Sophos Endpoint
Endpoint protection with Intercept X anti-ransomware technology and EDR.
Product pageSophos
United Kingdom3 products listed
Sophos Fusion is the industry’s most complete cyber defense system. It sees everything, connects everything, and enables your defenses to respond as one.
Our summaryBritish security company offering endpoint protection, firewalls and managed detection and response. Sophos X-Ops publishes threat research.
- Products listed
- 3
- Research stories
- 15
- Incidents and advisories
- 3
- Indicators
- 10
Sophos in our news, month by month
ResearchIncidents and advisories
3
May
2
3
Jun
2
Jul
1
Aug
2
Sept
Oct
Products and the controls they provide
Sophos MDR
Managed detection and response, 24/7, including for other vendors' tools.
Product pageSophos Firewall
Next-generation firewall with intrusion prevention.
Product pageExternal reviews
Independent tests, peer reviews and articles about Sophos. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by Sophos
Stories in our coverage based on what researchers at Sophos found or reported: 15 in total.
- 9 Sept 2026F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Malware injects PHP web shell into memory on F5 BIG-IP APM, evading disk-based detection.
- 8 Sept 2026Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Hackers deploy Linux rootkit on F5 BIG-IP APM devices via RCE vulnerability.
- 14 Aug 2026APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
HoneyMyte APT group's CoolClient backdoor now includes a kernel-level Windows rootkit.
- 30 Jul 2026Microsoft Teams vishing attacks lead to Chaos ransomware attacks
Microsoft Teams vishing campaign STAC4749 deploys Chaos ransomware against North American organizations.
- 8 Jul 2026AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
AI coding agents are triggering endpoint security rules designed to catch attackers.
- 4 Jun 2026Hola Browser for Windows compromised to deliver cryptominer
Hola Browser Windows version compromised to deliver undeclared Monero cryptominer to 0.1% of users.
- 2 Jun 2026AI-built ransomware toolkit automates EDR evasion, AD discovery
AI-assisted ransomware toolkit automates EDR evasion and Active Directory discovery in cybercriminal operations.
- 7 May 2026Hackers Use Fake Claude AI Site to Infect Users With New Beagle Malware
Hackers use fake Claude AI site to distribute new Beagle backdoor malware via malvertising.
- 4 May 2026Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
Phishing campaign VENOMOUS#HELPER targets 80+ orgs using SimpleHelp and ScreenConnect RMM tools for persistent access.
- 25 Apr 2026CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline
CISA adds 4 actively exploited vulnerabilities to KEV catalog with May 2026 federal deadline.
Incidents and advisories
Stories where a Sophos product had a vulnerability or was attacked, or Sophos itself was: 3 in total. Useful if you run its products.
- 23 Jun 2026FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
FortiBleed operation harvests 110 million credentials from FortiGate firewalls.
- 18 Jun 2026Gentlemen ransomware uses multiple EDR killers to disable defenses
Gentlemen ransomware uses multiple EDR killers to disable defenses.
- 3 Jun 2026Attackers Use AI to Automate EDR Evasion Testing
Attackers automate EDR evasion testing using Python scripts against major endpoint security products.
Indicators from these stories10 indicators · show· hide
| Type | Indicator | Story |
|---|---|---|
| malware | forticheck | FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation |
| malware | FortigateSniffer | FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation |
| malware | FortiProbe-fast | FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation |
| malware | HASHBOT | FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation |
| malware | GentleKiller | Gentlemen ransomware uses multiple EDR killers to disable defenses |
| malware | HavocKiller | Gentlemen ransomware uses multiple EDR killers to disable defenses |
| malware | HexKiller | Gentlemen ransomware uses multiple EDR killers to disable defenses |
| malware | OxideHarvest | Gentlemen ransomware uses multiple EDR killers to disable defenses |
| malware | SystemBC | Gentlemen ransomware uses multiple EDR killers to disable defenses |
| malware | ThrottleBlood | Gentlemen ransomware uses multiple EDR killers to disable defenses |
Vendor Watch
Run Sophos?
Get an email when a reviewed story names Sophos, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
From Sophos
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.