Sophos Threat Research

A month with no Critical-severity Windows bugs is overshadowed by a mass of Mariner mop-up

The availability of exploit code will likely lead to more widespread opportunistic attacks

Analysis of the tradecraft evolution across 6 months and 11 incidents

The ransomware scene gains another would-be EDR killer

Updates include novel abuse of recruitment platforms, modified infection chains, and expansion into a hybrid operation that combines data theft and ransomware deployment

Another campaign targeting WhatsApp users in Brazil spreads like a worm and employs multiple payloads for credential theft, session hijacking, and persistence

A cleanup month brings 63 patches… wait, no, 68… how about 61?

The threat group targeted a LANSCOPE zero-day vulnerability (CVE-2025-61932)

Exploitation of CVE-2025-59287 began after public disclosure and the release of proof-of-concept code

This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during July and August

On October 15, 2025, F5 reported that a nation-state threat actor had gained long-term access to some F5 systems and exfiltrated data, including source code and information about undisclosed product vulnerabilities. This information may enable threat actors to compromise F5 devices by developing exploits for these vulnerabilities. The UK National Cyber Security Centre also notes […]

Microsoft throws a farewell party for Win10, Office 2016, and Office 2019… a very big party

Counter Threat Unit™ (CTU) researchers are investigating multiple incidents in an ongoing campaign targeting users of the WhatsApp messaging platform. The campaign, which started on September 29, 2025, is focused on Brazil and seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session. […]

How the notorious Packer-as-a-Service operation built itself into a hydra

The emerging group demonstrates competent tradecraft using a familiar ransomware playbook and hints of ingenuity

The last round of fixes before Win 10’s final shout touches 15 product families, including Xbox

This approach represents an evolution from threat actors abusing remote monitoring and management tools

This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during May and June

Microsoft haul this month covers 109 CVEs… more or less

Following on from our preview, here's Ben Gelman and Sean Bergeron's research on enhancing command line classification with benign anomalous data