Crimson Palace returns: New Tools, Tactics, and Targets 

August 07, 2024

Sophos MDR hunt tracks Mimic ransomware campaign against organizations in India

STAC6451 threat cluster targets Internet-exposed Microsoft SQL servers for initial access

Security Operations

August 07, 2024

Best security practices for ESXi environments

Ten recommendations for defenders when natively run EDR isn’t an option

Security OperationsThreat Research

June 12, 2024

RD Web Access abuse: Fighting back

Investigation insights and recommendations from a recent welter of incident-response cases

Security OperationsThreat Research

June 05, 2024

Operation Crimson Palace: A Technical Deep Dive

Security OperationsThreat Research

May 13, 2024

Extracting data from encrypted virtual disks: six seven methods

For incident responders, a variety of techniques for information retrieval from locked-up VMs

Security OperationsThreat Research

April 26, 2024

Malware campaign attempts abuse of defender binaries

Command-and-control wares try to sneak onto systems disguised as various vendors; payloads vary, but Sophos customers are protected

Security OperationsThreat Research

March 20, 2024

Remote Desktop Protocol: The Series

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Security OperationsThreat Research

March 20, 2024

Remote Desktop Protocol: Exposed RDP (is dangerous)

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data answers, loud and clear

Security Operations

March 20, 2024

Remote Desktop Protocol: Queries for Investigation

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits

Security Operations