Sophos X-ops

Advanced Threat Response Joint Task Force

x-ops-banner

Latest Research

See More

Ransomware documentary video

 

Think You Know Ransomware?

A gripping documentary that delves into the alarming realities of ransomware, revealing the far-reaching consequences that affect both business owners and society at large.

Watch All Episodes

Cybersecurity threats are complex and sophisticated.

Sophos X-Ops brings together deep expertise across the attack environment to defend against even the most advanced threats.

  • Deep malware analysis and response expertise from the SophosLabs threat experts
  • Real-time intelligence from the Sophos Managed Threat Response threat hunting and neutralizations specialists
  • The frontline incident response experience of Sophos Rapid Response
  • World-leading deep learning capabilities from Sophos AI
  • Security operations expertise from the team running Sophos’ own defenses

Deeper Understanding Drives Better Defenses

Sophos X-Ops provides unparalleled insights into how threats are built, delivered, and operate in real time, revealing the full attack picture. Armed with this deep understanding, Sophos is able to build powerful, effective defenses against even the most advanced threats.

 

 

Sharing Threat Intelligence to Enable Defenders

Sophos is committed to transparency and openness with threat intelligence to enable businesses, governments, and individuals to better defend themselves from adversaries. Sophos X-Ops regularly publishes threat research on our blog and participates in conferences and industry events.

Resources

Sophos X-Ops brings together deep expertise across the attack environment to defend against even the most advanced threats.

Active Adversary Multiple Attackers Report

In recent months, we’ve noticed an uptick in the number of cases where organizations have been attacked multiple times. Some attacks take place simultaneously; others are separated by a few days, weeks, or months. Some involve different kinds of malware, or double – even triple – infections of the same type. 

Sophos 2023 Threat Report

The cybercriminal economy has increasingly transformed into an industry. Information technology companies have shifted to “as-a-service” offerings, and the cybercrime ecosystem has done the same. Access brokers, ransomware, information-stealing malware, malware delivery, and other elements of cybercrime operations have lowered barriers to entry for would-be cybercriminals.

Cyberthreats: A 20-Year Retrospective

In security we spend a lot of time trying to decipher the future. Where’s the next technology breakthrough? What are cybercriminals going to do next?

An Insider View Into The Increasingly Complex Kingminer Botnet

Kingminer is an opportunistic botnet that keeps quiet and flies under the radar. The operators are ambitious and capable, but don’t have endless resources – they use any solution and concept that is freely available, getting inspiration from public domain tools as well as techniques used by APT groups.

MyKings: The Slow But Steady Growth of a Relentless Botnet

The botnet known as MyKings wields a wide range of automated methods to break into servers – all just to install cryptocurrency miners.

Cloud Snooper Attack Bypasses AWS Security Measures

An investigation into an attack against a cloud computing server reveals an unusual and innovative way for malware to communicate through Amazon’s firewalls