Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

二月 5, 2025

Scalable Vector Graphics files pose a novel phishing threat

Threat Research

.svg

Featured

Phishing

Scalable vector graphics

Spam

A robot hand on the left reaches towards a human hand on the right, with a blurred blue-black cityscape in the background

一月 28, 2025

Update: Cybercriminals still not fully on board the AI train (yet)

Threat Research

ChatGPT

Cybercrime Forums

Featured

scams

Social engineering

Sophos X-Ops

Email,Alert,And,Message,Sending,/,Receiving,Concept,:,Envelope

一月 21, 2025

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”

Security Operations

Threat Research

Black Basta

Featured

Fin7

Java malware

legitimate service abuse

Microsoft Office 365

python malware

Quick Assist

remote machine management

Sophos X-Ops

STAC5143

stac5777

Teams

Magic,Wand,And,Top,Hat,Isolated,On,White.,Magician,Trick

一月 16, 2025

Gootloader inside out

Threat Research

Featured

Gootkit

Gootloader

HelloDolly

JScript

malicious SEO

malware

obfuscation

php

PHP shell

SEO

WordPress

YARA

一月 14, 2025

159-CVE January Patch Tuesday smashes single-month record

Threat Research

CVE-2025-21298

Featured

Microsoft

Microsoft Windows

OLE

Patch Tuesday

RTF

Real,Time,Analytics,Concept.,The,Process,Of,Collecting,Data,As

十二月 30, 2024

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks

Threat Research

CVSS

Patch Tuesday

patching

Sophos X-Ops

Threat Research

Business,Operations,And,Management,Concept.,Thinking,Of,A,Strategy,And

十二月 27, 2024

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS

Threat Research

CVSS

Patch Tuesday

patching

Sophos X-Ops

A,Wooden,Acoustic,Guitar,At,Night.,With,Spotlight,For,Your

十二月 19, 2024

Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces

Security Operations

Threat Research

CloudFlare

Featured

FlowerStorm

legitimate service abuse

Phishing

phishing-as-a-service

Rockstar

Rockstar2FA

Sophos MDR

Sophos X-Ops

十二月 12, 2024

The Bite from Inside: The Sophos Active Adversary Report

Security Operations

Threat Research

Active Adversary

Active Adversary Report

Featured

incident response

LoLBINs

MDR

RDP