June 07, 2022

The Active Adversary Playbook 2022

Cyberattacker behaviors, tactics and tools seen on the frontline of incident response during 2021

Security Operations

May 30, 2022

‘Follina’ Word doc taps previously unknown Microsoft Office vulnerability

MSDT.exe misuse in May makes for Memorial Day Monday mayhem

Threat Research

March 30, 2022

Second vulnerability in Spring Cloud casts shadow on popular Java framework

SophosLabs IPS signature available to detect and block issue under exploit

Security Operations

February 02, 2022

Log4Shell: How the Attackers’ Faces Have Changed Over Time

Following an article on January 24, 2022 of Log4Shell scanning and attack detections since the bug was reported, Sophos addresses reader questions about who’s behind it all

Security Operations

January 24, 2022

Log4Shell: No Mass Abuse, But No Respite, What Happened?

Sophos reviews the scanning and attack detections for Log4Shell to see what's really going on

Security Operations

August 23, 2021

ProxyShell vulnerabilities in Microsoft Exchange: What to do

The vulnerabilities lie in the Microsoft Client Access Service (CAS), which is commonly exposed to the public internet. This exposure has led to widespread exploitation by threat actors.

Security Operations

July 22, 2021

HiveNightmare aka SeriousSAM vulnerability : what to do

Security Operations

July 01, 2021

PrintNightmare vulnerability: what to do

Products & Services

May 06, 2021

Using Sophos EDR to identify endpoints impacted by Dell kernel driver vulnerability CVE-2021-21551

Use this query to identify which endpoints have the file associated with CVE-2021-21551, and which do not.

Products & Services