New Ransomware Strain Abuses Sophos Branding During Execution

Security firm Sophos discovered a novel ransomware using Sopho’s name and logo in its UI. The malware also uses „.sophos“ as the extension for encrypted files. The ransomware has a unique multi-functionality aspect, resembling a general-purpose remote access trojan (RAT) more than traditional ransomware. It communicates with a command-and-control server associated with Cobalt Strike C2 and cryptomining software attacks.

Current Threat

Chinese Cyber Espionage Employing Zero-Days and Botnets to Stay Undetected

Industries impacted: Communication Services, Government

Researchers from Mandiant have released a report detailing newly observed stealth techniques Chinese cyber espionage actors use to stay undetected and complicate attribution. These strategies are used both for initial infection as well as post-compromise and involve complex zero-day exploitation of different software and targeting of routers to hide attacker traffic. This constitutes a continuous evolution in the Chinese TTPs towards a stealthier approach to their operations, remaining under the radar for longer and avoiding leaving clear indicators of compromise.

Rollups