Category: SophosLabs Uncut

Providing Solutions

Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack

A new ransomware operator uses stealthy techniques, but borrows heavily from other players.

Phishing and malware actors abuse Google Forms for credentials, data exfiltration

Earlier this year as we researched malware use of Transport Layer Security-based communications to conceal command and control traffic and downloads, we found a disproportionate amount of traffic going to Google cloud services. Among the destinations we found in telemetry were a host of Google Forms pages. The abuse of legitimate public cloud services by…
Read more

Cring ransomware group exploits ancient ColdFusion server

The rarely-seen ransomware family leveraged commercial remote access tools to move laterally on the network