Sophos Blog

RSS

Threat Research

Luciferus

underground

Devil’s advocate? Uncensored Luciferus AI service advertised underground

Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime

The Frontlines

DFIR

MITRE ATT&CK

Threat hunting tools

Blue Team

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field.

Threat Research

Cyclops Blink

Cisco

Linux

“Eye” spy: Cyclops Blink returns with extended capabilities

Upgraded modular malware observed in attacks on Cisco Firewall Management Center (FMC) devices

Threat Research

rootkit

php

webshell

Dissecting a PHP web server rootkit

Sophos X-Ops takes a deep dive into an insidious piece of malware

Oktober 16, 2024

From QR to compromise: The growing “quishing” threat

Threat Research

featured

Phishing

QR code

Quishing

Sophos X-Ops

Spam

spearphishing

x-ops

Oktober 2, 2024

KI ermöglicht maßgeschneiderte Desinformation im großen Stil

Threat Research

featured

Social engineering

September 10, 2024

Crimson Palace returns: New Tools, Tactics, and Targets

Security Operations

Threat Research

BackdoorDiplomacy

Chinese APT

Crimson Palace

Earth Longzhi

featured

MDR

REF5961

Sophos X-Ops

TA428

Unfading Sea Haze

August 22, 2024

Qilin ransomware caught stealing credentials stored in Google Chrome

Security Operations

Threat Research

Credentials

featured

incident response

Privacy

qilin

Ransomware

A photograph of architectural diagrams on a table, with a yellow tape measure

August 15, 2024

Content updates and product architecture: Sophos Endpoint

Threat Research

content updates

drivers

featured

Intercept X

Sophos X-Ops

Un hombre con uniforme de policía bloquea la entrada a un edificio acristalado con los brazos en alto. Los atacantes de ransomware introducen un nuevo asesino EDR en su arsenal. Sophos descubre el uso de EDRKillShifter por los atacantes del ransomware RansomHub. Por Andreas Klopsch. Fuente de la imagen: Shutterstock

August 14, 2024

Ransomware attackers introduce new EDR killer to their arsenal

Threat Research

BYOVD

EDR

EDR killer

EDRKillShifter

featured

Ransomware

August 13, 2024

Don’t get Mad, get wise

Security Operations

Threat Research

AnyDesk

featured

incident response

mad liberator

malware

Social engineering

August 8, 2024

Ransomware-Gruppen erhöhen Druck auf Zahlungsunwillige

Threat Research

featured

Ransomware

August 7, 2024

Best security practices for ESXi environments

Security Operations

Threat Research

EDR

ESXi

featured

MDR

remediations

Sophos X-Ops

Virtualization

VMware