Sophos Blog

RSS

QEMU abused to evade detection and enable ransomware delivery - feature image

Threat Research

virtual machine

QEMU

PayoutsKing

GOLD ENCOUNTER

CitrixBleed2

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment

Sophos Insights

LLM

Exploit

vulnerability

Active Adversary

Pacific Rim

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.

Threat Research

OpenClaw

LLM

penetration testing

Red Team

CISO

Sophos X-Ops

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks

Products & Services

CISO

Compliance

Is compliance complexity outpacing IT capacity?

No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements

十一月 20, 2025

WhatsApp compromise leads to Astaroth deployment

Threat Research

Astaroth

Brazil

Featured

Guildma

infostealer

worm

十一月 12, 2025

November Patch Tuesday does its chores

Threat Research

Adobe

Featured

Microsoft

nuance

Patch Tuesday

十月 30, 2025

BRONZE BUTLER exploits Japanese asset management software vulnerability

Threat Research

BRONZE BUTLER

china

Featured

Japan

LANSCOPE

Tick

vulnerabiity

十月 29, 2025

Windows Server Update Services (WSUS) vulnerability abused to harvest sensitive data

Threat Research

Featured

vulnerability

Windows Server Update Services

WSUS

Threat Intelligence Executive Report cover image for Volume 2025 Number 5

十月 17, 2025

Threat Intelligence Executive Report – Volume 2025, Number 5

Threat Research

Featured

infostealer

MFA

multi-factor authentication

patching

Ransomware

Vulnerabilities

十月 15, 2025

F5 network compromised

Threat Research

advisory

compromise

Featured

十月 15, 2025

October Patch Tuesday beats January ’25 record

Threat Research

Featured

Microsoft

Patch Tuesday

Windows

Windows 10

Closeup side view of a coyote hunting in grassland

十月 10, 2025

WhatsApp Worm Targets Brazilian Banking Customers

Threat Research

Brazil

coyote

Featured

infostealer

Powershell

selenium

worm

九月 26, 2025

HeartCrypt’s wholesale impersonation effort

Threat Research

blind spider

Featured

heartcrypt

packer

Service