
Colin Cowie
Colin is a Manager of Threat Intelligence for the Sophos Managed Detection and Response (MDR) team, focusing on threat actor identification, incident response, and working alongside detection engineers to address emerging threats. In past roles, he worked in the financial sector performing internal and external penetration testing.
Content by Colin Cowie

Threat Research
AI
Ransomware
Aur0ra
AI used in Aur0ra ransomware testing and execution
October 29, 2026

Threat Research
AI
malvertising
infostealer
Sophos X-Ops
Fake AI, real malware: Attackers impersonating AI brands
August 19, 2026

AI Research
AI
Agentic AI
A double-edged bleeding edge: Classifying AI threats
June 30, 2026

Security Operations
Campaña maliciosa en WhatsApp despliega el troyano bancario Astaroth
November 21, 2025

Threat Research
Astaroth
Brazil
Featured
Guildma
infostealer
WhatsApp
worm
WhatsApp compromise leads to Astaroth deployment
November 20, 2025

Threat Research
Featured
MDR
Patch Tuesday
SharePoint
Sophos X-Ops
toolshell
SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild
July 21, 2025

Security Operations
Threat Research
3am ransomware
Featured
vishing
A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
May 20, 2025

Security Operations
Threat Research
adversary in the middle
Featured
MFA
MFA phishing
qilin
RMM
ScreenConnect
Sophos X-Ops
supply chain compromise
Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream
April 1, 2025

Security Operations
Threat Research
Black Basta
Featured
Fin7
Java malware
legitimate service abuse
Microsoft Office 365
python malware
Quick Assist
remote machine management
Sophos X-Ops
STAC5143
stac5777
Teams
Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”
January 21, 2025