Threat Research by Sophos

• Threat Intelligence Executive Report – Volume 2025, Number 5

  This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during July and August

• F5 network compromised

  On October 15, 2025, F5 reported that a nation-state threat actor had gained long-term access to some F5 systems and exfiltrated data, including source code and information about undisclosed product vulnerabilities. This information may enable threat actors to compromise F5 devices by developing exploits for these vulnerabilities. The UK National Cyber Security Centre also notes […]

• October Patch Tuesday beats January ’25 record

  Microsoft throws a farewell party for Win10, Office 2016, and Office 2019… a very big party

• WhatsApp Worm Targets Brazilian Banking Customers

  Counter Threat Unit™ (CTU) researchers are investigating multiple incidents in an ongoing campaign targeting users of the WhatsApp messaging platform. The campaign, which started on September 29, 2025, is focused on Brazil and seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session. […]

• HeartCrypt’s wholesale impersonation effort

  How the notorious Packer-as-a-Service operation built itself into a hydra

• GOLD SALEM’s Warlock operation joins busy ransomware landscape

  The emerging group demonstrates competent tradecraft using a familiar ransomware playbook and hints of ingenuity

• September Patch Tuesday handles 81 CVEs

  The last round of fixes before Win 10’s final shout touches 15 product families, including Xbox

• Velociraptor incident response tool abused for remote access

  This approach represents an evolution from threat actors abusing remote monitoring and management tools

• Threat Intelligence Executive Report – Volume 2025, Number 4

  This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during May and June

• August Patch Tuesday includes blasts from the (recent) past

  Microsoft haul this month covers 109 CVEs… more or less