Telecom
Cyberespionage: NCC Warns of Iranian Hacking Group Targeting Telcos, ISPs
The Nigerian Communications Commission (NCC) has again notified the general public of the existence of another hacking group orchestrating cyberespionage in the African telecoms space.
This is inline with the commission’s commitment to continuously keep stakeholders in the country’s telecoms sector informed, educated and protected.
The warning was contained in a statement released by Dr. Ikechukwu Adinde, Director, Public Affairs, NCC, on Monday in Abuja.
According to the statement, “An Iranian hacking group known as Lyceum (also known as Hexane, Siamesekitten, or Spirlin) has been reported to be targeting telecoms, Internet Service Providers (ISPs) and Ministries of Foreign Affairs (MFA) in Africa with upgraded malware in a recent politically motivated attacks oriented in cyberespionage”.
Information about this cyber attack is contained in the latest advisory issued by the Nigerian Computer Emergency Response Team (ngCERT). The ngCERT rated the probability and damage level of the new malware as high.
According to the advisory, the hacking group is known to be focused on infiltrating the networks of telecoms companies and ISPs. Between July and October, 2021, Lyceum was implicated in attacks against ISPs and telecoms organisations in Israel, Morocco, Tunisia, and Saudi Arabia.
The advanced persistent threat (APT) group has been linked to campaigns that hit Middle Eastern oil and gas companies in the past. Now, the group appears to have expanded its focus to the technology sector. In addition, the APT is responsible for a campaign against an unnamed African government’s Ministry of Foreign Affairs.
By the attackers’ mode of operation, Lyceum’s initial onslaught vectors include credential stuffing and brute-force attacks. So, once a victim’s system is compromised, the attackers conduct surveillance on specific targets. In that mode, Lyceum will attempt to deploy two different kinds of malware: Shark and Milan (known together as James).
Both malware are backdoors. Shark, a 32-bit executable written in C# and .NET, generates a configuration file for domain name system (DNS) tunneling or Hypertext Transfer Protocol (HTTP) C2 communications; whereas Milan – a 32-bit Remote Access Trojan (RAT) retrieves data.
Both are able to communicate with the group’s command-and-control (C2) servers. The APT maintains a C2 server network that connects to the group’s back doors, consisting of over 20 domains, including six that were previously not associated with the threat actors.
According to reports, individual accounts at companies of interest are usually targeted, and then once these accounts are breached, they are used as a springboard to launch spear-phishing attacks against high-profile executives in an organization.
The report suggests that not only do these attackers seek out data on subscribers and connected third-party companies, but once compromised, threat actors or their sponsors can also use these industries to surveil individuals of interest.
However, to guard against this kind of threats, the NCC wishes to re-echo ngCERT reports that multiple layers of security in addition to constant network monitoring is required by telecom companies and ISPs alike to stave off potential attacks.
Specifically, telecom consumers and the general public are advised to:
1. Ensure the consistent use of firewalls (software, hardware and cloud firewalls).
2. Enable a Web Application Firewall to help detect and prevent attacks coming from web applications by inspecting HTTP traffic.
3. Install Up-to-date antivirus programmes to help detect and prevent a wide range of malware, trojans, and viruses, which APT hackers will use to exploit your system.
4. Implement the use of Intrusion Prevention Systems that monitors your network.
5. Create a secure sandboxing environment that allows you to open and run untrusted programs or codes without risking harm to your operating system.
6. Ensure the use of virtual private network (VPN) to prevent an easy opportunity for APT hackers to gain initial access to your company’s network.
7. Enable spam and malware protection for your email applications, and educate your employees on how to identify potentially malicious emails.
For further technical assistance, contact ngCERT on [email protected].
The NCC, as the operator of the telecom sector’s cyber threat response centre (CSIRT), hereby reiterates its commitment active surveillance and monitoring of cyber activities in the sector and will always keep stakeholders in Nigeria’s telecommunications sector updated on potential threats within the cyber space.
This is to ensure that the networks that deliver essential services are safe and that telecom consumers are protected from being victims of cyber attacks.
Taiwo Oyedele, Chairman of the Presidential Committee on Fiscal Policy and Tax Reforms, has dismissed reports that bank accounts not linked to a Tax Identification Number (TIN) will be frozen or automatically debited from January 1, 2026.
Taiwo Oyedele
Oyedele described the claims as false and misleading, warning Nigerians against panic over misinformation surrounding recent tax and financial reforms.
In a post on his X handle Tuesday morning, he wrote: “Don’t let anyone manipulate you. Your bank account is safe. Misinformation makes you panic and fear a reform that is designed to help you.
“When they tell you that your account will be frozen or automatically debited from January 2026, ask them for the evidence in the new law. Be wise.”
He stressed that no provision in the new tax laws authorises the freezing of bank accounts, adding that the rumours are part of widespread misrepresentation of the reforms.
The committee chairman reiterated that the reforms are intended to simplify Nigeria’s tax system and ease the burden on ordinary citizens, not to impose punitive measures on bank customers.
US tech giant, Amazon has disclosed that it blocked more than 1,800 North Koreans from applying for jobs, amid growing concerns that Pyongyang is deploying large numbers of IT workers overseas to earn and launder funds.
Amazon
In a LinkedIn post, Amazon’s Chief Security Officer, Stephen Schmidt, said North Korean nationals have been attempting to secure remote IT roles with companies around the world, particularly in the United States.
He noted that the company recorded nearly a one-third increase in such applications over the past year.
According to Schmidt, many of the applicants operate through so-called “laptop farms” — computers physically located in the US but remotely controlled from abroad.
He warned that the issue is not unique to Amazon and is likely occurring at scale across the tech industry.
He added that common red flags include incorrectly formatted phone numbers and questionable academic credentials.
The issue has previously drawn the attention of US authorities. In July, a woman in Arizona was sentenced to more than eight years in prison for running a laptop farm that helped North Korean IT workers obtain remote jobs at more than 300 US companies.
Officials said the scheme generated over $17 million in revenue for both the woman and North Korea.
Last year, South Korea’s intelligence agency also warned that North Korean operatives were using LinkedIn to pose as recruiters, approaching South Koreans working at defence companies in an attempt to steal sensitive technological information.
“North Korea is actively training cyber personnel and infiltrating key locations worldwide,” Hong Min, an analyst at the Korea Institute for National Unification, told AFP.
He added that, given Amazon’s business model, the motivation behind such operations is largely economic, with a high likelihood of attempts to steal financial assets.
North Korea’s cyber warfare programme dates back to at least the mid-1990s and has since expanded into a cyber unit of about 6,000 personnel known as Bureau 121, according to a 2020 US military report.
In November, Washington announced sanctions against eight individuals accused of being state-sponsored hackers, alleging their illicit activities were carried out to fund North Korea’s nuclear weapons programme.
The US Treasury has also accused North Korea-linked cybercriminals of stealing more than $3 billion over the past three years, primarily through cryptocurrency-related crimes.
Treepz, Africa’s leading mobility and travel technology company, has officially launched direct flight bookings on its platform, enabling customers to search, compare and book flights to more than 210 destinations worldwide, including the United Kingdom, Canada and the United Arab Emirates.
The development marks a major milestone in Treepz’s transition from a mobility provider into a fully integrated travel platform. With the new service, travelers can now complete the entire booking process — from flight search to payment — directly on the Treepz website without relying on multiple agents or third-party platforms.
Speaking on the launch, Mr. Onyeka Akumah, Chief Executive Officer and Founder of Treepz, described the initiative as a defining moment for the company and for travel access across Africa.
He said launching flight bookings to serve customers with flights to over 200 destinations was a major achievement, noting that travelers could now search for flights, enter their details, make payments with their cards, and complete bookings instantly on the platform without delays or switching between multiple websites.
The launch comes at a critical time for the African travel market. December is widely regarded as the busiest travel season on the continent, driven by holiday vacations, family reunions, weddings, festivals and end-of-year celebrations.
Millions of Africans travel locally and internationally during this period, often facing challenges with slow booking systems, unclear pricing and fragmented services.
Treepz’s new flight booking system is designed to address these challenges by offering a faster, more intuitive and reliable experience.
Customers can now search and book flight tickets directly on the Treepz website, compare prices and travel options in real time, make payments using any card option, and complete bookings faster without switching platforms.
Treepz has outlined ambitious plans for 2026, including unlocking access to over six million hotels globally, which will allow travelers to book flights and accommodation together in one seamless flow.
The company also plans to expand its car rental services into Europe and South America, further strengthening its position as a one-stop travel ecosystem.
According to Akumah, these developments will significantly reduce planning time for both leisure and corporate travelers, while giving customers more control and convenience.
Treepz has already facilitated more than six million movements across multiple cities and countries, ranging from daily commutes and corporate transportation to group travel and event logistics. With active operations across Africa and recent expansion into Canada, the company continues to grow its international footprint.
The addition of flight bookings strengthens Treepz’s ability to serve global travelers while maintaining its reputation for reliability and customer-focused service.
By integrating flights, accommodation, ground transportation and experiences into one platform, Treepz is positioning itself as more than a mobility provider.
The company is evolving into a comprehensive travel solution designed for modern travelers who value speed, clarity and convenience.
Industry analysts say the move could redefine travel access across Africa, particularly during peak seasons when demand for efficient booking systems is highest.
With this launch, Treepz has taken a bold step toward building a unified, tech-driven travel ecosystem that connects Africa to the world.
Woherem Proposes Pragmatic Roadmap to End Terrorism and Banditry in Nigeria
AfDB Group Mobilises Global Private Capital to Close Africa’s Financing Gap
FIRS says NIN, CAC Numbers to Serve as Tax IDs from 2026
Oyedele Dismisses Claims Bank Accounts Without TIN Will Be Frozen
Fidelity Bank Bolsters Ikoyi Fire Station with Hoses, Pumps for Safer Communities
Nigeria Records Highest Weekly Cyberattacks in Africa — Report
Cyber Tsunami Hits Nigeria as Breaches Surge 1,047%, esentry Q3 Report Reveals
Minister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers
GenAI Adoption Among African workers Outpace Global Peers
Jumia’s Data Shows Nigerians Turning to Digital Retail to Navigate Inflation Pressures
News2 days agoUS Okays $2.1Bn for Christian Healthcare in Nigeria
General News3 days agoThe Mood Market to Light Up Lagos with a Rooftop Gifting, Food & Lifestyle Fair this Christmas
Broadcasting2 days agoTim Akano Recounts 20-Year Growth, Media Support at NITRA End-of-Year Meet
News2 days agoSERAP Asks Tinubu to Release CTC of Tax Bill
E-Financial2 days agoSterling Bank, Water.org, Sterling One Foundation Partner on WASH Loan for Millions
General News2 days agoLeo Stan Ekeh: A “Rare Avis”, an Unconquerable Entrepreneur
General News2 days agoFCCPC Forces Ikeja Electric Into Compliance, Unseals Headquarters After Rights Breach
- News1 day ago
US Begins Partial Visa Ban on Nigerians January 1