Ivan Mateos

Sophos Iberia Sales Engineer
Las opiniones publicadas por esta cuenta son personales y no corporativas.

[Ivan Mateos @IvanSophos]

Sophos joins Anthropic's Project Glasswing​ ​ | SOPHOS https://t.co/JtSoPdAyzJ

[Cyber Security News @The_Cyber_News]

Ghostcommit Attack Hides Malicious Prompts in Images to Exploit AI Agents

Source: https://t.co/6Ud3ZsEMq7

A novel supply chain attack called "Ghostcommit" that conceals prompt-injection instructions within PNG images to bypass AI code reviewers and trick coding agents into leaking secrets such as .env files.

A pull request containing an explicit, plain-text instruction to exfiltrate a repository's .env file is caught immediately by LLM-based reviewers like Cursor Bugbot and CodeRabbit, which flag the coherent, text-visible exploit as high severity before merge.

To evade this, the researchers split the payload: a harmless-looking AGENTS.md convention file instructs the coding agent to "derive a build constant" from a referenced image, docs/images/build-spec.png, while the actual malicious procedure, reading .env byte by byte and encoding it as ASCII integers, is rendered as text inside the image itself.

#cybersecuritynews

[Ivan Mateos @IvanSophos]

https://t.co/rQXnOlID9F

[Cyber Security News @The_Cyber_News]

⚠️ Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors

Source: https://t.co/64umiUjMHt

A financially motivated threat actor has deployed a custom Golang-based tool called FortigateSniffer across more than 430,000 FortiGate firewalls globally, silently harvesting over 110 million credentials since at least February 2026, including confirmed data exfiltration from a NATO-aligned defense contractor.

The threat actor, assessed to be an Initial Access Broker (IAB) motivated by financial gain, operated continuously through mid-June 2026, running 659 discrete harvest cycles with infrastructure that remains partially active at the time of writing. Tooling with Cyrillic-alphabet comments suggests a possible Russian origin, with potential links to ransomware groups or state-sponsored actors.

#cybersecuritynews

[SophosIberia @SophosIberia]

Los programas de recompensa por errores en la era Mythos

Cómo la IA está transformando la investigación de vulnerabilidades y cómo se ha adaptado nuestro programa

https://t.co/TL2HbKUosk

[SophosIberia @SophosIberia]

Actualización de Sophos Workspace Protection
https://t.co/v7dyepwJ7B

[Cyber Security News @The_Cyber_News]

🚨 FortiBleed – 70,000+ Fortinet Firewalls Compromised in Massive Exploitation Attack

Source: https://t.co/lVtJOueGaF

An exhaustive cyber espionage campaign now dubbed "FortiBleed" has silently compromised over 73,932 unique Fortinet firewall URLs across 194 countries.

Threat actors executed an estimated 1.16 billion credential-based attempts against over 320,000 FortiGate targets, while simultaneously launching an additional 2.1 billion brute-force attempts against more than 160,000 MSSQL servers, resulting in 21,632 unique compromised domains.

This campaign is attributed to a multi-operator, Russian-speaking cybercriminal group whose methodology goes well beyond simple credential stuffing.

#cybersecuritynews

[The Hacker News @TheHackersNews]

EDR bypass doesn’t always mean killing the agent.

A new technique called EDRChoker throttles EDR processes using Windows QoS policies, cutting bandwidth to 8 bits per second.

The agent may still run — but its server connection can time out, weakening telemetry and remote control.

Read more: https://t.co/X36SY6jyy2

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.

[Sophos @Sophos]

AI-driven attacks now move faster than most SOCs can respond. The question isn't whether to adapt. It's what an effective response actually looks like in practice.

Join Sophos experts on June 25 for a working session on defending at AI speed.

Register: https://t.co/sykDjfH6Cr

[SophosIberia @SophosIberia]

Sophos vuelve a ser líder en el Cuadrante Mágico™ de Gartner® de 2026 para la protección de endpoints por decimoséptima vez consecutiva
https://t.co/RSA5399NMb

[Ivan Mateos @IvanSophos]

Otro Ransom Remoto a la lista

[SophosIberia @SophosIberia]

El ransomware WantToCry cifra archivos de forma remota
https://t.co/mA1U4fR09x

[SophosIberia @SophosIberia]

Sophos Endpoint en acción: cómo detener un nuevo ataque a la cadena de suministro
https://t.co/oHegrYhpq6

[Ivan Mateos @IvanSophos]

Cómo trabajar con la «tríada letal»: reducción del alcance del impacto en las implementaciones de agentes de IA | SOPHOS https://t.co/qYAlY4j153

[SophosIberia @SophosIberia]

Cómo trabajar con la «tríada letal»: reducción del alcance del impacto en las implementaciones de agentes de IA
https://t.co/oo02f5bV6E

[SophosIberia @SophosIberia]

Ya está aquí GPT-5.5-Cyber ¿Qué supone para los defensores que trabajan en primera línea?
https://t.co/xH5JmJhODM

[Sophos @Sophos]

Frontier AI is redefining cyber defense. Sophos is proud to join @OpenAI's Trusted Access for Cyber (TAC) Program, gaining secure access to GPT-5.5-Cyber to help organizations detect, investigate, and respond to threats faster.

🔗 https://t.co/jYQWNcpd4I

[Sophos @Sophos]

For five years, Sophos engaged in defensive and counter-offensive operations against China-based, state-sponsored threat actors.

Now @DarknetDiaries, the most popular cybersecurity podcast in the world, has spent 90 minutes telling the full story.

🎧 https://t.co/XfhngKx3C7

[Ivan Mateos @IvanSophos]

GPT-5.5-Cyber is here. What it means for defenders operating at the frontier. | SOPHOS https://t.co/OKjencvYoJ

[Cyber Security News @The_Cyber_News]

⚠️ BitUnlocker Attack on Windows 11 Allows Access to Encrypted Disks in 5 Minutes

Source: https://t.co/dq8KjmuHtP

A new tool, BitUnlocker, reveals a practical downgrade attack against Microsoft's BitLocker encryption, allowing attackers with physical access to decrypt protected volumes on patched Windows 11 machines in under 5 minutes by exploiting a crucial gap between patching and certificate revocation.

The attack is rooted in CVE-2025-48804, one of four critical zero-day vulnerabilities. Systems that have completed the KB5025885 migration, moving the boot manager signature to the newer Windows UEFI CA 2023 certificate, are also protected against this downgrade path.

#cybersecuritynews #Windows11