Focus Scroll Background

Sophos Blog

RSS

BRONZE SANDCASTLE Meterpreter blog feature image

BRONZE SANDCASTLE deploys modified Meterpreter shells

The China-based threat group uses DLL sideloading in these attacks

Gabor Szappanos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

No novelty required to be effective

Show, don’t tell: Sophos AI at CAMLIS

The Sophos AI team presents a novel technique for calibrating agentic SOC analysts

BRONZE SANDCASTLE Meterpreter blog feature image

October 20, 2026

BRONZE SANDCASTLE deploys modified Meterpreter shells

Threat Research

October 20, 2026

Why Incident Response Demand Will Grow Faster than Expected

The Frontlines

October 19, 2026

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

Threat Research

ConnectWise Cloud Backup feature image

October 19, 2026

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Threat Research

October 15, 2026

Sophos ITDR expands identity protection for the AI era

Products & Services

October 14, 2026

Show, don’t tell: Sophos AI at CAMLIS

AI Research

October 13, 2026

Building intent-based access control without reading minds

AI Research

October 13, 2026

Stopping attackers who want your endpoint protection to go dark

Products & Services

October 13, 2026

Sophos AI Defense is now generally available

Products & Services