Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-05-07 ⋅ Sophos ⋅ Chaitanya Ghorpade, Gabor Szappanos, Matt Wixey, Rahil Shah, Rahul Dugar
Donuts and Beagles: Fake Claude site spreads backdoor
TriBack Loader
2023-05-03 ⋅ Sophos ⋅ Andrew Brandt, Gabor Szappanos, Xinran Wu
A doubled “Dragon Breath” adds new air to DLL sideloading attacks
Ghost RAT DragonBreath
2023-03-09 ⋅ Sophos ⋅ Gabor Szappanos
A border-hopping PlugX USB worm takes its act on the road
PlugX
2022-11-03 ⋅ Sophos ⋅ Gabor Szappanos
Family Tree: DLL-Sideloading Cases May Be Related
DARKDEW MISTCLOAK
2022-07-20 ⋅ Sophos ⋅ Colin Cowie, Gabor Szappanos
OODA: X-Ops Takes On Burgeoning SQL Server Attacks
Maoloa Remcos TargetCompany
2022-02-01 ⋅ Sophos ⋅ Gabor Szappanos, Sean Gallagher
SolarMarker campaign used novel registry changes to establish persistence
solarmarker
2021-11-18 ⋅ Sophos ⋅ Elida Leite, Ferenc László Nagy, Gabor Szappanos, Harinder Bhathal, Kyle Link, Nirav Parekh, Rahul Dugar, Ratul Ghosh, Robert Weiland, Sean Gallagher, Sergio Bestuilic, Vikas Singh
New ransomware actor uses password-protected archives to bypass encryption protection
2021-09-03 ⋅ Sophos ⋅ Anand Ajjan, Andrew Ludgate, Gabor Szappanos, Peter Mackenzie, Sean Gallagher, Sergio Bestulic, Syed Zaidi
Conti affiliates use ProxyShell Exchange exploit in ransomware attacks
Cobalt Strike Conti
2021-08-12 ⋅ Sophos ⋅ Andrew Brandt, Gabor Szappanos
Gootloader’s “mothership” controls malicious content
GootLoader
2021-05-11 ⋅ Sophos ⋅ Ferenc László Nagy, Gabor Szappanos, Mark Loman, Peter Mackenzie, Sean Gallagher, Suriya Natarajan, Szabolcs Lévai, Yusuf Arslan Polat
A defender’s view inside a DarkSide ransomware attack
DarkSide
2021-05-05 ⋅ SophosLabs Uncut ⋅ Andrew Brandt, Gabor Szappanos, Peter Mackenzie, Vikas Singh
Intervention halts a ProxyLogon-enabled attack
Cobalt Strike
2021-03-01 ⋅ Sophos Labs ⋅ Andrew Brandt, Gabor Szappanos
“Gootloader” expands its payload delivery options
GootKit
2021-01-21 ⋅ Sophos Labs ⋅ Andrew Brandt, Gabor Szappanos
MrbMiner: Cryptojacking to bypass international sanctions
2020-12-08 ⋅ Sophos ⋅ Anand Aijan, Bill Kearney, Gabor Szappanos, Mark Loman, Peter Mackenzie, Sean Gallagher, Sergio Bestulic, Syed Shahram
Egregor ransomware: Maze’s heir apparent
Egregor Maze
2020-11-04 ⋅ Sophos ⋅ Gabor Szappanos
A new APT uses DLL side-loads to “KilllSomeOne”
KilllSomeOne PlugX
2020-10-28 ⋅ SophosLabs Uncut ⋅ Anand Ajjan, Bill Kearny, Brett Cove, Elida Leite, Gabor Szappanos, Peter Mackenzie, Sean Gallagher, Syed Shahram
Hacks for sale: inside the Buer Loader malware-as-a-service
Buer Ryuk Zloader
2020-06-09 ⋅ Sophos Labs ⋅ Gabor Szappanos, Vikas Singh
Kingminer escalates attack complexity for cryptomining
Kingminer
2020-06-01 ⋅ Sophos Labs ⋅ Gabor Szappanos, Vikas Singh
THE INCREASINGLY COMPLEX KINGMINER BOTNET
Kingminer
2020-05-27 ⋅ SophosLabs ⋅ Andrew Brandt, Gabor Szappanos
Netwalker ransomware tools give insight into threat actor
Mailto
2019-12-18 ⋅ Sophos ⋅ Gabor Szappanos
MyKings: The slow but steady growth of a relentless botnet
MyKings Spreader
2016-07-01 ⋅ Virus Bulletin ⋅ Gabor Szappanos
New Keylogger on the Block
KeyBase
2014-06-27 ⋅ SophosLabs ⋅ Gabor Szappanos
PlugX - The Next Generation
PlugX
2014-02-03 ⋅ Virus Bulletin ⋅ Gabor Szappanos
Needle in a haystack
Evasive Panda