Beyond the kill chain: What cybercriminals do with their money (Part 1)

May 20, 2025

A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist

Another adversary picks up the email bombing / vishing Storm-1811 playbook, doing thorough reconnaissance to target specific employees with fake help desk call—this time, over the phone.

Security OperationsThreat Research

May 15, 2025

Beyond the kill chain: What cybercriminals do with their money (Part 5)

In the last of our five-part series, Sophos X-Ops explores the implications and opportunities arising from threat actors’ involvement in real-world industries and crimes

Threat Research

May 15, 2025

Beyond the kill chain: What cybercriminals do with their money (Part 4)

In the fourth of our five-part series, Sophos X-Ops explores threat actors’ real-world criminal business interests

Threat Research

May 15, 2025

Beyond the kill chain: What cybercriminals do with their money (Part 3)

In the third of our five-part series, Sophos X-Ops explores the more legally and ethically dubious business interests of financially motivated threat actors

Threat Research

May 15, 2025

Beyond the kill chain: What cybercriminals do with their money (Part 2)

In the second of our five-part series, Sophos X-Ops investigates the so-called ‘white’ (legitimate) business interests of threat actors

Threat Research

May 08, 2025

NICKEL TAPESTRY expands fraudulent worker operations

The North Korean IT worker scheme grows to include organizations in Europe and Asia and industries beyond the technology sector

Security OperationsThreat Research

April 29, 2025

Finding Minhook in a sideloading attack – and Sweden too

Multifaceted changes in TTPs illustrate what researchers see when they start digging

Threat Research

April 17, 2025

Moving CVEs past one-nation control

A near-miss episode of attempted defunding spotlights a need for a better way

Security OperationsThreat Research

April 16, 2025

Sophos Annual Threat Report appendix: Most frequently encountered malware and abused software

These are the tools of the trade Sophos detected in use by cybercriminals over 2024

Security OperationsThreat Research