Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Matt Wixey
Laughter in the dark: Tales of absurdity from the cyber frontline and what they taught us
Cybersecurity is usually a serious business, and for good reason. If you’re reading this article, you likely don’t need reminding about the very real risks of falling victim to cybercrime: financial and reputational loss, disruption, and psychological and physical harm. But, just occasionally, Sophos X-Ops comes across threat actors who change the tone – whether that’s through sheer audacity, genuine wit, or complete and utter ineptitude.
WhatsApp Worm Targets Brazilian Banking Customers
Counter Threat Unit™ (CTU) researchers are investigating multiple incidents in an ongoing campaign targeting users of the WhatsApp messaging platform. The campaign, which started on September 29, 2025, is focused on Brazil and seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session.
La strana storia di ischhfd83: quando i cybercriminali si attaccano a vicenda
In Sophos X-Ops riceviamo spesso domande dai nostri clienti per sapere se sono protetti da alcune varianti di malware. A prima vista, una recente richiesta sembrava come tante altre: un cliente voleva sapere se avessimo protezioni contro “Sakura RAT”, un progetto malware open-source ospitato su GitHub, in seguito ad articoli che lo descrivevano come dotato di “sofisticate capacità di elusione”. Approfondendo Sakura RAT, ci siamo accorti subito di due cose.
The strange tale of ischhfd83: When cybercriminals eat their own
At Sophos X-Ops, we often get queries from our customers asking if they’re protected against certain malware variants. At first glance, a recent question seemed no different. A customer wanted to know if we had protections for ‘Sakura RAT,’ an open-source malware project hosted on GitHub, because of media claims that it had “sophisticated anti-detection capabilities.” When we looked into Sakura RAT, we quickly realized two things. First, the RAT itself was likely of little threat to our customer.
Prioritizzazione delle patch: un’analisi approfondita di framework e strumenti - Parte 1: CVSS
Nel mese di agosto del 2022, l’unità di ricerca e analisi di Sophos, Sophos X-Ops, ha pubblicato un white paper sugli attaccanti multipli, ovvero gli avversari che prendono di mira più volte le stesse organizzazioni. Una delle nostre raccomandazioni principali emerse da questa ricerca era quella di prevenire gli attacchi ripetuti dando “priorità ai bug peggiori”, ovvero patchando le vulnerabilità critiche o di alto profilo che potrebbero colpire gli stack software specifici degli utenti.
パッチ適用の優先順位付け: フレームワークとツールの分析 - パート 2: 代替フレームワーク
** 本記事は、Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks の翻訳です。最新の情報は英語記事をご覧ください。** このシリーズのパート 1 では、CVSS とその仕組みについて詳細を確認し、CVSS にはいくつかの利点がある一方、優先順位付けの唯一の手段として使用するようには設計されていないと結論づけました。本記事では、修復の優先順位付けに用いることのできるいくつかの代替ツールやシステム、それらの使用方法、および長所と短所を取り上げます。 Black Hat USA 2019 で初めて発表された EPSS は、(CVSSと同じく) FIRST Special Interest Group (SIG) によって管理されています。Black Hat の講演に添付されたホワイトペーパーに記載されているように、EPSS の作成者は、CVSS...
Prioritizing patching: A deep dive into frameworks and tools - Part 2: Alternative frameworks
In the first part of this series, we took a close look at CVSS and how it works, concluding that while CVSS may offer some benefits, it’s not designed to be used as a sole means of prioritization. In this article, we’ll cover some alternative tools and systems for remediation prioritization, how they can be used, and their pros and cons. EPSS, first published at Black Hat USA 2019, is (like CVSS) maintained by a FIRST Special Interest Group (SIG).
パッチ適用の優先順位付け: フレームワークとツールの分析 - パート 1: CVSS
** 本記事は、Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS の翻訳です。最新の情報は英語記事をご覧ください。** 2022 年 8 月、Sophos X-Ops は複数の攻撃者に関するホワイトペーパーを発表しました。これらの攻撃者は、同じ組織を何度も標的にしていました。この調査における重要な推奨事項の 1 つは、「最悪のバグを優先的に修正する」、つまりユーザーの特定のソフトウェアスタックに影響を及ぼす可能性のある重大な、または注目度の高い脆弱性にパッチを適用することによって、繰り返し行われる攻撃を防ぐというものでした。このアドバイスは現在でも有用だと考えていますが、優先順位付けは複雑な問題です。何が「最悪のバグ」かを如何にして判別するのでしょうか。また、組織のリソースはおおよそ同じにもかかわらず、1 年間に公表される CVE の数が 2020 年の 18,325 件から 2022 年には 25,277 件、2023 年には 29,065...
Prioritizing patching: A deep dive into frameworks and tools - Part 1: CVSS
Back in August 2022, Sophos X-Ops published a white paper on multiple attackers – that is, adversaries targeting the same organizations multiple times. One of our key recommendations in that research was to prevent repeated attacks by ‘prioritizing the worst bugs first’: patching critical or high-profile vulnerabilities that could affect users’ specific software stacks. While we think this is still good advice, prioritization is a complex issue. How do you know what the worst bugs are?
Gli aggressori abusano ancora del tool Terminator e delle sue varianti
BYOVD (Bring Your Own Vulnerable Driver) è un tipo di attacco che vede gli aggressori rilasciare driver vulnerabili noti su un computer compromesso e poi sfruttare i bug per ottenere privilegi a livello di kernel. A questo livello di accesso, gli attaccanti possono ottenere molti risultati: nascondere malware, scaricare credenziali e, soprattutto, tentare di disabilitare le soluzioni EDR.
攻撃者に利用され続けるセキュリティ無効化ツール「Terminator」
** 本記事は、It’ll be back: Attackers still abusing Terminator tool and variants の翻訳です。最新の情報は英語記事をご覧ください。** BYOVD （脆弱なドライバーの持ち込み） とは、侵害されたマシンに攻撃者が既知の脆弱なドライバーをインストールし、その脆弱性を悪用してカーネルレベルの特権を獲得する攻撃の一種です。カーネルレベルのアクセス権を得た攻撃者は、マルウェアを隠したり、認証情報をダンプしたり、さらには EDR ソリューションの無効化を試みたりと、多くの攻撃を実行できます。 本記事執筆時点で、脆弱なドライバーと対応するシグネチャおよびハッシュのオープンソースリポジトリである loldrivers.io のリストでは、364 件のエントリが「脆弱なドライバー」とタグ付けされています。そのためか、以前は高度な攻撃者にしか扱えなかった BYOVD 攻撃が、近年ランサムウェアのオペレーターや技術力の低い攻撃者にも用いられるようになってきました。 たとえば、2020 年 2 月にソフォスは RobbinHood...
It’ll be back: Attackers still abusing Terminator tool and variants
BYOVD (Bring Your Own Vulnerable Driver) is a class of attack in which threat actors drop known vulnerable drivers on a compromised machine and then exploit the bug(s) to gain kernel-level privileges. At this level of access, attackers can accomplish a lot: hide malware, dump credentials, and, crucially, attempt to disable EDR solutions.
CryptoGuard : une approche asymétrique pour combattre les ransomwares
Les ransomwares représentent toujours la menace la plus dangereuse à laquelle les entreprises sont confrontées aujourd’hui. La combattre n’est pas une tâche facile, d’autant plus que les acteurs malveillants perfectionnent continuellement leurs techniques et leurs approches.
CryptoGuard: An asymmetric approach to the ransomware battle
** 本記事は、英語記事タイトル の翻訳です。最新の情報は英語記事をご覧ください。** Ransomware is one of the most significant threats facing organizations today. Battling it is no easy task, particularly given that threat actors are continually refining their techniques and approaches.
CryptoGuard: An asymmetric approach to the ransomware battle
Ransomware is one of the most significant threats facing organizations today. Battling it is no easy task, particularly given that threat actors are continually refining their techniques and approaches. Recent shifts, for example, include tweaks to ransomware-as-a-service (RaaS) models; the adoption of new programming languages; evolutions in targeting and deployment; and increasingly launching attacks after business hours and at weekends to hinder detection and incident response efforts.
攻撃者の潜伏を阻止するメモリスキャン
** 本記事は、Memory scanning leaves attackers nowhere to hide の翻訳です。最新の情報は英語記事をご覧ください。** ソフォスのテクノロジーや研究の裏側を読者に詳しくお伝えする Technical Thought Leadership の新シリーズ第一弾として、ソフォスのメモリスキャン保護およびその仕組みについて、概要をご紹介します。 メモリスキャンとは、プロセスのメモリ内 (プロセスイメージや疑わしいモジュール、スレッド、ヒープ領域) で脅威を捜索することを指します。メモリスキャンは、セキュリティ製品によって、さまざまな方法、あるいはタイミングで実行されます。新しいプロセスが作成されたときに実行されることもあれば、システム上の全プロセスまたは一部のプロセスに対して定期的に実行されることもあります。たとえば、マルウェアがプロセスに注入された悪意のあるペイロードを実行しようとする際に CreateRemoteThread (またはその亜種) を呼び出すことや、VirtualAllocEx や WriteProcessMemory...
Memory scanning leaves attackers nowhere to hide
In the first of our new series of technical thought leadership papers, which aim to give readers an in-depth look under-the-hood at some of our technologies and research, we wanted to provide an overview of our memory scanning protection and how it works. Memory scanning – searching within a process’s memory (the process image, and/or suspicious modules, threads, and heap regions) for threats – can be achieved in a variety of ways by security products, and at a variety of times.
For the win? Offensive research contests on criminal forums
If you’re a security researcher who wants to share your innovations and insights with the wider community (and gain some peer recognition into the bargain), you’ve got a few options: present at conferences; write papers, blogs, or Twitter threads; submit CVEs; or enter CTFs (capture-the-flag competitions) and vulnerability research contests like Pwn2Own. The legitimate side of the house is awash with opportunities. But what if you’re a threat actor, whose research is usually more clandestine?
Clustering attacker behavior reveals hidden patterns
A collection of very specific behaviors, observed by Sophos X-Ops incident response analysts in the lead-up to four separate ransomware attacks in the first quarter of 2023, indicates an unexpected connection between the attacks. In the parlance of the Managed Detection and Response (MDR) team, the peculiarly similar details constitute a threat activity cluster that Sophos can track. The Sophos MDR team performed postmortem investigations at the request of the targets.
Patch Tuesday du mois de juillet : une très bonne récolte
Version 2 [Mise à jour 1] publiée à 18h25 UTC, le 14 juillet 2023, ajoutant des informations sur CVE-2023-36884 et mettant à jour les chiffres de manière globale. Publié initialement à 18h38 UTC le 11 juillet 2023] Microsoft vient de publier des correctifs pour 130 vulnérabilités dont 8 problèmes de gravité ‘Critique’ dans Windows et deux autres dans SharePoint.
July’s Patch Tuesday: A rich harvest
Microsoft on Tuesday released patches for 129 vulnerabilities, including seven critical-severity issues in Windows and two in SharePoint. As usual, the largest number of addressed vulnerabilities affect Windows with 104 CVEs, including two that also affect Azure. Office takes 10 patches, including three that it shares with Outlook and one that it shares with Access. SharePoint takes five. Azure takes four, though two of those are shared with Windows as noted above. Microsoft Dynamics takes two.
Un ensemble varié de correctifs dans le Patch Tuesday du mois de février
Microsoft vient de publier, dans le Patch Tuesday du mois de février, des correctifs pour 75 vulnérabilités dans 12 familles de produits Microsoft, dont huit problèmes de gravité ‘Critique’ dans le protocole PEAP (Protected Extensible Authentication Protocol), le service de découverte iSCSI, Office, .NET et Visual Studio. Comme les mois précédents, la majeure partie des vulnérabilités concerne Windows, avec 32 correctifs.
A diverse set of fixes in February’s Patch Tuesday release
Microsoft on Tuesday released patches for 75 vulnerabilities in 12 Microsoft product families, including eight Critical-severity issues in the Protected Extensible Authentication Protocol (PEAP), the iSCSI Discovery Service, Office, and .NET and Visual Studio. As in previous months, the lion’s share of the vulnerabilities affect Windows, with 32 fixes. Microsoft Dynamics 365 and .NET and Visual Studio have the next-largest collections, with six; followed by Office and Azure at five apiece.
Des escrocs qui arnaquent d’autres escrocs sur les forums de cybercriminalité (4ème Partie)
Dans ce quatrième et dernier article de notre série, nous allons voir comment les escrocs qui arnaquent d’autres escrocs peuvent aider les chercheurs. C’est le dernier article de notre série intitulée “des escrocs qui arnaquent d’autres escrocs” ! (Vous avez manqué les précédents articles ? : le premier a présenté l’écosystème, le deuxième a examiné les différents types d’escroquerie et le troisième s’est concentré sur une arnaque spécifique et à grande échelle).
Des escrocs qui arnaquent d’autres escrocs sur les forums de cybercriminalité (3ème Partie)
Une sous-économie souterraine qui est bien plus qu'une simple curiosité : en effet, c'est un business en plein essor, et aussi une opportunité pour les défenseurs. Dans ce troisième article de notre série qui en compte quatre, nous allons nous pencher sur le curieux cas de ces vingt fausses marketplaces.
Des escrocs qui arnaquent d’autres escrocs sur les forums de cybercriminalité (2ème Partie)
Dans ce second article de notre série qui en compte quatre, nous allons passer en revue les différents types d’escroquerie rencontrés sur les forums cybercriminels. Dans la continuité de notre premier article qui traitait des escrocs qui arnaquent d’autres escrocs, nous allons aborder maintenant les différents types d’escroquerie rencontrés sur les marketplaces cybercriminelles : des “rip-and-runs” grossiers aux efforts sophistiqués et sur le long terme.
Des escrocs qui arnaquent d’autres escrocs sur les forums de cybercriminalité (1ère Partie)
Dans ce premier article d’une série de quatre, nous allons passer en revue les forums impliqués et comment ces derniers gèrent les escrocs qui arnaquent d’autres escrocs. Une arnaque se cache à chaque coin de rue sur les marketplaces cybercriminelles.
The scammers who scam scammers on cybercrime forums: Part 4
It’s the last chapter in our ‘Scammers who scam scammers’ series! (Missed the previous instalments? Part 1 introduced the ecosystem, Part 2 looked at the different types of scams, and Part 3 covered a specific, large-scale scam.). In this final article, we’ll look at why scammers on criminal marketplaces (inadvertently) provide useful strategic and tactical intelligence. Many criminal marketplaces demand proof when a scam is alleged, and victims are only too happy to oblige.
Cybercriminals scamming each other
"Cybercriminals are scamming each other out of millions of dollars and use arbitration to settle disputes about the scams." According to Sophos, attackers use classic techniques-some decades old, such as typosquatting, phishing, backdoored malware, and fake marketplaces-to carry out their scams against each other.
The scammers who scam scammers on cybercrime forums: Part 3
A shadowy sub-economy is more than just a curiosity – it’s booming business, and also an opportunity for defenders. In the third part of our series, we look at the curious case of twenty fake marketplaces. Threat Research dread featured genesis marketplaces scams Sophos X-Ops In the first chapter of this series, we provided an overview of the hidden sub-economy of scammers who scam scammers, and in the second we examined the wide variety of scams and tricks within it.
The scammers who scam scammers on cybercrime forums: Part 2
Following on from the first chapter of our investigation into scammers who scam scammers, we turn to the variety of scams on criminal marketplaces – which range from crude ‘rip-and-runs’ to sophisticated, long-term efforts. Rip-and-run One of the most common scams, a ‘rip-and-run’ can work in two ways: A buyer receives goods but doesn’t pay for them, or a seller receives payment but doesn’t deliver.
サイバー犯罪フォーラムにおける詐欺師による騙し合い：Part 2
詐欺師による騙し合いを調査したシリーズ第一弾に続き、今回は犯罪者向けのマーケットプレイスで行われているさまざまな詐欺を取り上げます。詐欺の種類はお粗末な「当て逃げ」から、長期的に続く高度な詐欺まで多岐に渡ります。 Products & Services MDR Sophos MDR セキュリティオペレーション 製品とサービス ** 本記事は、The scammers who scam scammers on cybercrime forums: Part 2 の翻訳です。最新の情報は英語記事をご覧ください。** 地下経済圏は謎に満ちており物珍しいだけでありません。実際に拡大しているビジネスであり、防御側の組織はこの経済圏を理解することで、防御を向上できる機会にすることができます。本シリーズの第二弾では、サイバー犯罪フォーラムで流行しているさまざまなタイプの詐欺を見ていきます。 詐欺師による騙し合いを調査したシリーズ Part...
Cybercriminals are scamming each other, tipping off law enforcement
Cybercriminals are scamming each other out of millions of dollars and use arbitration to settle disputes about the scams, according to Sophos. For this report, Sophos experts investigated two Russian-language cybercrime forums that provide Access-as-a-Service (AaaS) listings, and an English-language cybercrime forum and marketplace specializing in data leaks. All three sites have dedicated arbitration rooms.
The scammers who scam scammers on cybercrime forums: Part 1
A scam lurks around every corner on criminal marketplaces. Way back in 2009, Microsoft pointed out that the underground economy was rife with dishonesty, and in 2017, Digital Shadows reported on a database of ‘rippers’ (fraudsters who con criminals) created by marketplace users.
サイバー犯罪フォーラムにおける詐欺師による騙し合い
地下経済圏は謎に満ちており物珍しいだけでありません。実際に拡大しているビジネスであり、防御側の組織はこの経済圏を理解することで、防御を向上できる機会にすることができます。 Threat Research AaaS BreachForums EXPLOIT 特集 RaidForums Sophos X-Ops XSS マーケットプレイス 脅威調査 詐欺 ** 本記事は、The scammers who scam scammers on cybercrime forums: Part 1 の翻訳です。最新の情報は英語記事をご覧ください。** 犯罪者向けのマーケットプレイスには、いたるところに詐欺師が潜んでいます。遡ること 2009 年、Microsoft は地下経済圏に不正が蔓延していると指摘し、2017 年には Digital Shadows がマーケットプレイス利用者が作成した「リッパー」(犯罪者を騙す詐欺師)...
Microsoft patches 62 vulnerabilities, including Kerberos, and Mark of the Web, and Exchange…sort of
Microsoft on Tuesday released patches for 62 vulnerabilities in nine Microsoft product families. This includes nine Critical-class issues affecting Exchange and Windows. As in previous months, the majority of CVEs affect Windows, with a total of 41 CVEs, followed by eight in Office and four in Exchange. As with October’s release, Azure admins get a welcome breather, with only two patches – one a Remote Code Execution bug, the other an Elevation of Privilege vulnerability, both rated Important.
Are threat actors turning to archives and disk images as macro usage dwindles?
Malicious macros in Office documents have long been a favorite tactic of threat actors. So Microsoft’s announcement in February 2022 that macros in documents originating from the internet would be blocked by default came as welcome news (despite a brief rollback in July). XLM4 macros were also disabled by default in Microsoft 365 as of February 2022. But threat actors have always evolved in response to security developments, and this looks like it will be no exception.
Multiple attackers increase pressure on victims, complicate incident response
There’s a well-worn industry phrase about the probability of a cyberattack: “It’s not a matter of if, but when.” Some of the incidents Sophos recently investigated may force the industry to consider changing this rule-of-thumb: The question is not if, or when – but how many times? In an issue we highlighted in our Active Adversary Playbook 2022, we’re seeing organizations being hit by multiple attackers. Some attacks take place simultaneously; others are separated by a few days, weeks, or months.
Telerik UI exploitation leads to cryptominer, Cobalt Strike infections
Using a methodology first seen in 2020, an unknown threat actor has been exploiting a three-year-old bug in the Telerik UI web application framework to take control of web servers, installing Cobalt Strike beacons and other malware in the process. In the weeks following the initial, 2019 disclosure of the vulnerability, attackers scanned the internet for vulnerable applications. Many server admins were caught off guard by a rapid flurry of attacks that delivered cryptominers.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Matt
Contact Matt, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack