Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

九月 23, 2021

Phishing and malware actors abuse Google Forms for credentials, data exfiltration

Threat Research

exfiltration

Featured

Google Forms

legitimate service abuse

Phishing

TLS

九月 21, 2021

Cring ransomware group exploits ancient ColdFusion server

SophosLabs Uncut

Threat Research

ColdFusion

cring

Ransomware

九月 14, 2021

Big Office bug squashed for September 2021’s Patch Tuesday

Threat Research

14.8

Apple

CVE-2021-38645

CVE-2021-38647

CVE-2021-38648

CVE-2021-38649

CVE-2021-40444

Exploit

Featured

Forcedentry

iOS

Microsoft

Office

OMI

OMIGOD

Patch Tuesday

Troj/DocDl

九月 3, 2021

Conti affiliates use ProxyShell Exchange exploit in ransomware attacks

Security Operations

Threat Research

Conti

Featured

ProxyShell

九月 1, 2021

Fake pirated software sites serve up malware droppers as a service

八月 27, 2021

LockFile ransomware’s box of tricks: intermittent encryption and evasion

SophosLabs Uncut

Threat Research

Featured

LockFile

ProxyShell

Ransomware

Pygmy Hippopotamus, photo by William Warby (https://www.flickr.com/photos/wwarby/19446821910)

八月 25, 2021

How PetitPotam hijacks the Windows API, and what you can do about it

SophosLabs Uncut

Threat Research

Featured

LockFile

metasploit

NTLM

PetitPotam

ProxyLogon

Ransomware

八月 12, 2021

Gootloader’s “mothership” controls malicious content

Threat Research

Google

Gootloader

malicious SEO

malware

八月 9, 2021

BlackMatter ransomware emerges from the shadow of DarkSide

Threat Research

BlackMatter

DarkSide

Encryption

Featured

LockBit Ransomware

Ransomware

REvil