Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

Data,Protection,Cyber,Security,Privacy,Business,Internet,Technology,Concept

agosto 8, 2023

Clustering attacker behavior reveals hidden patterns

Threat Research

Black Basta

featured

Hive

MDR

Ransomware

Royal

Sophos X-Ops

TAC

threat activity cluster

agosto 7, 2023

SophosAI at DEF CON: Orchestrating large-scale scams using text, audio and image generative AI

AI Research

adversarial ai

DEF CON

Generative AI

Large Language Models

web scams

julho 26, 2023

Into the tank with Nitrogen

Threat Research

featured

initial access

malvertising

MDR

nitrogen

sideloading

Sophos X-Ops

Goldfish,Fishing,Lure,Underwater,On,Blue,Sky,Background.,Copy,Space

julho 20, 2023

Bad ad fad leads to IcedID, Gozi infections

Security Operations

Threat Research

BatLoader

Cybercrime Forums

FakeBat

featured

Gozi

IcedID

malvertising

MDR

Sophos X-Ops

julho 10, 2023

Clop At The Top – But For How Long?

Security Operations

Threat Research

clop

featured

FIN11

goanywhere

MDR

MOVEit

PaperCut

Ransomware

TA505

junho 30, 2023

Investigator, API Yourself: Deploying Microsoft Graph on the trail of an attacker

Security Operations

Threat Research

Email Compromise

featured

human-led threat hunting

MDR

Microsoft 365

microsoft graph

Office 365

junho 22, 2023

And I Shall Call It Mini-Me GPT: Using Large Language Models to Classify the Uncharted Web

AI Research

BERT

featured

GPT-3

Large Language Models

Sophos X-Ops

T5 Large LLM

Web filtering

website categorization

Data,Transfer,Concept,,Internet,Server,Connection

junho 5, 2023

Update 6: Information on MOVEit Vulnerabilities CVE-2023-34362, CVE-2023-35036, CVE-2023-35708, and CVE-2023-36934

Security Operations

Threat Research

CVE-2023-34362

CVE-2023-35036

CVE-2023-35708

CVE-2023-36932

CVE-2023-36933

CVE-2023-36934

Exploit

featured

FIN11

MDR

MOVEit

Progress Software

TA505

vulnerability

maio 12, 2023

Whodunnit? Cybercrook gets 6 years for ransoming his own employer

Naked Security

doj

FBI

MDR

Ransomware

Zero Trust