Sophos Threat Research

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

In the last of our five-part series, Sophos X-Ops explores the implications and opportunities arising from threat actors’ involvement in real-world industries and crimes

In the fourth of our five-part series, Sophos X-Ops explores threat actors’ real-world criminal business interests

In the third of our five-part series, Sophos X-Ops explores the more legally and ethically dubious business interests of financially motivated threat actors

In the second of our five-part series, Sophos X-Ops investigates the so-called ‘white’ (legitimate) business interests of threat actors

Sophos X-Ops investigates what financially motivated threat actors invest their ill-gotten profits in, once the dust has settled

Five issues actively exploited in the wild, but the real excitement may have been handled in advance

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

The North Korean IT worker scheme grows to include organizations in Europe and Asia and industries beyond the technology sector

Multifaceted changes in TTPs illustrate what researchers see when they start digging

A near-miss episode of attempted defunding spotlights a need for a better way

These are the tools of the trade Sophos detected in use by cybercriminals over 2024

Ransomware remains the biggest threat, but old and misconfigured network devices are making it too easy

One actively exploited issue patched; five Critical-severity Office vulns exploitable via Preview Pane

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope

Sophos X-Ops uncovers a recent campaign from an Android RAT first seen in 2019 – now infecting users in Taiwan

Not all authentication is equal to the task in 2025, but there is a best choice within reach

Just 57 CVEs to contend with (plus advisories), but six are already under exploit in the wild