August 26, 2025

Velociraptor incident response tool abused for remote access

This approach represents an evolution from threat actors abusing remote monitoring and management tools

Threat Research

August 20, 2025

Threat Intelligence Executive Report – Volume 2025, Number 4

This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during May and June

Threat Research

August 13, 2025

August Patch Tuesday includes blasts from the (recent) past

Microsoft haul this month covers 109 CVEs… more or less

Threat Research

August 07, 2025

Sophos AI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job

Following on from our preview, here's Ben Gelman and Sean Bergeron's research on enhancing command line classification with benign anomalous data

Threat Research

August 06, 2025

Shared secret: EDR killer in the kill chain

A look under the hood at a tool designed to disable protections

Threat Research

July 29, 2025

GOLD BLADE remote DLL sideloading attack deploys RedLoader

Attacks surged in July 2025 after the threat group updated its process to combine malicious LNK files and a recycled WebDAV technique

Threat Research

July 23, 2025

Small world: The revitalization of small AI models for cybersecurity

Sophos X-Ops explores why larger isn’t always better when it comes to solving security challenges with AI

Threat Research

July 21, 2025

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild

Sophos X-Ops sees exploitation across multiple customer estates

Threat Research

July 14, 2025

SophosAI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job

Sophos’ Ben Gelman and Sean Bergeron will present their research on enhancing command line classification with benign anomalous data at Las Vegas

Threat Research