Entrar
Dissecting a PHP web server rootkit
Sophos X-Ops takes a deep dive into an insidious piece of malware
Visualização de leitura
Ungentlemanly behavior: Insights into a ransomware operation
Analysis of 15 intrusions revealed tradecraft used by GOLD SHERWOOD affiliates
A call for collective action on cyber defense
Sophos joins organizations worldwide in supporting a coordinated and responsible approach to cyber defense.
The State of Ransomware in Education 2026
Insights from 226 IT and cybersecurity leaders across the education sector in 17 countries whose organizations were hit by ransomware in the past year.
Sophos Ranked #1 Overall in Endpoint, XDR, MDR, and Firewall in the G2 Fall 2026 Reports
Sophos is the only vendor recognized as a Leader across all five of these core cybersecurity markets.
Fake AI, real malware: Attackers impersonating AI brands
A year of MDR casework shows attackers repeatedly exploiting demand for AI tools
A heap of overflow in August’s Patch Tuesday haul
421 CVEs, a relatively small set of Edge patches, and two spicy stragglers
Hunting the Undead: Accelerating NetNTLMv1 Lookups Without GPUs
Outdated protocols, forgotten configurations, and legacy dependencies continue to create opportunities for attackers in modern environments. This research explores how NetNTLMv1 can still be leveraged today and how improvements in attack tooling are reducing the cost and complexity of exploiting it.
Reviving the Undead: Accelerating NetNTLMv1 Lookups Without GPUs
Outdated protocols, forgotten configurations, and legacy dependencies continue to create opportunities for attackers in modern environments. This research explores how NetNTLMv1 can still be leveraged today and how improvements in attack tooling are reducing the cost and complexity of exploiting it.
Abuse of alternative runtime environments Deno-tes defender headaches
Attack TTPs combine fileless execution, wide LOLBin use
ClickFix campaign abuses Deno runtime for infostealer delivery
Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer
Sophos Working with OpenAI on security from AI, with AI, and for AI
Sophos to bring OpenAI’s frontier models to the channel and managed service providers in newly announced partnership
Sophos DNS Protection update for GenAI
New Generative AI category is now available in DNS filtering policy and reporting.
N-able N-central exploitation results in RMM tool deployment
After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access
Interlock ransomware gang creates volatile situation
Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion specialists
When AI doesn’t know the target is real
The follow-up to the Hugging Face breach is a disclosure from Anthropic
Three-headed dogs and long tails: Sophos at BSides LV
Data scientists from the Sophos AI team will present two research talks at BSides Las Vegas
Secure by Design in practice: a year of progress on Sophos Firewall
One year on from our last Secure by Design update, we’re changing the format: deeper, per-product updates. First up: the firewall.
Chaos in Teams vishing
Attackers used Microsoft Teams vishing, custom malware, and remote access tools to facilitate ransomware deployment
