Threat Research – Sophos News
Industrial-strength April Patch Tuesday covers 135 CVEs 9 April 2025 at 13:23

Industrial-strength April Patch Tuesday covers 135 CVEs

Threat Research – Sophos News

By:Angela Gunn

9 April 2025 at 13:23

One actively exploited issue patched; five Critical-severity Office vulns exploitable via Preview Pane

A bar chart showing the distribution of patches in the April 2025 Patch Tuesday release by impact, further indicated by severity; material is covered in text

A bar chart showing the distribution of patches in the April 2025 Patch Tuesday release by product family, further indicated by severity; material is covered in text

A bar chart showing the distribution of patches in 2025 Patch Tuesdays release by impact, further indicated by severity

Threat Research – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Threat Research – Sophos News

By:Angela Gunn

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

Threat Research – Sophos News
Stealing user credentials with evilginx 28 March 2025 at 02:29

Stealing user credentials with evilginx

Threat Research – Sophos News

By:Angela Gunn

28 March 2025 at 02:29

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope

Threat Research – Sophos News
Little fires everywhere for March Patch Tuesday 12 March 2025 at 06:00

Little fires everywhere for March Patch Tuesday

Threat Research – Sophos News

By:Angela Gunn

12 March 2025 at 06:00

Just 57 CVEs to contend with (plus advisories), but six are already under exploit in the wild

A bar chart showing the distribution of March 2025's Microsoft patches sorted by impact and further sorted by severity, as described in article text

A bar chart showing the distribution of March 2025's Microsoft patches sorted by product family and further sorted by severity, as described in article text

A bar chart showing the cumulative totals of Microsoft patches in 2025, sorted by impact and further sorted by severity, as described in article text

Security Operations – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Security Operations – Sophos News

By:Angela Gunn

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you