Sophos Threat Research

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar 

A sea change in available data fuels fresh insights from the first half of 2024

Sophos X-Ops looks at the realism of this year’s MITRE ATT&CK Evaluations

Seventeen Critical-severity CVEs ready to deck your halls; also, new blog guidance for Windows Server admins

Sophos MDR has observed a new campaign that uses targeted phishing to entice the target to download a legitimate remote machine management tool to dump credentials. We believe with moderate confidence that this activity, which we track as STAC 1171, is related to an Iranian threat actor commonly referred to as MuddyWater or TA450. The […]

Fourteen product families affected as 2024 passes an unfortunate milestone

Last month, Sophos X-Ops reported several MDR cases where threat actors exploited a vulnerability in Veeam backup servers. We continue to track the activities of this threat cluster, which recently included deployment of a new ransomware. The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881. Attacks leveraged compromised […]

The Internet is full of cats—and in this case, malware-delivering fake cat websites used for very targeted search engine optimization.

Attackers leverage QR codes in PDF email attachments to spearphish corporate credentials from mobile devices

Bumper crop of Windows vulns leads the way; 15 product groups represented

In the wake of a gathering of industry leaders at Microsoft to discuss the endpoint-security ecosystem, some thoughts

Seven critical-severity vulnerabilities addressed, including an extraordinary (but narrow) Windows Update flaw

Chinese cyberespionage campaign renews efforts in multiple organizations in Southeast Asia, blending tactics and expanding efforts 

Sophos X-Ops explores the distribution and capabilities of the Atomic macOS Stealer (AMOS)

An EDR killer Sophos X-Ops has tracked for three years continues to bedevil organizations targeted by ransomware gangs.

Familiar ransomware develops an appetite for passwords to third-party sites

Sophos X-Ops takes a look at the content updates in Intercept X, and how we validate and release them

Monthly security release hauls out 85 CVEs… and that’s before the advisories

Sophos discovers the threat actors behind RansomHub ransomware using EDRKillShifter in attacks

The “Mad Liberator” ransomware group leverages social-engineering moves to watch out for