Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2022-06-16 ⋅ SophosLabs Uncut ⋅ Andrew Brandt
Confluence exploits used to drop ransomware on vulnerable servers
Cerber
2022-06-15 ⋅ Volexity ⋅ Steven Adair, Thomas Lancaster, Volexity Threat Research
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
pupy Sliver DriftingCloud
2022-05-04 ⋅ Sophos ⋅ Andreas Klopsch
Attacking Emotet’s Control Flow Flattening
Emotet
2022-04-12 ⋅ Sophos ⋅ Andrew Brandt, Angela Gunn, Ferenc László Nagy, Johnathan Fern, Linda Smith, Matthew Everts, Mauricio Valdivieso, Melissa Kelly, Peter Mackenzie, Sergio Bestulic
Attackers linger on government agency computers before deploying Lockbit ransomware
LockBit
2022-03-17 ⋅ Sophos ⋅ Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-02-28 ⋅ Sophos ⋅ Sean Gallagher
Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits
Conti Karma
2022-02-23 ⋅ SophosLabs Uncut ⋅ Andrew Brandt
Dridex bots deliver Entropy ransomware in recent attacks
Cobalt Strike Dridex Entropy
2022-02-23 ⋅ Sophos ⋅ Abhijit Gupta, Anand Ajjan, Andrew Brandt, Colin Cowie, Felix Weyne, Rahil Shah, Steven Lott, Syed Zaidi, Vikas Singh, Xiaochuan Zhang
Dridex bots deliver Entropy ransomware in recent attacks
Entropy
2022-02-22 ⋅ Sophos ⋅ Chester Wisniewski
Cyberthreats during Russian-Ukrainian tensions: what can we learn from history to be prepared?
Conti
2022-02-15 ⋅ Sophos ⋅ Matthew Everts, Stephen McNally
Vulnerable Exchange server hit by Squirrelwaffle and financial fraud
Squirrelwaffle
2022-02-01 ⋅ Sophos ⋅ Gabor Szappanos, Sean Gallagher
SolarMarker campaign used novel registry changes to establish persistence
solarmarker
2022-01-25 ⋅ Sophos ⋅ Andrew Brandt
Windows services lay the groundwork for a Midas ransomware attack
Midas
2022-01-25 ⋅ Sophos ⋅ Andrew Brandt, Jason Jenkins
Windows services lay the groundwork for a Midas ransomware attack
2022-01-24 ⋅ Sophos ⋅ Chester Wisniewski
Log4Shell: No Mass Abuse, But No Respite, What Happened?
2022-01-19 ⋅ Sophos ⋅ Colin Cowie, Mat Gangwer, Sophos MTR Team, Stan Andic
Zloader Installs Remote Access Backdoors and Delivers Cobalt Strike
Cobalt Strike Zloader
2021-12-22 ⋅ Sophos ⋅ Anand Ajjan, Andrew Brandt, Ferenc László Nagy, Fraser Howard, Peter Mackenzie, Sergio Bestulic, Timothy Easton
Avos Locker remotely accesses boxes, even running in Safe Mode
AvosLocker
2021-12-21 ⋅ Sophos ⋅ Andrew Brandt, Stephen Ormandy
Attackers test “CAB-less 40444” exploit in a dry run
2021-12-20 ⋅ Sophos ⋅ Sean Gallagher
Logjam: Log4j exploit attempts continue in globally distributed scans, attacks
2021-12-17 ⋅ Sophos ⋅ Hardik Shah, Sean Gallagher
Inside the code: How the Log4Shell exploit works
2021-12-12 ⋅ Sophos ⋅ Sean Gallagher
Log4Shell Hell: anatomy of an exploit outbreak