iiinova — where your digital self keeps evolving

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/10/2026

For the fourth year running, Sophos AI will share new research at CAMLIS. Next Friday (23/10), Senior AI/ML Engineer Tamás Nyiri will lead a poster session entitled “Show, Don’t Tell: Calibrating Agentic SOC Analysts via Hierarchical Evidence Graphs.” SOCs increasingly use AI agents to […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 25/09/2026

Every cyber defence assumes there's time to check: That's how it's always worked.... Verify the face, vet the hire, patch the flaw. In 2026, AI took that time away... We made a video on how that happened: www.youtube.com/watch?v=k9uTWVpjO8o… #infosec #cybersecurity #AI

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 07/09/2026

Sophos X-Ops took a deep dive into a PHP web server rootkit associated with compromised BIG-IP APM environments that use Apache and PHP components. The malware uses custom ELF loading, function hooking, and runtime code patching. The implant delivers on-demand server-side code execution […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 19/08/2026

Sophos X-Ops recently reviewed a year’s worth of cases tagged as AI activity. Of the confirmed adversarial AI cases, nearly all involved fake versions of legitimate AI sites and software used to infect users with malware. AI software impersonation accounted for 30 of 38 cases. Fake AI installer […]

infosec.exchange

Original post on infosec.exchange

001 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/08/2026

A threat actor talked commercial AI models past their guardrails, then stood up a "company" of AI agents that engineered, tested and refined malware. We break down exactly how they did it. New episode of The X-Ops Brief 👇 youtu.be/IG0BOSrknqw?si=SzYAXAU01wt…

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 31/07/2026

Data scientists from the Sophos AI team will be presenting new research at BSides Las Vegas next week, in two talks: one on a three-headed dog, and the other on long tails… First up, on Monday, a talk on ‘CerBERTus’ - a three-headed BERT-based model for prompt security. Rather than treating […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/07/2026

A lot of what's written about AI and cyberattacks is hype, or unverifiable. Our new AI report gives a detailed look at how attackers are actually operating: 🔷 Moving beyond experimentation to operationalize AI for attacks 🔷 Compressing attack timelines, turning weeks of manual work into days 🔷 […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 09/07/2026

How Do You Get Hacked With Zero Malware? WantToCry brute forces exposed SMB shares, steals your files, encrypts them on the attacker's infrastructure, then writes them back. We walk through the attack step by step 👇 youtu.be/YWSefucL0W8

120 2

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 30/06/2026

Conversations about ‘AI threats’ typically collapse into one of two extremes – on the one hand, hype and unverified claims; on the other, dismissal: it’s just old tradecraft with new branding. The truth is probably somewhere in between. Threat actors are using and experimenting with AI in […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/06/2026

At the NorthSec conference last month, Sophos Principal Data Scientist François Labrèche presented research addressing one of the biggest problems facing modern SOCs: alert fatigue. François proposed a novel approach to this issue: multiple layers of detection and filtering frameworks of […]

infosec.exchange

Original post on infosec.exchange

010 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/06/2026

We handed OpenClaw a penetration testing toolkit and pointed it at one of our own legacy Active Directory networks. The result: 23 findings across 11 attack paths… Full breakdown 👇 www.youtube.com/watch?v=NEculTwSj80

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 21/05/2026

New from Sophos X-Ops: the Nx Console VS Code extension compromise that led to the GitHub breach drops a Python backdoor that uses the GitHub Search API itself as its C2 channel — polling commit messages hourly for RSA-signed commands hidden in plain sight. Analysis, IOCs, recommendations and […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 20/05/2026

Our CTU Research team has been tracking GOLD SALEM (aka Warlock) A ransomware group that's torn through 60+ organisations across 3 continents in 6 months! New video out now ⬇️ www.youtube.com/watch?v=wfLcIjKbR5g #Cybersecurity #Ransomware #ThreatIntel

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 14/05/2026

Mainstream malware now regularly affects macOS users – particularly when it comes to infostealers, which regularly account for a significant portion of all the macOS detections we see in telemetry. Tracked since at least 2023, AMOS (Atomic macOS Stealer) is particularly prolific. It accounted […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 07/05/2026

As promised, we looked into this further and found what is, to our knowledge, a previously undocumented backdoor - plus some potentially linked campaigns and infrastructure. Full write-up: www.sophos.com/en-us/blog/donuts-an…

sophos.com

Donuts and Beagles: Fake Claude site spreads backdoor

A malicious imitation of Anthropic’s Claude site leads to DLL sideloading – and a backdoor

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/04/2026

🚨 Two supply chain attacks, same day, same C2. Sophos X-Ops is aware of reports of attackers hijacking Checkmarx KICS (Docker Hub, Open VSX, GitHub Actions) and the Bitwarden CLI (npm) to steal developer credentials on April 22. Evidence suggests one coordinated campaign. 🧵 Checkmarx KICS […]

infosec.exchange

Original post on infosec.exchange

010 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/04/2026

Update: We've done some further digging into this, and found that the C2 server is licence[.]claude-pro[.]com (port 443 over TCP, 8080 over UDP), with the following apparent ‘beacon’ structure: {"agent_id":"agent-[id]","hostname":"","user":"","heartbeat":3}. Interestingly, while the attack […]

infosec.exchange

Original post on infosec.exchange

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 14/04/2026

Sophos X-Ops recently investigated a report of a fake Claude website distributing malware. The malicious domain (claude-pro[.]com) downloads a file named Claude-Pro-windows-x64.zip, which when extracted results in an MSI installer file (Claude.msi). At the end of the attack chain is a […]

infosec.exchange

Original post on infosec.exchange

101 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/03/2026

This latest variant also has the ability to patch Ledger Live with malicious logic – which could lead to crypto wallets being drained of funds. It’s important to take into account the wider context of the increased risk to macOS users. Mainstream malware now regularly affects macOS users – […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/03/2026

or example: in Dec 2025, we observed a ClickFix campaign that leveraged shared ChatGPT conversations containing malicious links, leading to MacSync infections. A more recent campaign, in February, featured an updated MacSync variant – a multistage […] [Original post on infosec.exchange]

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/03/2026

ClickFix is an increasingly common social engineering technique, which threat actors use to trick users into installing malicious software on their devices. Historically, it’s been aimed at Windows users – but recently we’ve seen three ClickFix campaigns […] [Original post on infosec.exchange]

A screenshot of an installer window as part of a macOS ClickFix attack

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 25/02/2026

The 2026 Sophos Active Adversary Report is out — and despite the hype, we saw no AI-driven sea change in the threat landscape, based on the 600+ IR and MDR cases that made up our dataset. Attackers mostly stuck with what already works. Abuse of legitimate tools remained consistent, as did the […]

infosec.exchange

Original post on infosec.exchange

003 3

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/01/2026

In September 2025, Sophos Managed Detection and Response (MDR) teams identified a malvertising campaign distributing an infostealer dubbed TamperedChef – believed to be part of a wider campaign known as EvilAI. Previous coverage of this campaign suggests it began on June 26, 2025, with many of […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 10/11/2025

We’ve recently observed an increase in a malicious threat actor campaign leveraging GoTo LogMeIn installers distributed via phishing emails. X-Ops’ Labs and MDR teams are currently huddling on an investigation that’s delivering some interesting detection twists. The trouble starts, as trouble […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 31/10/2025

In a new blog post out today, we discuss the pros and cons of phishing simulations, and our own philosophy and approach at Sophos. We also provide ten tips for organizations when planning simulations (full details in the article, link below): 1. Find the right cadence 2. Pretexts should be […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 31/10/2025

At Sophos, we think there is. We’ve been running internal simulations since 2019 – but, crucially, we don’t measure by failure. We measure by success. Click rates aren’t that helpful, because it only takes one user to click – and they frame users as potential problems rather than potential […]

infosec.exchange

Original post on infosec.exchange

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 31/10/2025

Debates around the effectiveness of phishing simulations are widespread. Supporters claim they can boost learning retention rates, help train users’ instincts, reduce risk, and contribute to developing a ‘security-first’ culture. Detractors point to tick-box compliance, fatigue, unfair and […]

infosec.exchange

Original post on infosec.exchange

103 3

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 30/10/2025

Sophos researchers have identified real-world exploitation of a newly disclosed vulnerability in Windows Server Update Services (WSUS), where threat actors are harvesting sensitive data from organizations. Following public release of proof-of-concept code, attackers began abusing the flaw to […]

infosec.exchange

Original post on infosec.exchange

001 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

To ensure that this robustness does not come at the cost of model utility, we evaluated general capabilities with the MMLU benchmark using lm-evaluation-harness. The salted models achieved MMLU accuracies statistically indistinguishable from their unsalted counterparts, indicating that the […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

A similar trend holds for Vicuna-7B, where the ASR drops from 100% to 1.35% under salting. These results demonstrate that our approach effectively eliminates the subset of jailbreaks that remain robust under traditional defenses, outperforming both parameter-based and prompt-based strategies.

A bar chart showing jailbreak ASR vs MMLU accuracy for Vicuna-7b, across different defences (original model with no fine-tuning; standard fine-tuning; System Prompt Change; and LLM salting)

110 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

We evaluated LLM salting against the Greedy Coordinate Gradient (GCG) jailbreak attack. Experiments on LLaMA2-7B-Chat and Vicuna-7B showed that salting consistently breaks intra-model transferability, while preserving the model’s performance on benign […] [Original post on infosec.exchange]

A bar chart showing jailbreak ASR vs MMLU accuracy for LLaMA2-7b, across different defences (original model with no fine-tuning; standard fine-tuning; System Prompt Change; and LLM salting)

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

At the Conference for Applied Machine Learning in Information Security (CAMLIS) yesterday, SophosAI researcher Tamás Vörös presented his research on LLM salting, a novel technique to prevent LLM jailbreaks. Many organizations are increasingly deploying LLMs with minimal customization. This […]

infosec.exchange

Original post on infosec.exchange

112 2

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 21/10/2025

The Conference on Applied Machine Learning in Information Security (CAMLIS) kicks off tomorrow in Arlington, VA, and two data scientists from Sophos will be presenting their research. Ben Gelman will give a poster session on command line anomaly detection, research he previously presented at […]

infosec.exchange

Original post on infosec.exchange

010 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 26/08/2025

91% of #ransomware incidents involve data theft. Is your organization prepared? Explore the latest edition of our Threat Intelligence Executive Report – Volume 2025, Number 4, packed with actionable insights from our CTU Research Team. 🔹 Discover why […] [Original post on infosec.exchange]

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/08/2025

A memory dump revealed the executable to be an AV killer, which in that specific case targeted Sophos products. We weren’t alone, though -- a long list of security products turned out to be targeted by one or another version of the killer: • Bitdefender • Cylance • Fset • F-Secure • Fortinet • […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/08/2025

We focus first on taking apart a specific AV killer tool found among the thousands of payloads in certain HeartCrypt-packed samples. In multiple cases, the detection of this tool occurred during an ongoing ransomware attack. There is evidence for this tool’s distribution as early as January 2024 […]

infosec.exchange

Original post on infosec.exchange

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/08/2025

Since 2022, we’ve seen an increase in the sophistication of malware designed to disable EDR systems on an infected system. Some tools are developed by ransomware groups; some are purchased on the underground marketplace. In a post today we deep-dive into RansomHub’s EDRKillShifter – now […]

infosec.exchange

Original post on infosec.exchange

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 29/07/2025

The threat actors previously used these techniques individually: we saw the use of WebDAV to execute remotely hosted DLLs in September 2024, and we saw the sideloading of a renamed ADNotificationManager.exe file in March 2025. However, the combination we’re currently seeing represents a method […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 29/07/2025

Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications. The threat actors leverage a LNK file to remotely execute and sideload a […] [Original post on infosec.exchange]

A flow chart describing the infection chain under discussion; full text in article linked from next toot

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 23/07/2025

AI integration may seem very recent, but has been woven into the fabric of cybersecurity for many years. However, there are still improvements to be made. In our industry, models are often deployed on a massive scale, processing billions of events a day […] [Original post on infosec.exchange]

Clustered stacked bar graph showing performance difference between old production model and new, distilled model

013 3

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 21/07/2025

On Friday, July 18, 2025, Sophos MDR observed a surge in malicious activity targeting on-premise SharePoint instances. Analysts began tracking the execution of malicious PowerShell commands, associated with active exploitation leveraging a known exploit chain dubbed ToolShell. ⬇️ ToolShell […]

infosec.exchange

Original post on infosec.exchange

001 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

While we are not the first to report on this type of campaign (we have consolidated and cited previous research in a blog post out today, link below), we did find some potentially new information, including some interesting patterns and identifiers. We reported the repositories we found to […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

When we analyzed the backdoors, we ended up down a rabbithole of multiple variants, obfuscation, convoluted infection chains, and identifiers. The upshot is that a threat actor seems to be creating backdoored repos at scale, and may have been doing so for some time.

A screenshot of JavaScript code, showing four obfuscated string variables

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

We’ve previously looked into the niche world of threat actors targeting each other, so we investigated further, and found 133 backdoored repos, most linked to the same threat actor via an email address. Some repos claimed to be malware, others gaming cheats […] [Original post on infosec.exchange]

A screenshot of a YAML file, showing autocommit logic

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

We often get queries from customers asking if they’re protected against certain malware variants. A recent question seemed no different – a customer wanted to know if we had protections against ‘Sakura RAT,’ an open-source malware project hosted on GitHub […] [Original post on infosec.exchange]

A screenshot of a .NET project file, showing a long truncated string in the PreBuildEvent field

111 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

In our five-part series, out today, we explore the businesses and criminal activities that threat actors are discussing on underground forums. Part 1 provides context and background on our investigation, and explores some of the ways in which cybercriminals launder money. Parts 2-4 cover […]

infosec.exchange

Original post on infosec.exchange

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

However, it’s not all bad news. These forum posts also provide potentially useful information about threat actors, open new investigative avenues for law enforcement and regulators, and offer opportunities for the cybersecurity industry to collaborate with law enforcement.

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

Operation Destabilise – the NCA-led disruption of a large Russian money laundering network with links to ransomware, drugs, and espionage – showed it’s big business. A recent report by Europol also suggests an increasing overlap between cybercrime and real-world organized crime.

A screenshot from a criminal forum, in which a user provides details on things tax investigators look for and recommends certain businesses

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

Threat actors who expand into new territories and business ventures complicate investigations and draw more victims, collaborators, and innocent people – directly or indirectly – into their orbits.

A screenshot from a criminal forum, in which a user says they have an insider in a company and recommends that other users invest

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

The prospect of cybercriminals insidiously integrating themselves into legitimate industries – as well as being engaged in a wide range of real-world illegal activities – has significant implications for cybersecurity, law enforcement, and wider society.

A screenshot from a criminal forum, in which a user (likely a ransomware affiliate) suggests using “local girls” for laundering money, via OnlyFans

100 1