Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

A computer hard disk on fire against a white background

janeiro 13, 2026

Laughter in the dark: Tales of absurdity from the cyber frontline and what they taught us

Threat Research

Ransomware

Hive

Lockbit

BlackCat

LLM

Money Laundering

dezembro 18, 2025

I am not a robot: ClickFix used to deploy StealC and Qilin

Threat Research

clickfix

featured

GOLD FEATHER

human verification

infostealer

qilin

Ransomware

StealC

dezembro 15, 2025

Game of clones: Sophos and The MITRE ATT&CK Enterprise 2025 Evaluations

Threat Research

ATT&CK

Emulation

featured

MITRE

MUSTANG PANDA

scattered spider

Sophos X-Ops

Home maintenance - An untidy workshop bench full of dusty old tools and screws.

julho 21, 2025

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild

Threat Research

featured

MDR

Patch Tuesday

SharePoint

Sophos X-Ops

toolshell

junho 30, 2025

Using AI to identify cybercrime masterminds

AI Research

Threat Research

cybercrime

Dark Web

featured

threat activity cluster

threat actors

abril 2, 2025

It takes two: The 2025 Sophos Active Adversary Report

Security Operations

Threat Research

Active Adversary

Active Adversary Report

Compromised Credentials

detection

dwell time

featured

impact

incident response

LOLBIN

MFA

Monitoring

RDP

Remote Ransomware

root cause

Real,Time,Analytics,Concept.,The,Process,Of,Collecting,Data,As

dezembro 30, 2024

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks

Threat Research

CVSS

Patch Tuesday

patching

Sophos X-Ops

threat research

dezembro 12, 2024

the Bite from Inside: The Sophos Active Adversary Report

Security Operations

Threat Research

Active Adversary

Active Adversary Report

featured

incident response

LoLBINs

MDR

RDP

The,Muddy,Water,Of,The,Jordan,River,At,The,Border

novembro 20, 2024

Sophos MDR blocks and tracks activity from probable Iranian state actor “MuddyWater”

Security Operations

Threat Research

Atera

featured

legitimate service abuse

MDR

MuddyWater

Phishing

RMM

Sophos X-Ops

STAC 1171

TA450