Sophos Blog

RSS

Threat Research

Luciferus

underground

Devil’s advocate? Uncensored Luciferus AI service advertised underground

Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime

The Frontlines

DFIR

MITRE ATT&CK

Threat hunting tools

Blue Team

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field.

Threat Research

Cyclops Blink

Cisco

Linux

“Eye” spy: Cyclops Blink returns with extended capabilities

Upgraded modular malware observed in attacks on Cisco Firewall Management Center (FMC) devices

Threat Research

rootkit

php

webshell

Dissecting a PHP web server rootkit

Sophos X-Ops takes a deep dive into an insidious piece of malware

Januar 21, 2025

Fiese Masche: 3.000 Emails und ein “rettender” Support-Anruf via Teams

Threat Research

featured

Ransomware

Magic,Wand,And,Top,Hat,Isolated,On,White.,Magician,Trick

Januar 16, 2025

Gootloader inside out

Threat Research

featured

Gootkit

Gootloader

HelloDolly

JScript

malicious SEO

malware

obfuscation

php

PHP shell

SEO

WordPress

YARA

Januar 14, 2025

159-CVE January Patch Tuesday smashes single-month record

Threat Research

CVE-2025-21298

featured

Microsoft

Microsoft Windows

OLE

Patch Tuesday

RTF

A,Wooden,Acoustic,Guitar,At,Night.,With,Spotlight,For,Your

Dezember 19, 2024

Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces

Security Operations

Threat Research

CloudFlare

featured

FlowerStorm

legitimate service abuse

Phishing

phishing-as-a-service

Rockstar

Rockstar2FA

Sophos MDR

Sophos X-Ops

Dezember 12, 2024

Der Wolf im Schafspelz – Cyberkriminelle setzen auf die Windows-Tarnkappe

Threat Research

featured

White Grey Virtual reality Headset isolated on white background

Dezember 11, 2024

Keeping it real: Sophos and the 2024 MITRE ATT&CK Evaluations: Enterprise

Threat Research

featured

MITRE

MITRE ATT&CK

Ransomware

Sophos X-Ops

Dezember 11, 2024

December Patch Tuesday arrives bearing 71 gifts

Threat Research

featured

Microsoft

Patch Tuesday

RDP

Windows

The,Muddy,Water,Of,The,Jordan,River,At,The,Border

November 20, 2024

Sophos MDR blocks and tracks activity from probable Iranian state actor “MuddyWater”

Security Operations

Threat Research

Atera

featured

legitimate service abuse

MDR

MuddyWater

Phishing

RMM

Sophos X-Ops

STAC 1171

TA450

November 13, 2024

November Patch Tuesday loads up everyone’s plate

Threat Research

CVE-2024-43451

CVE-2024-43623

CVE-2024-43630

CVE-2024-49033

CVE-2024-49039

featured

Microsoft Defender

Microsoft Windows

Patch Tuesday