Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

julho 15, 2025

Sweet 16: Sophos named a Leader (again) in the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

Products & Services

EDR

Endpoint

Endpoint Detection and Response

EPP

Extended Detection and Response

featured

Gartner

MDR

Sophos Endpoint

XDR

julho 10, 2025

Sophos Central firewall management update

Products & Services

Firewall

julho 7, 2025

Strengthening cyber resilience: Introducing Internal Attack Surface Management (IASM) for Sophos Managed Risk

Products & Services

featured

MANAGED RISK

MDR

Security Operations

junho 30, 2025

Using AI to identify cybercrime masterminds

AI Research

Threat Research

cybercrime

Dark Web

featured

threat activity cluster

threat actors

junho 25, 2025

O Estado do Ransomware 2025

Products & Services

Products and Services

Ransomware

State of Ransomware

Research

Sophos MDR

Sophos Endpoint

junho 4, 2025

The strange tale of ischhfd83: When cybercriminals eat their own

threat research

Asyncrat

Backdoor

Cybercrime Forums

featured

Lumma Stealer

Sophos X-Ops

maio 27, 2025

DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers

Security Operations

threat research

Dragonforce

featured

MSP

Simplehelp

Sophos MDR Incident Response

Sophos X-Ops

supply chain compromise

maio 21, 2025

DragonForce targets rivals in a play for dominance

threat research

ctu

cybercrime

Dragonforce

featured

Gold Harvest

RansomHub

Ransomware

scattered spider

maio 20, 2025

A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist

Security Operations

threat research

3am ransomware

featured

vishing