One actively exploited issue patched; five Critical-severity Office vulns exploitable via Preview Pane

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope

Sophos X-Ops uncovers a recent campaign from an Android RAT first seen in 2019 – now infecting users in Taiwan

Not all authentication is equal to the task in 2025, but there is a best choice within reach

Just 57 CVEs to contend with (plus advisories), but six are already under exploit in the wild

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope

At a conference in Boston, the nation’s scientists commiserated and strategized as funding cuts and federal layoffs throw their world into turmoil.

© Olivier Douliery/Agence France-Presse — Getty Images

Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar 

A sea change in available data fuels fresh insights from the first half of 2024

Sophos MDR has observed a new campaign that uses targeted phishing to entice the target to download a legitimate remote machine management tool to dump credentials. We believe with moderate confidence that this activity, which we track as STAC 1171, is related to an Iranian threat actor commonly referred to as MuddyWater or TA450. The […]

Last month, Sophos X-Ops reported several MDR cases where threat actors exploited a vulnerability in Veeam backup servers. We continue to track the activities of this threat cluster, which recently included deployment of a new ransomware. The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881. Attacks leveraged compromised […]

The Internet is full of cats—and in this case, malware-delivering fake cat websites used for very targeted search engine optimization.

Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.

Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward

Brace yourselves... and consider reading your email in plaintext for now