SparkMalware
Spark is a Windows backdoor and has been in use since as early as 2017.From MITRE ATT&CK
Last reported 3 days ago, by Help Net Security15 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1684Social Engineering
“PREY-0059 social engineering campaign: A threat actor is currently involved in a social engineering campaign that impersonates internal IT help-desk staff over Microsoft Teams, delivering Windows update-related files that infect users with a Java-based RAT.”
- T1190Exploit Public-Facing Application
“Exploiting these flaws on exposed systems maps to the MITRE ATT&CK technique Exploit Public-Facing Application (T1190).”
- T1505.003Web Shell
“…or’s indicators of compromise or detection guidance (Citrix, Check Point, Fortinet, and Cisco all published them), look for new files, web shells, and unexpected outbound connections, and rotate the credentials the system held.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
NVIDIA unveils security architecture that can stop AI agents crossing set boundaries“The architecture extends beyond large computing installations to support NVIDIA RTX Spark, DGX Spark and DGX Station systems for agents operating locally across industries including retail, healthcare, manufacturing, robotics and telecommunications.”
-
Cisco Unified Intelligence Center SQL Injection Vulnerability“Cisco would like to thank Hesham Ahmed from Spark Professional Services for reporting this vulnerability.”
-
Risky Bulletin: PwnEscape vulnerability lets you escape KVM“Ukrainian hacktivist deface school testing system: Pro-Ukrainian hacktivist groupBlack Spark has hacked and defaced a Russian school testing system with anti-Putin and anti-government messages.”
-
Silent Push Joins Singapore's IMDA Spark Programme“Silent Push Joins Singapore's IMDA Spark Programme”
-
Top RCE Vulnerabilities“…VSS) is an improper certificate validation bug in VPN negotiation that lets an unauthenticated attacker run code on Security Gateway and Spark Firewall appliances that use Site-to-Site or Remote Access VPN.”
-
Ridge Security’s RidgeOne keeps autonomous penetration testing data inside customer environments“Combining Ridge Security’s RidgeGen agentic security validation platform with an open-weight AI model running on NVIDIA DGX Spark, RidgeOne enables organizations to perform deep security testing within their own environment without sending sensitive testing data to an external AI…”
-
Meta outlines Muse Wonder safeguards for AI agents acting on your behalf“The company compared Muse Wonder Full with Muse Spark 1.3 and found that Wonder Full performed better on those tasks than the Spark trend would predict.”
-
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents“Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances”
-
Check Point Pre-Auth Flaws Under Attack“CVE-2026-85102 affects VPN certificate handling in Security Gateways and Spark Firewalls, while CVE-2026-93616 affects the Check Point Management web service.”
-
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files“Meta said in August that a pre-release version of its Muse Spark 1.1 model exploited a flaw in a real website and changed its database during an exercise run by the same partner, Irregular.”
-
NCSC-2026-0365 [1.01] [H/H] Kwetsbaarheden verholpen in Check Point VPN-producten“De kwetsbaarheid geldt voor Security Gateway en Check Point Spark Firewall wanneer Site-to-Site VPN of Remote Access VPN wordt gebruikt.”
-
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks“The attempts, against a flaw tracked as CVE-2026-85102, have targeted customers of Spark, Check Point's firewall line for small businesses.”
-
June 2026 CVE Landscape“…campaign across Linux architectures, while Qilin Ransomware was associated with CVE-2026-50751 affecting Checkpoint Security Gateway and Spark Firewalls.”
-
Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)“…the 8th of June 2026, Check Point released hotfixes for a pair of vulnerabilities in their Mobile Access/SSL VPN, Remote Access VPN, and Spark Firewall products, specifically within the "deprecated" IKEv1 VPN code.”
-
10 Cybersecurity Podcasts to Add to Your Queue Now“Hosted by: David Spark (founder and executive producer of the CISO Series), alongside Mike Johnson, CISO of Rivian, and Andy Ellis, principal at Duha.”
Thanks — we review every report.