Sophos

Heads up, ScreenConnect users: we’re seeing malicious activity involving unauthorized deployments.

Sophos MDR is actively hunting. Check for unexpected deployments or remote commands, including from curl.exe or PowerShell.

What we’re seeing + IOCs: sophos.com/en-us/blog/mal…

Cybercrime keeps making headlines.

French authorities attributed a cyberattack affecting hundreds of supermarket refrigeration systems to an Iran-linked group. Sophos’ Rafe Pilling spoke to the @WSJ about why attackers target systems like these.

🔗 wsj.com/world/europe/f…

Good news: Retailers are recovering faster and paying ransoms less often.

Bad news: 62% of ransomware attacks now encrypt data, up from 48% last year.

Prevention still has ground to make up.

Read the latest State of Ransomware in Retail 2026 report: sophos.com/en-us/blog/the…

Most phishing attacks target credentials. Evil Tokens goes after an authenticated Microsoft 365 session.

Watch Marlene Jones break down session theft and how Sophos MDR stopped a real-world attack before the token could be abused.

Learn more: sophos.com/en-us/resource…

AI is moving beyond experimentation in cyberattacks.

Sophos Counter Threat Unit researchers found GOLD OGRE using AI to support Aur0ra ransomware operations, from network discovery to command execution and lateral movement.

Read the full analysis: sophos.com/en-us/blog/ai-…