Interlock ransomware gang creates volatile situation
In March 2026, the Sophos Emergency Incident Response (EIR) team investigated an incident in which we observed the use of...
investigated
Chaos in Teams vishing
Sophos analysts investigated a Microsoft Teams voice phishing (vishing) campaign tracked as STAC4749 that used a consistent set of IT-themed...
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
In one of the cases we have investigated, a few hours after the user approved the request, the attacker signed...
Vect and TeamPCP partner for ransomware campaigns
Counter Threat Unit™ (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a...
ESET APT Activity Report Q4 2025–Q1 2026
ESET ResearchThreat Reports An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4...
WantToCry ransomware remotely encrypts files
SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial...
WantToCry ransomware remotely encrypts files
SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors exploiting SMB for initial access and then exfiltrating files...
Operation NoVoice: Rootkit Tells No Tales
Authored By: Ahmad Zubair Zahid McAfee’s mobile research team identified and investigated an Android rootkit campaign tracked as Operation Novoice. The malware described...
Malicious use of virtual machine infrastructure
In late 2025, SophosLabs analysts investigated several WantToCry remote ransomware incidents. In each case, the attackers used virtual machines with...
