Sophos Blog

RSS

Threat Research

Luciferus

underground

Devil’s advocate? Uncensored Luciferus AI service advertised underground

Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime

The Frontlines

DFIR

MITRE ATT&CK

Threat hunting tools

Blue Team

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field.

Threat Research

Cyclops Blink

Cisco

Linux

“Eye” spy: Cyclops Blink returns with extended capabilities

Upgraded modular malware observed in attacks on Cisco Firewall Management Center (FMC) devices

Threat Research

rootkit

php

webshell

Dissecting a PHP web server rootkit

Sophos X-Ops takes a deep dive into an insidious piece of malware

March 23, 2026

Oracle vulnerability (CVE-2026-21992) impacts core products

Threat Research

advisory

vulnerability

Oracle

March 19, 2026

Android devices ship with firmware-level malware

Threat Research

Android

Keenadu

March 13, 2026

March Patch Tuesday visits 15 product families

Threat Research

Patch Tuesday

x-ops

Microsoft

Windows

detection

March 13, 2026

Initial access techniques used by Iran-based threat actors

Threat Research

Iran

initial access

March 11, 2026

Evil evolution: ClickFix and macOS infostealers

Threat Research

MacOS

infostealer

clickfix

MacSync

Social engineering

March 5, 2026

Optimize Your Sophos Firewall Security

Products & Services

Firewall

v22

network

March 3, 2026

Hacktivist campaigns increase as United States, Iran, and Israel conflict intensifies

Threat Research

hacktivism

Iran

israel

Operation Epic Fury

March 1, 2026

Cyber Advisory: Increased Cyber Risk Amid U.S.–Israel–Iran Escalation

Security Operations

Sophos CTU

Iran

Operation Epic Fury

February 26, 2026

Sophos Workspace Protection is Now Available

Products & Services

Workspace