Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Devil's advocate? Uncensored Luciferus AI service advertised underground

Sep 14, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On August 24, 2026, Counter Threat Unit (CTU) researchers observed an Exploit underground forum persona named “Optimus_Prime” advertising an uncensored AI subscription service named Luciferus. The persona joined Exploit on April 18, and their profile displays a “coding / coder” activity label. As of September 4, the persona has published 21 posts on the forum.
Read Post
sophos

ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

Sep 14, 2026 By Marchelle David In Sophos
Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI Era threats. If you’ve opened the Enterprise ATT&CK matrix recently, you may have done a double-take. The familiar Defense Evasion column is gone.
Read Post
sophos

"Eye" spy: Cyclops Blink returns with extended capabilities

Sep 11, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In August 2026, Counter Threat Unit (CTU) researchers analyzed a malicious 64-bit Linux executable named timezone_check that was discovered on multiple compromised Cisco Firewall Management Center (FMC) devices. The sophisticated modular implant provides persistent remote access to a compromised Linux system.
Read Post

Ungentlemanly behavior: Insights into a ransomware operation

Sep 9, 2026 By Sophos In Sophos
They call themselves The Gentlemen Behind the name is one of the most active ransomware operations of the past 12 months, linked to 683 victims and a playbook built around compromised credentials, legitimate tools, rapid privilege escalation, and aggressive defense evasion. In this video, Susie Evershed and Rafe Pilling break down the latest research from Sophos Counter Threat Unit (CTU), revealing how some affiliates can move from initial compromise to ransomware deployment in less than 24 hours.
View Video
Sophos To Bring OpenAI GPT Cyber Models Into Managed Risk Offering, Helping Defenders Validate Exploit Paths

Sophos To Bring OpenAI GPT Cyber Models Into Managed Risk Offering, Helping Defenders Validate Exploit Paths

Sep 7, 2026 By Sophos In Sophos
The company is building a new Exploit Path Verification (EPV) capability that will tell security teams which vulnerabilities an attacker can reach in their environment, turning long exposure lists into evidence-backed priorities.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.