Sophos, a global leader of innovative security solutions for defeating cyberattacks, today shares details of a new ransomware group called Mad Liberator in a post entitled "Don't Get Mad, Get Wise." Having first emerged in July 2024, the group uses an unusual social-engineering tactic to gain access to the victim's environment. Based on a recent Sophos X-Ops incident response investigation, Mad Liberator targets victims using remote access tools, such as Anydesk, installed on endpoints and servers, to request access and take control of the device. What's unusual about this approach is that Sophos X-Ops researchers found no indication of contact between the attacker and victim prior to the victim receiving an unsolicited Anydesk connection desk. Once the attacker sends an Anydesk connection request: "We have seen ransomware groups come and go, and this may be the same for Mad Liberator but this new mode of exploitation of remote-access tools is proof of a wider trend in the ransomware industry.