Telecom
Cybercriminals Are Doubling Down on Credential Theft, Launching More Innovative Ransomware Attacks – Sophos 2023 Threat Report Reveals
Sophos, a global leader in innovating and delivering cybersecurity as a service, has on Monday published its 2023 Threat Report.
The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service.
The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.
Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up.
Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.
“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors.
“For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities.
“The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”
With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.
“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.
Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.
“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.
The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”
Sophos also analyzed the following trends:
·The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.
· Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in“bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.
· Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.
· The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.
To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.
Telecom
IHS Nigeria Hosts Telecom Industry Stakeholders to Discuss Protection of Critical National Infrastructure in Lagos State
IHS Nigeria, part of the IHS Holding Limited (NYSE: IHS) (“IHS Towers”) group, one of the largest independent owners, operators, and developers of shared communications infrastructure in the world by tower count, recently hosted a high-level meeting of stakeholders in the telecommunications industry including regulators and law enforcement agencies, at its corporate headquarters in Lagos.
The meeting was organized to develop a multi-stakeholder action plan for the protection of Critical National Information Infrastructure (CNII) assets in Lagos state.
Recognizing the importance of communications infrastructure as the backbone of national security, economic growth and social cohesion, the stakeholders at the meeting convened under the umbrella of the Association of Licensed Telecoms Operators of Nigeria (ALTON) agreed on the urgent need for collaborative solutions to ensure the protection of these vital assets.
The meeting was attended by senior representatives from the telecommunications stakeholder groups and regulatory bodies including the Nigerian Communications Commission (NCC), the Association of Licensed Telecoms Operators of Nigeria (ALTON), Association of Telecommunications Companies of Nigeria (ATCON) and the Lagos State Infrastructure Maintenance and Regulatory Agency (LASIMRA).
Also in attendance were representatives from the Mobile Network Operators (MNOs), and InfraCos as well as the Nigeria Security and Civil Defence Corps (NSCDC), the security agency tasked with the protection of Critical National Infrastructure across the country.
Following extensive deliberations, the stakeholders resolved to establish a working group dedicated to addressing key industry challenges, including the vandalization and theft of telecommunications infrastructure, arbitrary shutdown of base stations, fiber cuts due to road construction and the denial of access by unauthorized individuals by leveraging technology for real-time monitoring and protection, strengthening security measures around telecommunication sites and collaborating more with the security and regulatory agencies to mitigate these challenges.
The stakeholders underscored the need to prioritize deterrence and prevention of these incidents and highlighted the importance of public awareness campaigns to sensitize the host communities and public of the need to protect telecommunications infrastructure in their localities.
Dapo Otunla, Senior Vice President & Chief Corporate Services Officer of IHS Nigeria, commented, “The protection of Critical National Information Infrastructure (CNII) has been a critical concern for all industry stakeholders.
“We are experiencing daily losses of assets, which significantly impact on the quality of service delivered to subscribers. Addressing these issues is paramount to sustaining Nigeria’s digital ecosystem and meeting regulatory expectations.”
Over 1ooo athletes are already set to participate in the upcoming MTN Champs Continental Relays, taking place between April 9 and April 12 at the UNILAG and Yabatech Sports complexes. Organisers anticipate even more registrations before the April 2 deadline.
MTN Champs is Nigeria’s largest grassroots sports competition, a collaboration between MTN Nigeria and Making of Champs (MoC), providing a platform for young athletes to showcase their talents and potentially represent Nigeria on the global stage.
Osaze Ebueku, Senior Manager, Go-to-Market at MTN Nigeria at the opening ceremony of the MTN Champs Classics events in Benin had emphasised the long-term vision behind MTN Champs: “We’re building future Olympians for Nigeria. MTN Champs is about more than competition. It’s about changing lives.”
The continental relays mark the second leg of the MTN Champs Season 3, following the Classics competition in Benin, which saw 4,371 event entries from 2,056 athletes.
As of March 24, the Lagos leg had already recorded 2,821 event entries across different age categories, highlighting the growing enthusiasm around the competition.
The registered athletes are spread across four categories, with 174 in the Cadet (U-14) category, 388 in Youth (U-17), 270 in Junior (U-20), and 279 in the Senior category.
To ensure smooth participation, organisers have outlined important guidelines. Athletes in the Cadet, Youth, and Junior categories must submit a signed Parental Consent Form, while all registered schools and athletes must collect their competition bibs by April 8 at the competition venue to confirm their participation and secure their place on the start list.
Sports enthusiasts can look forward to an electrifying showcase of emerging talent, as young athletes seize the opportunity to prove their skills on a professional stage.
Telecom
Again, Labour Fumes, Threatens Shutdown of Telcos over Non-Implementation of 15 Percent Tariff Reduction
Nigeria Labour Congress (NLC) is threatening to shut down operations of telecommunications companies over their refusal to comment on the 15 percent reduction in telecom tariffs.
Recall that that organised labour, through the NLC, forced the federal government and NCC to reduce the telecommunications tariff hike from 50% to 35% after threatening to shut down telecom operations and the NCC in response to what it saw as exploitative economic policies amidst excruciating suffering, hardship, and deepening poverty.
The government had previously formed a 10-member committee, consisting of five government and NLC representatives, to deliberate on the thorny topic of tariff hikes within two weeks and report back before making a final decision on the new telecom tariff structure.
Consequently, on Friday, February 21, 2025, the committee, at a meeting conducted in the office of the National Security Adviser (NSA) that lasted nearly three hours, decided on a 15 per cent tariff cut.
According to reports, in accordance with the conditions of the agreement, an official communiqué announcing the tariff reduction was scheduled to be released on Saturday, February 22.
According to Chronicle,iIt was said that the meeting began at 4:00 p.m. and concluded around 7:00 p.m., during which NLC representatives insisted that the tariff hike be withdrawn.
According to sources, after significant pressure from NLC representatives in the 10-man committee, the government and NCC gave up and agreed on the 15% decrease, which the government or NCC should have announced the next day.
However, at the time of this report, no such announcement has been made.
Leaders of the labour union are not taking the government’s failure to announce or implement the 15% tariff decrease lightly, suspecting that they have been duped.
The Labour leaders have therefore resolved to directly confront the NCC and telecommunications operators next week.
Though it has been reported that the date for the start of the industrial action against the NCC and telecom providers has been set and mobilisation is underway, the information is being closely guarded.
One of the leaders of the NLC stated that “We have received directives to commence mobilisation since last week. In fact, the date for the commencement of industrial action against the NCC and telecommunication operators’ offices across the country has been fixed. We have been warned not to disclose the date because the plan is to take all concerned by surprise. We are not giving any notice because we thought we had resolved this matter over a month ago. It is as if we have been scammed. Therefore, we have decided to confront the matter head-on.”
On February 12, the NLC expressed outrage over telecommunications companies’ tariff hikes, despite an earlier agreement with the Federal Government and the NCC.
According to the Labour union, “If the telecommunications companies fail to revert to the old tariff by the end of February 2025, a total shutdown of their operations nationwide will commence on March 1, 2025.”
To demonstrate its seriousness, the NLC declared that, as a first step in resisting the arbitrary tariff hike, it directed that workers and other willing citizens boycott the services of MTN, AIRTEL, and GLO daily between 11:00 a.m. and 2:00 p.m. until the end.
On Tuesday, February 11, NLC leaders issued a communiqué at the conclusion of their Central Working Committee (CWC) meeting in Lokoja, Kogi State, urging workers and citizens to suspend data purchases from telecommunications companies, which have also become one of their most effective tools for exploiting Nigerian citizens.
The communiqué, signed by Joe Ajaero and Emma Ugboaja, Congress’ President and General Secretary, respectively, instructed NLC State Councils and industrial union affiliates to quickly sensitise and mobilise their members and the general public in their jurisdictions.
Titan Trust Bank Selects Oracle FSS for Core and Digital Banking Technology
IMF Appoints Elumelu, Nigerian Businessman to Advisory Council
NCS to Launch Electronic System for Cash Declarations at Airports
IHS Nigeria Hosts Telecom Industry Stakeholders to Discuss Protection of Critical National Infrastructure in Lagos State
Aquaterra Energy Secures Multi-million-dollar well Intervention Contract with Intrepid Energy in Nigeria
Telecom2 days agoAgain, Labour Fumes, Threatens Shutdown of Telcos over Non-Implementation of 15 Percent Tariff Reduction
News2 days agoNNPC Ready to Go to Capital Market for IPO- CFIO
E-Business2 days agoFG Launches Online Visa Approval Centre
E-Business2 days agoQNET Disassociates From Fraudulent Academy in Abuja, Supports EFCC Arrest
E-Business2 days agoFirm Discovers Sophisticated Chrome Zero-day Exploit Used in Active Attacks
Telecom1 day agoIHS Nigeria Hosts Telecom Industry Stakeholders to Discuss Protection of Critical National Infrastructure in Lagos State
E-Business2 days agoNITDA Partners JICA to Launch Nigeria-Japan Startup Hub
E-Financial2 days agoFintech, Remittances Anchor Africa’s Booming Payments System