Login
DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
27 May 2025 at 05:00
Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network
Normal view
Received before yesterday
-
Threat Research – Sophos News
- DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
DragonForce targets rivals in a play for dominance
21 May 2025 at 08:00
Not content with attacking retailers, this aggressive group is fighting a turf war with other ransomware operators
-
- A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
20 May 2025 at 12:30
Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.
-
- Beyond the kill chain: What cybercriminals do with their money (Part 1)
Beyond the kill chain: What cybercriminals do with their money (Part 1)
15 May 2025 at 07:00
Sophos X-Ops investigates what financially motivated threat actors invest their ill-gotten profits in, once the dust has settled
Microsoft primes 71 fixes for May Patch Tuesday
14 May 2025 at 10:26
Five issues actively exploited in the wild, but the real excitement may have been handled in advance
Lumma Stealer, coming and going
9 May 2025 at 04:12
The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive
-
- DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
27 May 2025 at 05:00
Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network
-
- A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist
20 May 2025 at 12:30
Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.
Lumma Stealer, coming and going
9 May 2025 at 04:12
The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive
NICKEL TAPESTRY expands fraudulent worker operations
8 May 2025 at 11:45
The North Korean IT worker scheme grows to include organizations in Europe and Asia and industries beyond the technology sector
Moving CVEs past one-nation control
17 April 2025 at 15:57
A near-miss episode of attempted defunding spotlights a need for a better way
The Sophos Annual Threat Report: Cybercrime on Main Street 2025
16 April 2025 at 05:00
Ransomware remains the biggest threat, but old and misconfigured network devices are making it too easy
It takes two: The 2025 Sophos Active Adversary Report
2 April 2025 at 05:01
The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you
-
- Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream
Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream
1 April 2025 at 05:30
Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.
February Patch Tuesday delivers 57 packages
11 February 2025 at 14:17
After January’s deluge, a calmer update volume returns
Scalable Vector Graphics files pose a novel phishing threat
5 February 2025 at 11:01
The SVG file format can harbor malicious HTML, scripts, and malware
Update: Cybercriminals still not fully on board the AI train (yet)
28 January 2025 at 07:00
A year after our initial research on threat actors’ attitudes to generative AI, we revisit some underground forums and find that many cybercriminals are still skeptical – although there has been a slight shift
