The Bite from Inside: The Sophos Active Adversary Report

On May 20, 2025, CNN reported that a ransomware attack had triggered a “system-wide technology outage” at Kettering Adventist Health in Ohio. Disclosures by Kettering Health would later explain that the healthcare system had been attacked by InterLock, a ransomware gang who were threatening to destroy data and publish data if their demands were not……

Laurie Chen, Farah Master and Liz Lee report: China accused the United States National Security Agency (NSA) on Tuesday of launching “advanced” cyberattacks during the Asian Winter Games in February, targeting essential industries. Police in the northeastern city of Harbin said three alleged NSA agents to a wanted list and also accused the University of…

Redis has patched a use-after-free in its blocking-client code that lets an authenticated user run arbitrary OS commands on the machine hosting the database. The flaw was found by an autonomous AI tool built to hunt bugs in large codebases. Tracked as CVE-2026-23479, the flaw was introduced in Redis 7.2.0 and remained in every stable…

Cybersecurity researchers have lifted the lid on the threat actors’ exploitation of a now-patched security flaw in Microsoft Windows to deploy the PipeMagic malware in RansomExx ransomware attacks. The attacks involve the exploitation of CVE-2025-29824, a privilege escalation vulnerability impacting the Windows Common Log File System (CLFS) that was addressed by Microsoft in April 2025,

The SK Telecom breach, which has already generated significant coverage on this site and other outlets, continues to make headlines.  This time, it is because after announcing they were accepting full responsibility for the breach, they sued to overturn a $91 million monetary penalty imposed by regulators, and have now rejected a settlement proposal that……

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary’s previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. “StormEncryptor is written in C++ and appends the file name extension .encrypted