Tag: Sophos
Sandboxie abuse turns the tool into a China-linked loader
Sophos has tied a previously undocumented cluster to eight DLL sideloading chains that leaned on signed, everyday Windows tools.
PoisonedRefresh rootkit keeps F5 web shells invisible to disk scans
A fileless rootkit dubbed PoisonedRefresh injects PHP web shells into the memory of compromised F5 BIG-IP APM appliances.