Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network

Not content with attacking retailers, this aggressive group is fighting a turf war with other ransomware operators

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

In the last of our five-part series, Sophos X-Ops explores the implications and opportunities arising from threat actors’ involvement in real-world industries and crimes

In the fourth of our five-part series, Sophos X-Ops explores threat actors’ real-world criminal business interests

In the third of our five-part series, Sophos X-Ops explores the more legally and ethically dubious business interests of financially motivated threat actors

In the second of our five-part series, Sophos X-Ops investigates the so-called ‘white’ (legitimate) business interests of threat actors

Sophos X-Ops investigates what financially motivated threat actors invest their ill-gotten profits in, once the dust has settled

Five issues actively exploited in the wild, but the real excitement may have been handled in advance

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive