's reach to date .

Check Point Research publishes monthly and annual threat intelligence including the widely cited Global Threat Index, operating autonomously from Check Point's commercial product teams. It is a distinct entity from Check Point Software's product division, which separately disclosed the CVE-2026-50751 VPN zero-day; the 90 per cent Gentlemen affiliate-revenue figure sometimes attributed to Check Point Research in fact comes from the leak-site tracker ransomware.live, not from this division's own reporting.

The C2 monitoring technique, identifying and gaining access to a threat actor's command infrastructure, is a high-value intelligence collection method that can reveal victim lists, operational schedules and malware configurations. That Check Point Research achieved this against an active top-tier ransomware operation suggests either a misconfigured C2 or a deliberate law-enforcement cooperation effort, though neither has been confirmed on the record.

Common Questions
How did Check Point Research access The Gentlemen's victim list?
Check Point Research identified and monitored a SystemBC command-and-control server used by The Gentlemen ransomware group, gaining visibility into 1,570 confirmed victims. C2 monitoring exploits misconfigured or exposed infrastructure to obtain intelligence.Source: Check Point Research
What is Check Point Research and what do they publish?
Check Point Research is the threat-intelligence division of Check Point Software Technologies. It publishes the monthly Global Threat Index, major malware discoveries, and APT research. It reported on The Gentlemen ransomware's 1,570+ victim network in May 2026.
What is SystemBC malware and how does The Gentlemen use it?
SystemBC is a proxy malware and C2 framework used by ransomware operators to maintain persistent, encrypted command channels. The Gentlemen ransomware group deployed SystemBC as their C2 infrastructure; Check Point Research identified and monitored a SystemBC server, revealing 1,570+ confirmed victims.Source: Check Point Research
How does Check Point Research compare to Mandiant or CrowdStrike for threat intelligence?
Check Point Research focuses on vulnerability discovery and malware analysis, publishing the monthly Global Threat Index. Mandiant (now Google Threat Intelligence Group) specialises in nation-state attribution and Incident Response. CrowdStrike OverWatch focuses on endpoint-based adversary tracking. All three contribute to public threat intelligence but with different methodological emphases.
Source Material
Check Point Research