Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network

Not content with attacking retailers, this aggressive group is fighting a turf war with other ransomware operators

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

In the last of our five-part series, Sophos X-Ops explores the implications and opportunities arising from threat actors’ involvement in real-world industries and crimes

In the fourth of our five-part series, Sophos X-Ops explores threat actors’ real-world criminal business interests

In the third of our five-part series, Sophos X-Ops explores the more legally and ethically dubious business interests of financially motivated threat actors

In the second of our five-part series, Sophos X-Ops investigates the so-called ‘white’ (legitimate) business interests of threat actors

Sophos X-Ops investigates what financially motivated threat actors invest their ill-gotten profits in, once the dust has settled

Five issues actively exploited in the wild, but the real excitement may have been handled in advance

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s network

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

The North Korean IT worker scheme grows to include organizations in Europe and Asia and industries beyond the technology sector

A near-miss episode of attempted defunding spotlights a need for a better way

These are the tools of the trade Sophos detected in use by cybercriminals over 2024

Ransomware remains the biggest threat, but old and misconfigured network devices are making it too easy

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there’s hope