Cybersecurity

In this blogpost, we uncover the first known cases of collaboration between Gamaredon and Turla, in Ukraine. Key points of this blogpost: In February 2025, we discovered that the Gamaredon tool PteroGraphin was used...
Well, one of them is, but what's important is that we now have a platform on which we can start pushing out a lot...

GOLD SALEM’s Warlock operation joins busy ransomware landscape – Sophos News

Counter Threat Unit™ (CTU) researchers are monitoring a threat group that refers to itself as Warlock Group. The group, which CTU™ researchers track as...

TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks

The threat actor known as TA558 has been attributed to a fresh set of attacks delivering various remote access trojans (RATs) like Venom RAT...

NICKEL TAPESTRY expands fraudulent worker operations – Sophos News

With this post, the X-Ops blog is thrilled to present research from our Sophos siblings newly joining us from Secureworks, of which CTU (the...

Malicious MCP servers used in supply chain attacks

Introduction In this article, we explore how the Model Context Protocol (MCP) — the new “plug-in bus” for AI assistants — can be weaponized as...

Web Searches For Archives – SANS Internet Storm Center

Johannes wrote a diary entry "Increasing Searches for ZIP Files" where he analyzed the increase of requests for ZIP files (like backup.zip, web.zip, ...)...

Grifter – Darknet Diaries

Full Transcript Grifter is a longtime hacker, DEF CON organizer, and respected voice in the infosec community. From his early days...

Are cybercriminals hacking your systems – or just logging in?

As bad actors often simply waltz through companies’ digital front doors with...

Troy Hunt: Weekly Update 468

I only just realised, as I prepared this accompanying blog post, that...

September Patch Tuesday handles 81 CVEs – Sophos News

.Microsoft on Tuesday announced 81 patches affecting 15 product families. Nine of the addressed issues are considered by Microsoft to be of Critical severity,...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Sep 10, 2025Ravie LakshmananVulnerability / Software Security Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if...

Lumma Stealer, coming and going – Sophos News

In September 2024, a threat hunt across Sophos Managed Detection and Response’s telemetry uncovered a Lumma Stealer campaign using fake CAPTCHA sites that instructed...

Mobile cyberthreat report for Q2 2025

IT threat evolution in Q2 2025. Mobile statisticsIT threat evolution in Q2 2025. Non-mobile statistics The mobile section of our quarterly cyberthreat report includes statistics...

Recent articles