Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

dezembro 15, 2025

Game of clones: Sophos and The MITRE ATT&CK Enterprise 2025 Evaluations

Threat Research

ATT&CK

Emulation

featured

MITRE

MUSTANG PANDA

scattered spider

Sophos X-Ops

dezembro 11, 2025

React2Shell flaw (CVE-2025-55182) exploited for remote code execution

threat research

featured

vulnerability

react2shell

dezembro 11, 2025

A big finish to 2025 in December’s Patch Tuesday

X-ops

threat research

featured

Microsoft

Patch Tuesday

Zero Days

dezembro 11, 2025

GOLD SALEM tradecraft for deploying Warlock ransomware

threat research

cybercrime

featured

GOLD SALEM

Ransomware

Warlock

dezembro 9, 2025

Sophos Firewall v22 já está disponível

Sophos Insights

Autonomous University of Yucatan campus building.

novembro 24, 2025

Modernizing trust: How UADY transformed campus security with Sophos

Sophos Insights

Case Study

customer case study

Education

higher education

novembro 21, 2025

Campanha maliciosa no WhatsApp implanta o trojan bancário Astaroth

Security Operations

novembro 18, 2025

Cybersecurity for Microsoft Environments

Products & Services

Security Operations

featured

Microsoft

Microsoft 365 Copilot

Microsoft Copilot

Microsoft Defender

Microsoft Intelligent Security Association (MISA)

Microsoft Security Copilot

SMB

Sophos Intelix

Sophos MDR

Sophos X-Ops

A group of keys lined up around an unlocked padlock.

novembro 14, 2025

Infostealers: The silent doorway to identity attacks — and why proactive defense matters

Sophos Insights

digital identity

featured

Identity Threat Detection and Response

Information Stealers

infostealer

Sophos ITDR