Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

The North Korean IT worker scheme grows to include organizations in Europe and Asia and industries beyond the technology sector

A near-miss episode of attempted defunding spotlights a need for a better way

These are the tools of the trade Sophos detected in use by cybercriminals over 2024

Ransomware remains the biggest threat, but old and misconfigured network devices are making it too easy

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope