Sorry

This feed does not validate.

In addition, interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: https://feeds.feedburner.com/sophos/dgdY

  1. <?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
  2. xmlns:content="http://purl.org/rss/1.0/modules/content/"
  3. xmlns:wfw="http://wellformedweb.org/CommentAPI/"
  4. xmlns:dc="http://purl.org/dc/elements/1.1/"
  5. xmlns:atom="http://www.w3.org/2005/Atom"
  6. xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  7. xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  9. xmlns:georss="http://www.georss.org/georss"
  10. xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#"
  11. xmlns:media="http://search.yahoo.com/mrss/"
  12. >
  13.  
  14. <channel>
  15. <title>Sophos News</title>
  16. <atom:link href="https://news.sophos.com/en-us/feed/" rel="self" type="application/rss+xml" />
  17. <link>https://news.sophos.com/en-us/</link>
  18. <description>The Sophos Blog</description>
  19. <lastBuildDate>Fri, 24 Jan 2025 20:49:52 +0000</lastBuildDate>
  20. <language>en-US</language>
  21. <sy:updatePeriod>
  22. hourly </sy:updatePeriod>
  23. <sy:updateFrequency>
  24. 1 </sy:updateFrequency>
  25. <generator>https://wordpress.org/?v=6.7.1</generator>
  26.  
  27. <image>
  28. <url>https://news.sophos.com/wp-content/uploads/2020/01/cropped-sophos.png?w=32</url>
  29. <title>Sophos News</title>
  30. <link>https://news.sophos.com/en-us/</link>
  31. <width>32</width>
  32. <height>32</height>
  33. </image>
  34. <site xmlns="com-wordpress:feed-additions:1">166161023</site> <item>
  35. <title>Sophos MDR tracks two ransomware campaigns using &#8220;email bombing,&#8221; Microsoft Teams “vishing”</title>
  36. <link>https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/</link>
  37. <comments>https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/?noamp=mobile#respond</comments>
  39. <dc:creator><![CDATA[gallagherseanm]]></dc:creator>
  40. <pubDate>Tue, 21 Jan 2025 11:30:14 +0000</pubDate>
  41. <category><![CDATA[Security Operations]]></category>
  42. <category><![CDATA[Threat Research]]></category>
  43. <category><![CDATA[Black Basta]]></category>
  44. <category><![CDATA[featured]]></category>
  45. <category><![CDATA[Fin7]]></category>
  46. <category><![CDATA[Java malware]]></category>
  47. <category><![CDATA[legitimate service abuse]]></category>
  48. <category><![CDATA[Microsoft Office 365]]></category>
  49. <category><![CDATA[python malware]]></category>
  50. <category><![CDATA[Quick Assist]]></category>
  51. <category><![CDATA[remote machine management]]></category>
  52. <category><![CDATA[STAC5143]]></category>
  53. <category><![CDATA[stac5777]]></category>
  54. <category><![CDATA[Teams]]></category>
  55. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959250</guid>
  56.  
  57. <description><![CDATA[Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware.]]></description>
  59. <wfw:commentRss>https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/feed/</wfw:commentRss>
  60. <slash:comments>0</slash:comments>
  63. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/emailbomb.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  64. <post-id xmlns="com-wordpress:feed-additions:1">959250</post-id>
  65. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2025/01/emailbomb.jpg" alt="" />
  66. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/emailbomb.jpg" medium="image" alt="">
  67. <media:title type="html">Email,Alert,And,Message,Sending,/,Receiving,Concept,:,Envelope</media:title>
  68. </media:content>
  69.  
  70. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/Rpivot-obfuscated.png" medium="image" alt="A screenshot of Python code from an obfuscated copy of RPivot dropped by the STAC5143 attackers.">
  71. <media:title type="html">A screenshot of Python code from an obfuscated copy of RPivot dropped by the STAC5143 attackers.</media:title>
  72. </media:content>
  73.  
  74. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/Fig2Vishing.png" medium="image" alt="Figure 2:Sophos Central investigation screen of threat actor’s incoming activity captured by Microsoft Office 365 integration">
  75. <media:title type="html">Figure 2:Sophos Central investigation screen of threat actor’s incoming activity captured by Microsoft Office 365 integration</media:title>
  76. </media:content>
  77.  
  78. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/TeamsVishingfig2.png" medium="image" alt="" />
  79. </item>
  80. <item>
  81. <title>Gootloader inside out</title>
  82. <link>https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/</link>
  83. <comments>https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/?noamp=mobile#respond</comments>
  85. <dc:creator><![CDATA[Gabor Szappanos]]></dc:creator>
  86. <pubDate>Thu, 16 Jan 2025 17:00:02 +0000</pubDate>
  87. <category><![CDATA[Threat Research]]></category>
  88. <category><![CDATA[featured]]></category>
  89. <category><![CDATA[Gootkit]]></category>
  90. <category><![CDATA[Gootloader]]></category>
  91. <category><![CDATA[HelloDolly]]></category>
  92. <category><![CDATA[JScript]]></category>
  93. <category><![CDATA[malicious SEO]]></category>
  94. <category><![CDATA[malware]]></category>
  95. <category><![CDATA[obfuscation]]></category>
  96. <category><![CDATA[php]]></category>
  97. <category><![CDATA[PHP shell]]></category>
  98. <category><![CDATA[SEO]]></category>
  99. <category><![CDATA[WordPress]]></category>
  100. <category><![CDATA[YARA]]></category>
  101. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959285</guid>
  102.  
  103. <description><![CDATA[Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward]]></description>
  105. <wfw:commentRss>https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/feed/</wfw:commentRss>
  106. <slash:comments>0</slash:comments>
  109. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_2429786175.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  110. <post-id xmlns="com-wordpress:feed-additions:1">959285</post-id>
  111. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_2429786175.jpg" alt="" />
  112. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_2429786175.jpg" medium="image" alt="">
  113. <media:title type="html">Magic,Wand,And,Top,Hat,Isolated,On,White.,Magician,Trick</media:title>
  114. </media:content>
  115.  
  116. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image1.png" medium="image" alt="A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them">
  117. <media:title type="html">A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them</media:title>
  118. </media:content>
  119.  
  120. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image2.png" medium="image" alt="Gootloader has poisoned search results in multiple languages, including German, French, and Korean ">
  121. <media:title type="html">Gootloader has poisoned search results in multiple languages, including German, French, and Korean </media:title>
  122. </media:content>
  123.  
  124. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image3.png" medium="image" alt="Source of the Gootkit/Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don&#039;t actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result">
  125. <media:title type="html">Source of the Gootkit/Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don&#039;t actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result</media:title>
  126. </media:content>
  127.  
  128. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image4.png" medium="image" alt=" A screenshot of the source code from a Gootkit/Goodloader landing page. Image courtesy of Sucuri Research.">
  129. <media:title type="html"> A screenshot of the source code from a Gootkit/Goodloader landing page. Image courtesy of Sucuri Research.</media:title>
  130. </media:content>
  131.  
  132. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image5.png" medium="image" alt="The WordPress database dump included this table that contains a set of the first three octets of IP addresses, a block list of IP ranges that cannot revisit the Gootloader website on the same day">
  133. <media:title type="html">The WordPress database dump included this table that contains a set of the first three octets of IP addresses, a block list of IP ranges that cannot revisit the Gootloader website on the same day</media:title>
  134. </media:content>
  135.  
  136. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image6.png" medium="image" alt="A block of base64-encoded data stored as a variable named $pposte in a WordPress database">
  137. <media:title type="html">A block of base64-encoded data stored as a variable named $pposte in a WordPress database</media:title>
  138. </media:content>
  139.  
  140. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image7.png" medium="image" alt="Malicious SEO content phrases embedded in a WordPress database table, linking the site to an Excel spreadsheet converter search query">
  141. <media:title type="html">Malicious SEO content phrases embedded in a WordPress database table, linking the site to an Excel spreadsheet converter search query</media:title>
  142. </media:content>
  143.  
  144. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image8.png" medium="image" alt="The &#034;place marker&#034; string appears in the OpenGraph metadata SEO headers of a Gootkit/Gootloader-modified web page">
  145. <media:title type="html">The &#034;place marker&#034; string appears in the OpenGraph metadata SEO headers of a Gootkit/Gootloader-modified web page</media:title>
  146. </media:content>
  147.  
  148. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image9.png" medium="image" alt="Files that contain references to the Gootloader &#034;mothership&#034; website (screenshot courtesy of VirusTotal)">
  149. <media:title type="html">Files that contain references to the Gootloader &#034;mothership&#034; website (screenshot courtesy of VirusTotal)</media:title>
  150. </media:content>
  151.  
  152. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image10.png" medium="image" alt="Commented text, preceded with double slashes, documents the Gootkit characteristics of modified web pages">
  153. <media:title type="html">Commented text, preceded with double slashes, documents the Gootkit characteristics of modified web pages</media:title>
  154. </media:content>
  155.  
  156. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image11.png" medium="image" alt="a WordPress database dump in VirusTotal">
  157. <media:title type="html">a WordPress database dump in VirusTotal</media:title>
  158. </media:content>
  159.  
  160. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image12.png" medium="image" alt=" A SQL dump from a compromised WordPress installation contains base64-encoded elements of the Gootkit/Gootloader modifications">
  161. <media:title type="html"> A SQL dump from a compromised WordPress installation contains base64-encoded elements of the Gootkit/Gootloader modifications</media:title>
  162. </media:content>
  163.  
  164. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image13.png" medium="image" alt="The decoded base64 data from the WordPress database reveals the PHP script that handles decoding the malicious content for a site visitor">
  165. <media:title type="html">The decoded base64 data from the WordPress database reveals the PHP script that handles decoding the malicious content for a site visitor</media:title>
  166. </media:content>
  167.  
  168. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image14.png" medium="image" alt="A simple command shell Gootkit inserts into the PHP running in a WordPress site the threat actors have comrpomised">
  169. <media:title type="html">A simple command shell Gootkit inserts into the PHP running in a WordPress site the threat actors have comrpomised</media:title>
  170. </media:content>
  171.  
  172. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image15.png" medium="image" alt="The portion of the Gootkit code that collects the HTML content of the fake page it will later draw over the top of the compromised website">
  173. <media:title type="html">The portion of the Gootkit code that collects the HTML content of the fake page it will later draw over the top of the compromised website</media:title>
  174. </media:content>
  175.  
  176. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image16.png" medium="image" alt=" The Gootkit code blocks repeat visitors by adding not only the visitor&#039;s IP address range to a block list, but the entire class C IPv4 address range on either side of the visitor&#039;s address, just for good measure">
  177. <media:title type="html"> The Gootkit code blocks repeat visitors by adding not only the visitor&#039;s IP address range to a block list, but the entire class C IPv4 address range on either side of the visitor&#039;s address, just for good measure</media:title>
  178. </media:content>
  179.  
  180. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image17.png" medium="image" alt="The Gootkit/Gootloader fake forum page, featuring a &#034;question&#034; and an &#034;answer&#034; that links to the Gootloader JScript first-stage payload">
  181. <media:title type="html">The Gootkit/Gootloader fake forum page, featuring a &#034;question&#034; and an &#034;answer&#034; that links to the Gootloader JScript first-stage payload</media:title>
  182. </media:content>
  183.  
  184. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image18.png" medium="image" alt="The unique key is linked in a Javascript code snippet embedded in the compromised WordPress server page.">
  185. <media:title type="html">The unique key is linked in a Javascript code snippet embedded in the compromised WordPress server page.</media:title>
  186. </media:content>
  187.  
  188. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image19.png" medium="image" alt="A set of commands that deletes from view the original page content on the compromised WordPress server page the visitor lands on">
  189. <media:title type="html">A set of commands that deletes from view the original page content on the compromised WordPress server page the visitor lands on</media:title>
  190. </media:content>
  191.  
  192. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image20.png" medium="image" alt="The replacement content includes the text of the &#034;Questions And Answers&#034; fake forum page">
  193. <media:title type="html">The replacement content includes the text of the &#034;Questions And Answers&#034; fake forum page</media:title>
  194. </media:content>
  195.  
  196. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image21.png" medium="image" alt="The download link points to a php script hosted on a different server. This link delivers the .js file packed into a Zip archive which comprises the first stage Gootloader payload">
  197. <media:title type="html">The download link points to a php script hosted on a different server. This link delivers the .js file packed into a Zip archive which comprises the first stage Gootloader payload</media:title>
  198. </media:content>
  199.  
  200. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image22.png" medium="image" alt="A Gootkit/Gootloader fake forum page in German. The source code of the page shows the link points to a file named down.php hosted on a completely different server than the one where the page appears. The link marked in red will connect to the server that is hosting the first-stage download JScript.">
  201. <media:title type="html">A Gootkit/Gootloader fake forum page in German. The source code of the page shows the link points to a file named down.php hosted on a completely different server than the one where the page appears. The link marked in red will connect to the server that is hosting the first-stage download JScript.</media:title>
  202. </media:content>
  203.  
  204. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image23.png" medium="image" alt="The source code of the PHP script that delivers the first stage Gootloader payload">
  205. <media:title type="html">The source code of the PHP script that delivers the first stage Gootloader payload</media:title>
  206. </media:content>
  207.  
  208. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image24.png" medium="image" alt="Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante blog)">
  209. <media:title type="html">Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante blog)</media:title>
  210. </media:content>
  211.  
  212. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image25.png" medium="image" alt="Another format of the modified HelloDolly.php script shows the unique identifier string">
  213. <media:title type="html">Another format of the modified HelloDolly.php script shows the unique identifier string</media:title>
  214. </media:content>
  215.  
  216. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image26.png" medium="image" alt="A variation on the modified HelloDolly.php script">
  217. <media:title type="html">A variation on the modified HelloDolly.php script</media:title>
  218. </media:content>
  219.  
  220. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image27.png" medium="image" alt="A screenshot that summarizes the modification process Gootloader uses (image courtesy of the Rich Infante blog)">
  221. <media:title type="html">A screenshot that summarizes the modification process Gootloader uses (image courtesy of the Rich Infante blog)</media:title>
  222. </media:content>
  223.  
  224. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image28.png" medium="image" alt="A WordPress database dump contains the same elements that the Rich Infante blog references">
  225. <media:title type="html">A WordPress database dump contains the same elements that the Rich Infante blog references</media:title>
  226. </media:content>
  227.  
  228. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image29.png" medium="image" alt="The encoded form of a PHP script that delivers the .js payload">
  229. <media:title type="html">The encoded form of a PHP script that delivers the .js payload</media:title>
  230. </media:content>
  231.  
  232. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image30.png" medium="image" alt="A screenshot of a file uploaded to VirusTotal shows references to the IP address formerly used to host the Gootkit/Gootloader &#034;mothership&#034; server">
  233. <media:title type="html">A screenshot of a file uploaded to VirusTotal shows references to the IP address formerly used to host the Gootkit/Gootloader &#034;mothership&#034; server</media:title>
  234. </media:content>
  235.  
  236. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image31.png" medium="image" alt="The my-game website as it appeared in 2014, a Russian-language gambling site called &#034;Casino Game Life&#034;">
  237. <media:title type="html">The my-game website as it appeared in 2014, a Russian-language gambling site called &#034;Casino Game Life&#034;</media:title>
  238. </media:content>
  239.  
  240. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/202501_gootloader_image32.png" medium="image" alt="The my-game domain that continues to host the Gootkit/Gootloader mothership originally belonged to a German team that played the game Counter-Strike competitively">
  241. <media:title type="html">The my-game domain that continues to host the Gootkit/Gootloader mothership originally belonged to a German team that played the game Counter-Strike competitively</media:title>
  242. </media:content>
  243. </item>
  244. <item>
  245. <title>Sophos ZTNA Updates</title>
  246. <link>https://news.sophos.com/en-us/2025/01/16/sophos-ztna-updates/</link>
  247. <comments>https://news.sophos.com/en-us/2025/01/16/sophos-ztna-updates/?noamp=mobile#respond</comments>
  249. <dc:creator><![CDATA[Chris McCormack]]></dc:creator>
  250. <pubDate>Thu, 16 Jan 2025 14:25:20 +0000</pubDate>
  251. <category><![CDATA[Products & Services]]></category>
  252. <category><![CDATA[network]]></category>
  253. <category><![CDATA[ZTNA]]></category>
  254. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959228</guid>
  255.  
  256. <description><![CDATA[New Let's Encrypt and regional support.]]></description>
  258. <wfw:commentRss>https://news.sophos.com/en-us/2025/01/16/sophos-ztna-updates/feed/</wfw:commentRss>
  259. <slash:comments>0</slash:comments>
  262. <media:content url="https://news.sophos.com/wp-content/uploads/2024/07/sophos-ztna.png?w=230&#38;h=130&#38;crop=1" medium="image" alt="sophos ztna" />
  263. <post-id xmlns="com-wordpress:feed-additions:1">959228</post-id>
  264. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/07/sophos-ztna.png" alt="sophos ztna" />
  265. <media:content url="https://news.sophos.com/wp-content/uploads/2024/07/sophos-ztna.png" medium="image" alt="sophos ztna">
  266. <media:title type="html">sophos ztna</media:title>
  267. </media:content>
  268.  
  269. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/image1.png?w=279" medium="image" alt="Lets Encrypt">
  270. <media:title type="html">Lets Encrypt</media:title>
  271. </media:content>
  272.  
  273. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/image2.png" medium="image" alt="Lets Encrypt">
  274. <media:title type="html">Lets Encrypt</media:title>
  275. </media:content>
  276.  
  277. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/ZTNAscreenshot.jpg" medium="image" alt="ZTNA">
  278. <media:title type="html">ZTNA</media:title>
  279. </media:content>
  280.  
  281. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/image4.jpg" medium="image" alt="Regions">
  282. <media:title type="html">Regions</media:title>
  283. </media:content>
  284. </item>
  285. <item>
  286. <title>159-CVE January Patch Tuesday smashes single-month record</title>
  287. <link>https://news.sophos.com/en-us/2025/01/14/159-cve-january-patch-tuesday-smashes-single-month-record/</link>
  288. <comments>https://news.sophos.com/en-us/2025/01/14/159-cve-january-patch-tuesday-smashes-single-month-record/?noamp=mobile#respond</comments>
  290. <dc:creator><![CDATA[Angela Gunn]]></dc:creator>
  291. <pubDate>Wed, 15 Jan 2025 03:09:41 +0000</pubDate>
  292. <category><![CDATA[Threat Research]]></category>
  293. <category><![CDATA[CVE-2025-21298]]></category>
  294. <category><![CDATA[featured]]></category>
  295. <category><![CDATA[Microsoft]]></category>
  296. <category><![CDATA[Microsoft Windows]]></category>
  297. <category><![CDATA[OLE]]></category>
  298. <category><![CDATA[Patch Tuesday]]></category>
  299. <category><![CDATA[RTF]]></category>
  300. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959257</guid>
  301.  
  302. <description><![CDATA[Brace yourselves... and consider reading your email in plaintext for now]]></description>
  304. <wfw:commentRss>https://news.sophos.com/en-us/2025/01/14/159-cve-january-patch-tuesday-smashes-single-month-record/feed/</wfw:commentRss>
  305. <slash:comments>0</slash:comments>
  308. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_86010604.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="Patch Tuesday" />
  309. <post-id xmlns="com-wordpress:feed-additions:1">959257</post-id>
  310. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_86010604.jpg" alt="Patch Tuesday" />
  311. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/shutterstock_86010604.jpg" medium="image" alt="Patch Tuesday">
  312. <media:title type="html">Patch Tuesday</media:title>
  313. </media:content>
  314.  
  315. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/pt2501-fig01.png" medium="image" alt="A bar chart showing the distribution of severities of bugs patched in the January 2025 Patch Tuesday set, as described in the article text">
  316. <media:title type="html">A bar chart showing the distribution of severities of bugs patched in the January 2025 Patch Tuesday set, as described in the article text</media:title>
  317. </media:content>
  318.  
  319. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/pt2501-fig02.png" medium="image" alt="A bar chart showing the distribution of product families affected by bugs patched in the January 2025 Patch Tuesday set, as described in the article text">
  320. <media:title type="html">A bar chart showing the distribution of product families affected by bugs patched in the January 2025 Patch Tuesday set, as described in the article text</media:title>
  321. </media:content>
  322.  
  323. <media:content url="https://news.sophos.com/wp-content/uploads/2025/01/pt2501-fig03.png" medium="image" alt="A bar chart showing 61 months of overall CVEs counts for Microsoft Patch Tuesdays since January 2020; the rightmost bar indicates the numbers for january 2025 and is taller than the rest">
  324. <media:title type="html">A bar chart showing 61 months of overall CVEs counts for Microsoft Patch Tuesdays since January 2020; the rightmost bar indicates the numbers for january 2025 and is taller than the rest</media:title>
  325. </media:content>
  326. </item>
  327. <item>
  328. <title>Prioritizing patching: A deep dive into frameworks and tools &#8211; Part 2: Alternative frameworks</title>
  329. <link>https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks/</link>
  331. <dc:creator><![CDATA[Matt Wixey]]></dc:creator>
  332. <pubDate>Mon, 30 Dec 2024 15:05:30 +0000</pubDate>
  333. <category><![CDATA[Threat Research]]></category>
  334. <category><![CDATA[CVSS]]></category>
  335. <category><![CDATA[Patch Tuesday]]></category>
  336. <category><![CDATA[patching]]></category>
  337. <category><![CDATA[Sophos X-Ops]]></category>
  338. <category><![CDATA[threat research]]></category>
  339. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959081</guid>
  340.  
  341. <description><![CDATA[In the second of a two-part series on tools and frameworks designed to help with remediation prioritization, we explore some alternatives to CVSS]]></description>
  345. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2483952669.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  346. <post-id xmlns="com-wordpress:feed-additions:1">959081</post-id>
  347. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2483952669.jpg" alt="" />
  348. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2483952669.jpg" medium="image" alt="">
  349. <media:title type="html">Real,Time,Analytics,Concept.,The,Process,Of,Collecting,Data,As</media:title>
  350. </media:content>
  351.  
  352. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-1-1.png" medium="image" alt="" />
  353.  
  354. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-2-1.png" medium="image" alt="" />
  355.  
  356. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-3.png" medium="image" alt="" />
  357.  
  358. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-4.png" medium="image" alt="" />
  359.  
  360. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-5.png" medium="image" alt="" />
  361.  
  362. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-6.png" medium="image" alt="" />
  363.  
  364. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-7.png" medium="image" alt="" />
  365. </item>
  366. <item>
  367. <title>Prioritizing patching: A deep dive into frameworks and tools &#8211; Part 1: CVSS</title>
  368. <link>https://news.sophos.com/en-us/2024/12/27/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-1-cvss/</link>
  370. <dc:creator><![CDATA[Matt Wixey]]></dc:creator>
  371. <pubDate>Fri, 27 Dec 2024 17:33:53 +0000</pubDate>
  372. <category><![CDATA[Threat Research]]></category>
  373. <category><![CDATA[CVSS]]></category>
  374. <category><![CDATA[Patch Tuesday]]></category>
  375. <category><![CDATA[patching]]></category>
  376. <category><![CDATA[Sophos X-Ops]]></category>
  377. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=959055</guid>
  378.  
  379. <description><![CDATA[In the first of a two-part series exploring tools and frameworks which can help organizations with remediation prioritization, Sophos X-Ops takes a look at the Common Vulnerability Scoring System (CVSS)]]></description>
  383. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2501372697.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  384. <post-id xmlns="com-wordpress:feed-additions:1">959055</post-id>
  385. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2501372697.jpg" alt="" />
  386. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_2501372697.jpg" medium="image" alt="">
  387. <media:title type="html">Business,Operations,And,Management,Concept.,Thinking,Of,A,Strategy,And</media:title>
  388. </media:content>
  389.  
  390. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-1.png" medium="image" alt="" />
  391.  
  392. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Figure-2.png" medium="image" alt="" />
  393. </item>
  394. <item>
  395. <title>Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces</title>
  396. <link>https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/</link>
  398. <dc:creator><![CDATA[gallagherseanm]]></dc:creator>
  399. <pubDate>Thu, 19 Dec 2024 15:11:48 +0000</pubDate>
  400. <category><![CDATA[Security Operations]]></category>
  401. <category><![CDATA[Threat Research]]></category>
  402. <category><![CDATA[CloudFlare]]></category>
  403. <category><![CDATA[featured]]></category>
  404. <category><![CDATA[FlowerStorm]]></category>
  405. <category><![CDATA[legitimate service abuse]]></category>
  406. <category><![CDATA[Phishing]]></category>
  407. <category><![CDATA[phishing-as-a-service]]></category>
  408. <category><![CDATA[Rockstar]]></category>
  409. <category><![CDATA[Rockstar2FA]]></category>
  410. <category><![CDATA[Sophos MDR]]></category>
  411. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=958944</guid>
  412.  
  413. <description><![CDATA[A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar ]]></description>
  417. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_1469287178.jpg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  418. <post-id xmlns="com-wordpress:feed-additions:1">958944</post-id>
  419. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_1469287178.jpg" alt="" />
  420. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_1469287178.jpg" medium="image" alt="">
  421. <media:title type="html">A,Wooden,Acoustic,Guitar,At,Night.,With,Spotlight,For,Your</media:title>
  422. </media:content>
  423.  
  424. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/rockstar-decoy.png" medium="image" alt="A screenshot of a Rockstar2FA &#034;decoy&#034; page, a fake auto dealer site.">
  425. <media:title type="html">A screenshot of a Rockstar2FA &#034;decoy&#034; page, a fake auto dealer site.</media:title>
  426. </media:content>
  427.  
  428. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Rockstar-backend-server-comms.jpg" medium="image" alt="Screen shots of the developer view of Chrome showing web requests sent from a Rockstar2FA phishing portal. ">
  429. <media:title type="html">Screen shots of the developer view of Chrome showing web requests sent from a Rockstar2FA phishing portal. </media:title>
  430. </media:content>
  431.  
  432. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/RockstarTLDs.png" medium="image" alt="A pie chart showing the distribution of top-level domains the 10 most heavily used domain names were registered with. A third were .ru, a fifth were .com. ">
  433. <media:title type="html">A pie chart showing the distribution of top-level domains the 10 most heavily used domain names were registered with. A third were .ru, a fifth were .com. </media:title>
  434. </media:content>
  435.  
  436. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FlowerStorm-detects-by-TLD.jpg" medium="image" alt="A bar chart showing the distribution of TLDs and number of URLs detected per month for Rockstar2FA. The number of .ru domains decreased significantly over time.">
  437. <media:title type="html">A bar chart showing the distribution of TLDs and number of URLs detected per month for Rockstar2FA. The number of .ru domains decreased significantly over time.</media:title>
  438. </media:content>
  439.  
  440. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Rockstarerror522.png" medium="image" alt="A screenshot of a failed connection error for a Rockstar decoy page.">
  441. <media:title type="html">A screenshot of a failed connection error for a Rockstar decoy page.</media:title>
  442. </media:content>
  443.  
  444. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/RockstarOutlookanimate.png" medium="image" alt="A screenshot of an animated Office365 logo for Outlook used by Rockstar&#039;s phishing portal pages.">
  445. <media:title type="html">A screenshot of an animated Office365 logo for Outlook used by Rockstar&#039;s phishing portal pages.</media:title>
  446. </media:content>
  447.  
  448. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Failed_connection_Rockstar_backend.png" medium="image" alt="A screenshot of a Chrome developer view of a Rockstar pages.dev phishing portal failing to connect to a backend server.">
  449. <media:title type="html">A screenshot of a Chrome developer view of a Rockstar pages.dev phishing portal failing to connect to a backend server.</media:title>
  450. </media:content>
  451.  
  452. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FlowerStormphishnext-php.png" medium="image" alt="A screenshot of data abouit and ">
  453. <media:title type="html">A screenshot of data abouit and </media:title>
  454. </media:content>
  455.  
  456. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FlowerStormEntraID-log.png" medium="image" alt="Figure 9: the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.">
  457. <media:title type="html">Figure 9: the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.</media:title>
  458. </media:content>
  459.  
  460. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Flowerstorm-same-host-authenticate.png" medium="image" alt="Figure 10: the HTTP header data for a phishing page’s backend server communications on a separate host">
  461. <media:title type="html">Figure 10: the HTTP header data for a phishing page’s backend server communications on a separate host</media:title>
  462. </media:content>
  463.  
  464. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FlowerstormDeveloperViewPhishportal.png" medium="image" alt="Figure 11: A developer browser view of the phishing page protectivewearsupplies[.]doclawfederal[.]com/wQBPg/">
  465. <media:title type="html">Figure 11: A developer browser view of the phishing page protectivewearsupplies[.]doclawfederal[.]com/wQBPg/</media:title>
  466. </media:content>
  467.  
  468. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/rockstardom.png" medium="image" alt="Figure12: The document object model of a Rockstar2FA phishing page ">
  469. <media:title type="html">Figure12: The document object model of a Rockstar2FA phishing page </media:title>
  470. </media:content>
  471.  
  472. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/OldFlowerDom.png" medium="image" alt="Figure 13: The DOM of an older FlowerStorm phishing page (from June 2024)">
  473. <media:title type="html">Figure 13: The DOM of an older FlowerStorm phishing page (from June 2024)</media:title>
  474. </media:content>
  475.  
  476. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/NewFlowerDom.png" medium="image" alt="Figure 14: The DOM of a newer FlowerStorm phishing page; the algorithm generating the title and function names uses a combination of two botanical-themed words">
  477. <media:title type="html">Figure 14: The DOM of a newer FlowerStorm phishing page; the algorithm generating the title and function names uses a combination of two botanical-themed words</media:title>
  478. </media:content>
  479.  
  480. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/RS_vs_FS_detects.jpg" medium="image" alt="Figure 15: A chart plotting daily page detections for Rockstar2FA and FlowerStorm through the end of November 2024 ">
  481. <media:title type="html">Figure 15: A chart plotting daily page detections for Rockstar2FA and FlowerStorm through the end of November 2024 </media:title>
  482. </media:content>
  483.  
  484. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FlowerStormTargeting.png" medium="image" alt="Figure 16: The ten countries most targeted by attackers using FlowerStorm, based on Sophos detections">
  485. <media:title type="html">Figure 16: The ten countries most targeted by attackers using FlowerStorm, based on Sophos detections</media:title>
  486. </media:content>
  487.  
  488. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/FSindustrytargeting.png" medium="image" alt="Figure 17: The ten business sectors most targeted by attackers using FlowerStorm">
  489. <media:title type="html">Figure 17: The ten business sectors most targeted by attackers using FlowerStorm</media:title>
  490. </media:content>
  491. </item>
  492. <item>
  493. <title>Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports</title>
  494. <link>https://news.sophos.com/en-us/2024/12/18/sophos-ranked-1-overall-for-firewall-mdr-and-edr-in-the-g2-winter-2025-reports/</link>
  496. <dc:creator><![CDATA[rajansanhotra]]></dc:creator>
  497. <pubDate>Wed, 18 Dec 2024 10:21:54 +0000</pubDate>
  498. <category><![CDATA[Products & Services]]></category>
  499. <category><![CDATA[EDR]]></category>
  500. <category><![CDATA[Endpoint]]></category>
  501. <category><![CDATA[Firewall]]></category>
  502. <category><![CDATA[G2]]></category>
  503. <category><![CDATA[MDR]]></category>
  504. <category><![CDATA[Sophos EDR]]></category>
  505. <category><![CDATA[Sophos Endpoint]]></category>
  506. <category><![CDATA[Sophos Firewall]]></category>
  507. <category><![CDATA[Sophos MDR]]></category>
  508. <category><![CDATA[Sophos XDR]]></category>
  509. <category><![CDATA[XDR]]></category>
  510. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=958917</guid>
  511.  
  512. <description><![CDATA[Sophos was also ranked the #1 solution in 36 individual reports spanning the Antivirus, EDR, Endpoint Protection Suites, XDR, Firewall, and MDR markets.]]></description>
  516. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Sophos-ranked-1-overall-for-Firewall-MDR-and-EDR-in-the-G2-Winter-2025-Reports-1.png?w=230&#38;h=130&#38;crop=1" medium="image" alt="Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports" />
  517. <post-id xmlns="com-wordpress:feed-additions:1">958917</post-id>
  518. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/Sophos-ranked-1-overall-for-Firewall-MDR-and-EDR-in-the-G2-Winter-2025-Reports-1.png" alt="Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports" />
  519. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Sophos-ranked-1-overall-for-Firewall-MDR-and-EDR-in-the-G2-Winter-2025-Reports-1.png" medium="image" alt="Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports">
  520. <media:title type="html">Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports</media:title>
  521. </media:content>
  522. </item>
  523. <item>
  524. <title>Year in Review 2024: The major headlines and moments from Sophos this year</title>
  525. <link>https://news.sophos.com/en-us/2024/12/17/year-in-review-2024-the-major-headlines-and-moments-from-sophos-this-year/</link>
  527. <dc:creator><![CDATA[Doug Aamoth]]></dc:creator>
  528. <pubDate>Tue, 17 Dec 2024 13:00:15 +0000</pubDate>
  529. <category><![CDATA[Products & Services]]></category>
  530. <category><![CDATA[Sophos Endpoint]]></category>
  531. <category><![CDATA[Sophos MDR]]></category>
  532. <category><![CDATA[Sophos X-Ops]]></category>
  533. <category><![CDATA[Sophos XDR]]></category>
  534. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=958865</guid>
  535.  
  536. <description><![CDATA[From cyber attacks across the geopolitical landscapes, to product updates that help small businesses, Sophos was there in 2024.]]></description>
  540. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/sophos-wews-blog-banner-year-in-review-1200x628px-01.png?w=230&#38;h=130&#38;crop=1" medium="image" alt="sophos-wews-blog-banner-year-in-review-1200x628px-01" />
  541. <post-id xmlns="com-wordpress:feed-additions:1">958865</post-id>
  542. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/sophos-wews-blog-banner-year-in-review-1200x628px-01.png" alt="sophos-wews-blog-banner-year-in-review-1200x628px-01" />
  543. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/sophos-wews-blog-banner-year-in-review-1200x628px-01.png" medium="image" alt="sophos-wews-blog-banner-year-in-review-1200x628px-01">
  544. <media:title type="html">sophos-wews-blog-banner-year-in-review-1200x628px-01</media:title>
  545. </media:content>
  546. </item>
  547. <item>
  548. <title>DeepSpeed: a tuning tool for large language models</title>
  549. <link>https://news.sophos.com/en-us/2024/12/13/deepspeed-a-tuning-tool-for-large-language-models/</link>
  551. <dc:creator><![CDATA[gallagherseanm]]></dc:creator>
  552. <pubDate>Fri, 13 Dec 2024 11:30:50 +0000</pubDate>
  553. <category><![CDATA[AI Research]]></category>
  554. <category><![CDATA[deepspeed]]></category>
  555. <category><![CDATA[featured]]></category>
  556. <category><![CDATA[LLM]]></category>
  557. <category><![CDATA[LLM tuning]]></category>
  558. <guid isPermaLink="false">https://news.sophos.com/en-us/?p=958840</guid>
  559.  
  560. <description><![CDATA[SophosAI’s framework for upgrading the performance of LLMs for cybersecurity tasks (or any other specific task) is now open source. ]]></description>
  564. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_asset-generation-6dc4f763-f8a7-4dff-a56b-92736d8c8d6c-1_edited-e1734048709973.jpeg?w=230&#38;h=130&#38;crop=1" medium="image" alt="" />
  565. <post-id xmlns="com-wordpress:feed-additions:1">958840</post-id>
  566. <media:thumbnail url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_asset-generation-6dc4f763-f8a7-4dff-a56b-92736d8c8d6c-1_edited-e1734048709973.jpeg" alt="" />
  567. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/shutterstock_asset-generation-6dc4f763-f8a7-4dff-a56b-92736d8c8d6c-1_edited-e1734048709973.jpeg" medium="image" alt="">
  568. <media:title type="html">shutterstock_asset-generation-6dc4f763-f8a7-4dff-a56b-92736d8c8d6c-1_edited</media:title>
  569. </media:content>
  570.  
  571. <media:content url="https://news.sophos.com/wp-content/uploads/2024/12/Slide1.jpeg" medium="image" alt="" />
  572. </item>
  573. </channel>
  574. </rss>
  575.  

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda