Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.

Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward

Brace yourselves... and consider reading your email in plaintext for now

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar 

A sea change in available data fuels fresh insights from the first half of 2024

Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar 

A sea change in available data fuels fresh insights from the first half of 2024

Results from the latest ATT&CK Evaluations for endpoint detection and response solutions.

Sophos is the only vendor named a Customers’ Choice across Endpoint Protection Platforms, Network Firewalls, and Managed Detection and Response

Sophos MDR has observed a new campaign that uses targeted phishing to entice the target to download a legitimate remote machine management tool to dump credentials. We believe with moderate confidence that this activity, which we track as STAC 1171, is related to an Iranian threat actor commonly referred to as MuddyWater or TA450. The […]

Sophos X-Ops unveils five-year investigation tracking China-based groups targeting perimeter devices

After January’s deluge, a calmer update volume returns

The SVG file format can harbor malicious HTML, scripts, and malware

A year after our initial research on threat actors’ attitudes to generative AI, we revisit some underground forums and find that many cybercriminals are still skeptical – although there has been a slight shift