#sophosxops — Public Fediverse posts

Sophos AI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophos-ai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #commandline #SophosXOps #blackhat #FEATURED #BlackHat #featured #LLM #AI

Sophos AI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophos-ai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #commandline #SophosXOps #blackhat #FEATURED #BlackHat #featured #LLM #AI

Sophos AI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophos-ai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #commandline #SophosXOps #blackhat #FEATURED #BlackHat #featured #LLM #AI

GOLD BLADE Remote DLL Sideloading Attack Deploys RedLoader – Source: news.sophos.com https://ciso2ciso.com/gold-blade-remote-dll-sideloading-attack-deploys-redloader-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DLLsideloading #ThreatResearch #nakedsecurity #nakedsecurity #Cybercrime #SophosXOps #GOLDBLADE #RedLoader #FEATURED #featured #WebDAV #webdav #LNK #lnk

GOLD BLADE Remote DLL Sideloading Attack Deploys RedLoader – Source: news.sophos.com https://ciso2ciso.com/gold-blade-remote-dll-sideloading-attack-deploys-redloader-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DLLsideloading #ThreatResearch #nakedsecurity #nakedsecurity #Cybercrime #SophosXOps #GOLDBLADE #RedLoader #FEATURED #featured #WebDAV #webdav #LNK #lnk

GOLD BLADE Remote DLL Sideloading Attack Deploys RedLoader – Source: news.sophos.com https://ciso2ciso.com/gold-blade-remote-dll-sideloading-attack-deploys-redloader-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DLLsideloading #ThreatResearch #nakedsecurity #nakedsecurity #Cybercrime #SophosXOps #GOLDBLADE #RedLoader #FEATURED #featured #WebDAV #webdav #LNK #lnk

Sophos’ Secure by Design 2025 Progress – Source: news.sophos.com https://ciso2ciso.com/sophos-secure-by-design-2025-progress-source-news-sophos-com/ #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #securebydesign #SecurebyDesign #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #CISA

Sophos’ Secure by Design 2025 Progress – Source: news.sophos.com https://ciso2ciso.com/sophos-secure-by-design-2025-progress-source-news-sophos-com/ #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #securebydesign #SecurebyDesign #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #CISA

Sophos’ Secure by Design 2025 Progress – Source: news.sophos.com https://ciso2ciso.com/sophos-secure-by-design-2025-progress-source-news-sophos-com/ #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #securebydesign #SecurebyDesign #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #CISA

Small world: The revitalization of small AI models for cybersecurity – Source: news.sophos.com https://ciso2ciso.com/small-world-the-revitalization-of-small-ai-models-for-cybersecurity-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #smallmodels #SophosXOps #FEATURED #SophosAI #featured #LLM

Small world: The revitalization of small AI models for cybersecurity – Source: news.sophos.com https://ciso2ciso.com/small-world-the-revitalization-of-small-ai-models-for-cybersecurity-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #smallmodels #SophosXOps #FEATURED #SophosAI #featured #LLM

Small world: The revitalization of small AI models for cybersecurity – Source: news.sophos.com https://ciso2ciso.com/small-world-the-revitalization-of-small-ai-models-for-cybersecurity-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #smallmodels #SophosXOps #FEATURED #SophosAI #featured #LLM

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild – Source: news.sophos.com https://ciso2ciso.com/sharepoint-toolshell-vulnerabilities-being-exploited-in-the-wild-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SharePoint #SophosXOps #sharepoint #ToolShell #toolshell #FEATURED #featured #mdr #MDR

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild – Source: news.sophos.com https://ciso2ciso.com/sharepoint-toolshell-vulnerabilities-being-exploited-in-the-wild-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SharePoint #SophosXOps #sharepoint #ToolShell #toolshell #FEATURED #featured #mdr #MDR

SharePoint ‘ToolShell’ vulnerabilities being exploited in the wild – Source: news.sophos.com https://ciso2ciso.com/sharepoint-toolshell-vulnerabilities-being-exploited-in-the-wild-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SharePoint #SophosXOps #sharepoint #ToolShell #toolshell #FEATURED #featured #mdr #MDR

SophosAI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophosai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #blackhat2025 #SophosXOps #FEATURED #SophosAI #featured #LLM

SophosAI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophosai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #blackhat2025 #SophosXOps #FEATURED #SophosAI #featured #LLM

SophosAI at Black Hat USA ’25: Anomaly detection betrayed us, so we gave it a new job – Source: news.sophos.com https://ciso2ciso.com/sophosai-at-black-hat-usa-25-anomaly-detection-betrayed-us-so-we-gave-it-a-new-job-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #anomalydetection #ThreatResearch #nakedsecurity #nakedsecurity #blackhat2025 #SophosXOps #FEATURED #SophosAI #featured #LLM

The strange tale of ischhfd83: When cybercriminals eat their own – Source: news.sophos.com https://ciso2ciso.com/the-strange-tale-of-ischhfd83-when-cybercriminals-eat-their-own-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #lummastealer #SophosXOps #AsyncRAT #backdoor #FEATURED #asyncrat #Backdoor #featured

The strange tale of ischhfd83: When cybercriminals eat their own – Source: news.sophos.com https://ciso2ciso.com/the-strange-tale-of-ischhfd83-when-cybercriminals-eat-their-own-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #lummastealer #SophosXOps #AsyncRAT #backdoor #FEATURED #asyncrat #Backdoor #featured

The strange tale of ischhfd83: When cybercriminals eat their own – Source: news.sophos.com https://ciso2ciso.com/the-strange-tale-of-ischhfd83-when-cybercriminals-eat-their-own-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #lummastealer #SophosXOps #AsyncRAT #backdoor #FEATURED #asyncrat #Backdoor #featured

PJobRAT makes a comeback, takes another crack at chat apps – Source: news.sophos.com https://ciso2ciso.com/pjobrat-makes-a-comeback-takes-another-crack-at-chat-apps-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #MobileMalware #nakedsecurity #mobilemalware #nakedsecurity #SophosXOps #FEATURED #featured #Android #PJobRAT #pjobrat #Taiwan

PJobRAT makes a comeback, takes another crack at chat apps – Source: news.sophos.com https://ciso2ciso.com/pjobrat-makes-a-comeback-takes-another-crack-at-chat-apps-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #MobileMalware #nakedsecurity #mobilemalware #nakedsecurity #SophosXOps #FEATURED #featured #Android #PJobRAT #pjobrat #Taiwan

PJobRAT makes a comeback, takes another crack at chat apps – Source: news.sophos.com https://ciso2ciso.com/pjobrat-makes-a-comeback-takes-another-crack-at-chat-apps-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #MobileMalware #nakedsecurity #mobilemalware #nakedsecurity #SophosXOps #FEATURED #featured #Android #PJobRAT #pjobrat #Taiwan

Update: Cybercriminals still not fully on board the AI train (yet) – Source: news.sophos.com https://ciso2ciso.com/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #socialengineering #Socialengineering #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #ChatGPT #Scams #scams #AI

Update: Cybercriminals still not fully on board the AI train (yet) – Source: news.sophos.com https://ciso2ciso.com/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #socialengineering #Socialengineering #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #ChatGPT #Scams #scams #AI

Update: Cybercriminals still not fully on board the AI train (yet) – Source: news.sophos.com https://ciso2ciso.com/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #socialengineering #Socialengineering #cybercrimeforums #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #FEATURED #featured #ChatGPT #Scams #scams #AI

A year ago, Sophos X-Ops published our research into threat actor attitudes towards AI. We went into the underground forums to see what they were saying about AI.
At the time, we found threat actors were skeptical, grappling with the same issues, problems, and concerns everyone was.
A year later, we've returned to see what, if anything has changed. Overall, we've seen a slight shift, but the song remains the same overall: skeptical.
Get more details in our latest report here:

https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet/
#sophosxops #threatintel #ai

A year ago, Sophos X-Ops published our research into threat actor attitudes towards AI. We went into the underground forums to see what they were saying about AI.
At the time, we found threat actors were skeptical, grappling with the same issues, problems, and concerns everyone was.
A year later, we've returned to see what, if anything has changed. Overall, we've seen a slight shift, but the song remains the same overall: skeptical.
Get more details in our latest report here:

https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet/
#sophosxops #threatintel #ai

A year ago, Sophos X-Ops published our research into threat actor attitudes towards AI. We went into the underground forums to see what they were saying about AI.
At the time, we found threat actors were skeptical, grappling with the same issues, problems, and concerns everyone was.
A year later, we've returned to see what, if anything has changed. Overall, we've seen a slight shift, but the song remains the same overall: skeptical.
Get more details in our latest report here:

https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet/
#sophosxops #threatintel #ai

A year ago, Sophos X-Ops published our research into threat actor attitudes towards AI. We went into the underground forums to see what they were saying about AI.
At the time, we found threat actors were skeptical, grappling with the same issues, problems, and concerns everyone was.
A year later, we've returned to see what, if anything has changed. Overall, we've seen a slight shift, but the song remains the same overall: skeptical.
Get more details in our latest report here:

https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fully-on-board-the-ai-train-yet/
#sophosxops #threatintel #ai

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SophosXOps #patching #CVSS

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SophosXOps #patching #CVSS

Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #PatchTuesday #SophosXOps #patching #CVSS

Continue getting ready for the new year with part two of our two part series on “Patch Prioritization.”.

Here we go into #EPSS, #SSVC, #KEV, and other tools and frameworks.

https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks

#sophosxops #threatintelligence #patching #patchprioritization

Continue getting ready for the new year with part two of our two part series on “Patch Prioritization.”.

Here we go into #EPSS, #SSVC, #KEV, and other tools and frameworks.

https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks

#sophosxops #threatintelligence #patching #patchprioritization

Continue getting ready for the new year with part two of our two part series on “Patch Prioritization.”.

Here we go into #EPSS, #SSVC, #KEV, and other tools and frameworks.

https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks

#sophosxops #threatintelligence #patching #patchprioritization

Continue getting ready for the new year with part two of our two part series on “Patch Prioritization.”.

Here we go into #EPSS, #SSVC, #KEV, and other tools and frameworks.

https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks

#sophosxops #threatintelligence #patching #patchprioritization

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #patching #CVSS

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #patching #CVSS

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS – Source: news.sophos.com https://ciso2ciso.com/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss-source-news-sophos-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #SophosXOps #patching #CVSS

Get ready for the new year by taking time to better understand how to prioritize your patching.

Read understanding #CVSS part one of our two part series on “Patch Prioritization.”.

https://news.sophos.com/en-us/2024/12/27/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss/

#sophosxops #threatintelligence #patching #patchprioritization

Get ready for the new year by taking time to better understand how to prioritize your patching.

Read understanding #CVSS part one of our two part series on “Patch Prioritization.”.

https://news.sophos.com/en-us/2024/12/27/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss/

#sophosxops #threatintelligence #patching #patchprioritization

Get ready for the new year by taking time to better understand how to prioritize your patching.

Read understanding #CVSS part one of our two part series on “Patch Prioritization.”.

https://news.sophos.com/en-us/2024/12/27/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss/

#sophosxops #threatintelligence #patching #patchprioritization

Get ready for the new year by taking time to better understand how to prioritize your patching.

Read understanding #CVSS part one of our two part series on “Patch Prioritization.”.

https://news.sophos.com/en-us/2024/12/27/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss/

#sophosxops #threatintelligence #patching #patchprioritization

Additionally, case data reveals a 3-week delay before Akira posts victim information on their leaksite. Research indicates 127 victims have been posted to their leak site over the last 6 months. Sophos X-Ops is tracking 2 active Akira threat clusters (STAC5881, STAC5397), with the STAC5397 also deploying Fog ransomware. We commonly observe them leveraging PsExec, Advanced IP Scanner, SoftPerfect Network Scanner, 7-zip, Rclone, AnyDesk, WinRAR, WInSCP and Filezilla software during intrusions.#Akira #ransomware #threatintel #Sophosxops

Additionally, case data reveals a 3-week delay before Akira posts victim information on their leaksite. Research indicates 127 victims have been posted to their leak site over the last 6 months. Sophos X-Ops is tracking 2 active Akira threat clusters (STAC5881, STAC5397), with the STAC5397 also deploying Fog ransomware. We commonly observe them leveraging PsExec, Advanced IP Scanner, SoftPerfect Network Scanner, 7-zip, Rclone, AnyDesk, WinRAR, WInSCP and Filezilla software during intrusions.#Akira #ransomware #threatintel #Sophosxops

Additionally, case data reveals a 3-week delay before Akira posts victim information on their leaksite. Research indicates 127 victims have been posted to their leak site over the last 6 months. Sophos X-Ops is tracking 2 active Akira threat clusters (STAC5881, STAC5397), with the STAC5397 also deploying Fog ransomware. We commonly observe them leveraging PsExec, Advanced IP Scanner, SoftPerfect Network Scanner, 7-zip, Rclone, AnyDesk, WinRAR, WInSCP and Filezilla software during intrusions.#Akira #ransomware #threatintel #Sophosxops

Additionally, case data reveals a 3-week delay before Akira posts victim information on their leaksite. Research indicates 127 victims have been posted to their leak site over the last 6 months. Sophos X-Ops is tracking 2 active Akira threat clusters (STAC5881, STAC5397), with the STAC5397 also deploying Fog ransomware. We commonly observe them leveraging PsExec, Advanced IP Scanner, SoftPerfect Network Scanner, 7-zip, Rclone, AnyDesk, WinRAR, WInSCP and Filezilla software during intrusions.#Akira #ransomware #threatintel #Sophosxops

Sophos X-Ops has just released a brand-new Active Adversary Report, covering the first six months of 2024 – a little light holiday reading, as one does. For the first time ever, data from MDR's customer-facing Incident Response team is fully incorporated with data from our dedicated Incident Response team. The result is our largest dataset ever, with 190 entries normalized across 63 fields.

Perhaps the most startling finding of all is that abuse of LOLbins was up, way up, in the first half of the year. The AAR analysis team thought it might be a hallucination brought on by ingesting all that MDR data but... it isn't. The report has details, including what (besides RDP) is getting a workout. (Spoiler: You name it. Some of these attackers are just odd.)

We worked on a great number of ransomware cases in 1H24, as you'd expect. What you might not expect is which ransomware brands were most often involved, especially if you follow the headlines about high-profile law-enforcement activities. The new report looks at how the scene shaped up after the February 2024 LockBit takedown and points out a data pattern that you might not have glimpsed in the usual day-to-day news coverage.

Finally, as AAR stands on the cusp of its sixth year of data (the first AAR was published in 2021, covering 2020 and the then-new IR team), we revisited some of our older investigations -- dwell time, time-to-Active-Directory, and many more. Updated information on these topics and many more is in the report. Enjoy!

https://news.sophos.com/en-us/2024/12/12/active-adversary-report-2024-12/

#threatintel #Sophosxops

Sophos X-Ops has just released a brand-new Active Adversary Report, covering the first six months of 2024 – a little light holiday reading, as one does. For the first time ever, data from MDR's customer-facing Incident Response team is fully incorporated with data from our dedicated Incident Response team. The result is our largest dataset ever, with 190 entries normalized across 63 fields.

Perhaps the most startling finding of all is that abuse of LOLbins was up, way up, in the first half of the year. The AAR analysis team thought it might be a hallucination brought on by ingesting all that MDR data but... it isn't. The report has details, including what (besides RDP) is getting a workout. (Spoiler: You name it. Some of these attackers are just odd.)

We worked on a great number of ransomware cases in 1H24, as you'd expect. What you might not expect is which ransomware brands were most often involved, especially if you follow the headlines about high-profile law-enforcement activities. The new report looks at how the scene shaped up after the February 2024 LockBit takedown and points out a data pattern that you might not have glimpsed in the usual day-to-day news coverage.

Finally, as AAR stands on the cusp of its sixth year of data (the first AAR was published in 2021, covering 2020 and the then-new IR team), we revisited some of our older investigations -- dwell time, time-to-Active-Directory, and many more. Updated information on these topics and many more is in the report. Enjoy!

https://news.sophos.com/en-us/2024/12/12/active-adversary-report-2024-12/

#threatintel #Sophosxops

Sophos X-Ops has just released a brand-new Active Adversary Report, covering the first six months of 2024 – a little light holiday reading, as one does. For the first time ever, data from MDR's customer-facing Incident Response team is fully incorporated with data from our dedicated Incident Response team. The result is our largest dataset ever, with 190 entries normalized across 63 fields.

Perhaps the most startling finding of all is that abuse of LOLbins was up, way up, in the first half of the year. The AAR analysis team thought it might be a hallucination brought on by ingesting all that MDR data but... it isn't. The report has details, including what (besides RDP) is getting a workout. (Spoiler: You name it. Some of these attackers are just odd.)

We worked on a great number of ransomware cases in 1H24, as you'd expect. What you might not expect is which ransomware brands were most often involved, especially if you follow the headlines about high-profile law-enforcement activities. The new report looks at how the scene shaped up after the February 2024 LockBit takedown and points out a data pattern that you might not have glimpsed in the usual day-to-day news coverage.

Finally, as AAR stands on the cusp of its sixth year of data (the first AAR was published in 2021, covering 2020 and the then-new IR team), we revisited some of our older investigations -- dwell time, time-to-Active-Directory, and many more. Updated information on these topics and many more is in the report. Enjoy!

https://news.sophos.com/en-us/2024/12/12/active-adversary-report-2024-12/

#threatintel #Sophosxops

Sophos X-Ops has just released a brand-new Active Adversary Report, covering the first six months of 2024 – a little light holiday reading, as one does. For the first time ever, data from MDR's customer-facing Incident Response team is fully incorporated with data from our dedicated Incident Response team. The result is our largest dataset ever, with 190 entries normalized across 63 fields.

Perhaps the most startling finding of all is that abuse of LOLbins was up, way up, in the first half of the year. The AAR analysis team thought it might be a hallucination brought on by ingesting all that MDR data but... it isn't. The report has details, including what (besides RDP) is getting a workout. (Spoiler: You name it. Some of these attackers are just odd.)

We worked on a great number of ransomware cases in 1H24, as you'd expect. What you might not expect is which ransomware brands were most often involved, especially if you follow the headlines about high-profile law-enforcement activities. The new report looks at how the scene shaped up after the February 2024 LockBit takedown and points out a data pattern that you might not have glimpsed in the usual day-to-day news coverage.

Finally, as AAR stands on the cusp of its sixth year of data (the first AAR was published in 2021, covering 2020 and the then-new IR team), we revisited some of our older investigations -- dwell time, time-to-Active-Directory, and many more. Updated information on these topics and many more is in the report. Enjoy!

https://news.sophos.com/en-us/2024/12/12/active-adversary-report-2024-12/

#threatintel #Sophosxops

Sophos X-Ops teams are monitoring and responding to attacks against Cleo products VLTrader, Harmony, and LexiCom prior to version 5.8.0.23 in each as outlined in this advisory: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending.

Sophos MDR and Labs teams can confirm seeing 50+ unique hosts targeted by these attacks at this time.

All observed impacted customers have a branch or operate within the North Americas, primarily the US. We note the majority of observed affected customers are retail organizations.

Sophos MDR threat hunting currently shows the first attack on 2024-12-06 at 17:47 UTC.

We will continue to monitor and provide updates as we have more information.

#Sophosxops #threatintel

Sophos X-Ops teams are monitoring and responding to attacks against Cleo products VLTrader, Harmony, and LexiCom prior to version 5.8.0.23 in each as outlined in this advisory: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending.

Sophos MDR and Labs teams can confirm seeing 50+ unique hosts targeted by these attacks at this time.

All observed impacted customers have a branch or operate within the North Americas, primarily the US. We note the majority of observed affected customers are retail organizations.

Sophos MDR threat hunting currently shows the first attack on 2024-12-06 at 17:47 UTC.

We will continue to monitor and provide updates as we have more information.

#Sophosxops #threatintel

Sophos X-Ops teams are monitoring and responding to attacks against Cleo products VLTrader, Harmony, and LexiCom prior to version 5.8.0.23 in each as outlined in this advisory: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending.

Sophos MDR and Labs teams can confirm seeing 50+ unique hosts targeted by these attacks at this time.

All observed impacted customers have a branch or operate within the North Americas, primarily the US. We note the majority of observed affected customers are retail organizations.

Sophos MDR threat hunting currently shows the first attack on 2024-12-06 at 17:47 UTC.

We will continue to monitor and provide updates as we have more information.

#Sophosxops #threatintel

Sophos X-Ops teams are monitoring and responding to attacks against Cleo products VLTrader, Harmony, and LexiCom prior to version 5.8.0.23 in each as outlined in this advisory: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending.

Sophos MDR and Labs teams can confirm seeing 50+ unique hosts targeted by these attacks at this time.

All observed impacted customers have a branch or operate within the North Americas, primarily the US. We note the majority of observed affected customers are retail organizations.

Sophos MDR threat hunting currently shows the first attack on 2024-12-06 at 17:47 UTC.

We will continue to monitor and provide updates as we have more information.

#Sophosxops #threatintel

From the frontlines: Our CISO’s view of Pacific Rim – Source: news.sophos.com https://ciso2ciso.com/from-the-frontlines-our-cisos-view-of-pacific-rim-source-news-sophos-com/ #PacificRimthoughtleadership #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #nakedsecurity #nakedsecurity #PacificRim #SophosXOps

Pacific Rim: What’s it to you? – Source: news.sophos.com https://ciso2ciso.com/pacific-rim-whats-it-to-you-source-news-sophos-com/ #PacificRimthoughtleadership #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #nakedsecurity #nakedsecurity #PacificRim #SophosXOps

From the frontlines: Our CISO’s view of Pacific Rim – Source: news.sophos.com https://ciso2ciso.com/from-the-frontlines-our-cisos-view-of-pacific-rim-source-news-sophos-com/ #PacificRimthoughtleadership #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #nakedsecurity #nakedsecurity #PacificRim #SophosXOps