Hello,
I just got hit with Cryptowall 3.0 on Friday and SEP on the infected workstation didn't prevent the attack until it started to detect help_decrypt.txt .png .html files. The endpoint client was up-to-date so I'm not sure why this happened. Wasn't Sophos AV suppose to prevent such malware behaviour from fully executing? Did anyone encounter the same thing?
FYI, Cryptowall managed to delete my shadow copy but luckily I do have backups.
Edit - After reading replies, yes I do use Sophos UTM as well. All the workstations uses Sophos Endpoint Protection.
This thread was automatically locked due to age.
