❌

Normal view

Before yesterdayMain stream

Threat Research – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Threat Research – Sophos News

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

Threat Research – Sophos News
Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream 1 April 2025 at 05:30

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

Threat Research – Sophos News

By:gallagherseanm

1 April 2025 at 05:30

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A screenshot of the WikiLeaksV2 web site used by the Qilin RaaS group.

Figure 2: The Qilin data-leak site hosted on Tor features a QR code and hyperlink to the WikiLeaksV2 page

Figure 3: Domain registrations matching STAC4365 activity

Figure 5: A code display of the evilginx HTTP proxy and of the HTTP response that redirects non-phishing visits to the legitimate site—in this case, ScreenConnect

Figure 6: The phishing email received by the targeted administrator: New Login AlertYour ScreenConnect instance was recently logged into from a new IP address: Account ID: Domain: cloud.screenconnect.com Host User Name: IP Address: Location: Long Beach, California, United States Time: 2025/01/22 13:53:20 If you authorized this login, no further action is required. If you did not authorize this login attempt, please review the security alert checklist in documentation for further instructions. Login and review the security alert. ScreenConnect Team

Figure 7: A Windows log file displaying deployment of the attacker’s own ScreenConnect instance

Figure 8: a screenshot of log entries showing data compression via WinRAR

Figure 9: Exfiltration via EasyUpload.io shown in screenshot of activity log.

Figure 10: Telemetry showing the passwords appended to the ransomware as it was executed across different customers

Figure 11: The ransomware note dropped on victims’ computers by the Qilin ransomware

Threat Research – Sophos News
Stealing user credentials with evilginx 28 March 2025 at 02:29

Stealing user credentials with evilginx

Threat Research – Sophos News

28 March 2025 at 02:29

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope

Threat Research – Sophos News
The future of MFA is clear – but is it here yet? 20 March 2025 at 12:00

The future of MFA is clear – but is it here yet?

Threat Research – Sophos News

By:Chester Wisniewski

20 March 2025 at 12:00

Not all authentication is equal to the task in 2025, but there is a best choice within reach

A flow chart showing (simplified) WebAuthn authentication flow

Security Operations – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Security Operations – Sophos News

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

Security Operations – Sophos News
Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream 1 April 2025 at 05:30

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

Security Operations – Sophos News

By:gallagherseanm

1 April 2025 at 05:30

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A screenshot of the WikiLeaksV2 web site used by the Qilin RaaS group.

Figure 2: The Qilin data-leak site hosted on Tor features a QR code and hyperlink to the WikiLeaksV2 page

Figure 3: Domain registrations matching STAC4365 activity

Figure 5: A code display of the evilginx HTTP proxy and of the HTTP response that redirects non-phishing visits to the legitimate site—in this case, ScreenConnect

Figure 6: The phishing email received by the targeted administrator: New Login AlertYour ScreenConnect instance was recently logged into from a new IP address: Account ID: Domain: cloud.screenconnect.com Host User Name: IP Address: Location: Long Beach, California, United States Time: 2025/01/22 13:53:20 If you authorized this login, no further action is required. If you did not authorize this login attempt, please review the security alert checklist in documentation for further instructions. Login and review the security alert. ScreenConnect Team

Figure 7: A Windows log file displaying deployment of the attacker’s own ScreenConnect instance

Figure 8: a screenshot of log entries showing data compression via WinRAR

Figure 9: Exfiltration via EasyUpload.io shown in screenshot of activity log.

Figure 10: Telemetry showing the passwords appended to the ransomware as it was executed across different customers

Figure 11: The ransomware note dropped on victims’ computers by the Qilin ransomware

Security Operations – Sophos News
Stealing user credentials with evilginx 28 March 2025 at 02:29

Stealing user credentials with evilginx

Security Operations – Sophos News

28 March 2025 at 02:29

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope