Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

Curvy,Detour,Along,The,Piilani,Highway,In,The,Southeast,Of

十月 4, 2022

Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse

Threat Research

BlackByte

EDR

Featured

Ransomware

Sophos X-Ops

Red,Car,Driving,Past,Dangerous,Winding,Road,Sign,In,A

十月 3, 2022

Two Exchange Server vulns veer dangerously close to ProxyShell

Threat Research

Exchange Server

Featured

ProxyShell

Sophos X-Ops

ssrf

The,Concept,Of,Fixing,Bugs,In,Computer,Code.,Patch,On

九月 13, 2022

A lighter Patch Tuesday, but one heavy with remote code execution bugs

Threat Research

Featured

Microsoft

Patch Tuesday

Security Operations

Sophos X-Ops

Different cookies in glass jar - depositphotos.com

八月 18, 2022

Cookie stealing: the new perimeter bypass

Threat Research

Active Adversary

cookie theft

Featured

Information Stealers

Security Operations

Sophos X-Ops

八月 9, 2022

Multiple attackers increase pressure on victims, complicate incident response

Security Operations

Threat Research

Active Adversary Report

BlackCat

Conti

cryptominers

Cybercrime Forums

Featured

Hive

IABs

Karakurt

Lockbit

Ransomware

Sophos X-Ops

八月 4, 2022

Genesis Brings Polish to Stolen-Credential Marketplaces

Threat Research

Cybercrime Forums

cybercriminals

genesis

IABs

Ransomware

Security Operations

Sophos X-Ops

七月 20, 2022

Behind the Research: The Making of “OODA: X-Ops Takes on Burgeoning SQL Server Attacks”

Security Operations

Threat Research

Behind the research

Sophos X-Ops

七月 20, 2022

OODA: X-Ops Takes On Burgeoning SQL Server Attacks

Security Operations

Threat Research

Featured

Managed Threat Response

MTR•Rapid Response

Sophos Rapid Response

Sophos X-Ops

七月 20, 2022

Sophos X-Ops FAQ

Threat Research

Security Operations

Sophos X-Ops