E-Business
HP Q3 Wolf Security Report Shows What is Helping Threat Actors Hoodwink Detection Tools
HP Inc. issued its third quarter HP Wolf Security Threat Insights Report, finding that archive file formats – such as ZIP and RAR files – were the most common file type for delivering malware, surpassing Office files for the first time in three years.
This report provides an analysis of real-world cyberattacks, helping organizations to keep up with the latest techniques cybercriminals use to evade detection and breach users in the fast-changing cybercrime landscape.
Based on data from millions of endpoints running HP Wolf Security, the research found 44% of malware was delivered inside archive files – an 11% rise on the previous quarter – compared to 32% delivered through Office files such as Microsoft Word, Excel, and PowerPoint.
The report identified several campaigns that were combining the use of archive files with new HTML smuggling techniques – where cybercriminals embed malicious archive files into HTML files to bypass email gateways – to then launch attacks.
For example, recent QakBot and IceID campaigns used HTML files to direct users to fake online document viewers that were masquerading as Adobe. Users were then instructed to open a ZIP file and enter a password to unpack the files, which then deployed malware onto their PCs.
As the malware within the original HTML file is encoded and encrypted, detection by email gateway or other security tools is very difficult.
Instead, the attacker relies on social engineering, creating a convincing and well-designed web page to fool people into initiating the attack by opening the malicious ZIP file. In October, the same attackers were also found using fake Google Drive pages in an ongoing effort to trick users into opening malicious ZIP files.
“Archives are easy to encrypt, helping threat actors to conceal malware and evade web proxies, sandboxes, or email scanners. This makes attacks difficult to detect, especially when combined with HTML smuggling techniques.
“What was interesting with the QakBot and IceID campaigns was the effort put in to creating the fake pages – these campaigns were more convincing than what we’ve seen before, making it hard for people to know what files they can and can’t trust,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.
HP also identified a complex campaign using a modular infection chain, which could potentially enable attackers to change the payload – such as spyware, ransomware, keylogger – mid-campaign, or to introduce new features, like geo-fencing.
This could enable an attacker to change tactics depending on the target they have breached. By not including malware directly in the attachment sent to the target, it is also harder for email gateways to detect this type of attack.
“As shown, attackers are constantly switching up techniques, making it very difficult for detection tools to spot,” comments Dr Ian Pratt, Global Head of Security for Personal Systems, HP Inc. “By following the Zero Trust principle of fine-grained isolation, organizations can use micro-virtualization to make sure potentially malicious tasks – like clicking on links or opening malicious attachments – are executed in a disposable virtual machine separated from the underlying systems.
“This process is completely invisible to the user, and traps any malware hidden within, making sure attackers have no access to sensitive data and preventing them from gaining access and moving laterally.”
HP Wolf Security runs risky tasks like opening email attachments, downloading files and clicking links in isolated, micro-virtual machines (micro-VMs) to protect users, capturing detailed traces of attempted infections.
HP’s application isolation technology mitigates threats that can slip past other security tools and provides unique insights into novel intrusion techniques and threat actor behavior.
By isolating threats on PCs that have evaded detection tools, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals. To date, HP customers have clicked on over 18 billion email attachments, web pages, and downloaded files with no reported breaches.
Dr. Olubunmi Tunji-Ojo, minister of Interior, has announced the launch of an Online Visa Approval Center to eliminate bureaucratic bottlenecks and reduce corruption in the visa application process.
Commissioned by the President in December, the new system ensures that applicants no longer need to visit a visa office, know anyone in the system, or lobby for approvals.
At a stakeholders’ sensitisation workshop on the implementation of the Nigeria Visa Policy (NVP) 2025, yesterday in Abuja, Dr. Tunji-Ojo said the visa is considered a very important document by the government because it is an instrument of migration management and an instrument of economic development.
The minister explained that Nigeria has to strike a delicate balance between national security and, of course, the ease of migration.
“And we think that it’s something that we can do and something we will do.
“We don’t have a physical Visa Approval Center. If you apply for a Nigerian visa anywhere in the world, you do so online. We process it here in Nigeria, and if approved, you receive your e-visa in your email,” he explained.
To enhance efficiency, the government has set a 48-hour deadline for processing e-visas.
“It is unprofessional and unacceptable for the Nigeria Immigration Service not to approve or provide feedback within 48 hours,” the minister stated.
“It breaks my heart that people need to lobby to even get visas to Nigeria. It shouldn’t be so. It shouldn’t be.
“For anybody that is qualified, for anybody that wants to do legitimate activities in Nigeria, such people should be able to come to Nigeria easily. And this is why we are opening our space. Mr. President is interested in foreign direct investments.”
Further, he said Nigeria is interested in partnering with the rest of the world to develop its economy but, “We can’t do that when we allow bottlenecks to hold us down. So these reforms, basically, are aimed at opening our space, enhancing national security, and we hope that the primary responsibilities of the visa scheme will be achieved.”
Kemi Nandap, controller general, Nigeria Immigration Service (NIS), said the NIS would fully digitize its e-visa platform and reduce visa classifications from 79 to 44 to enhance accessibility, transparency, and efficiency in the new visa policy.
She said, “At the core of this policy is the new e-visa platform—a fully digitized, centralized system that revolutionizes how foreign nationals interact with our country’s entry procedures. As part of this transformation, the Nigerian Visa Policy 2024 underwent a comprehensive review, resulting in a significant reduction in visa classifications from 79 to 44.
“These categories have been logically grouped to simplify procedures, reduce complexities, and greatly improve the user experience. Importantly, we have maintained the original purpose and intent of each visa class throughout this reform.”
Mr. Takao Shimokawa, director general, Economic Development Department at the Japan International Cooperation Agency (JICA) has visited the National Information Technology Development Agency (NITDA) to discuss the forthcoming launch of the Nigeria-Japan Startup Hub Project.
Mr. Dejo Olawunmi, director of IT Infrastructure Solutions at NITDA and Mr. Takao Shimokawa, director general, Economic Development Department at the Japan International Cooperation Agency (JICA)
This is in a strategic move to strengthen Nigeria’s startup ecosystem.
During his visit, Mr. Shimokawa was received by Mr. Dejo Olawunmi, director of IT Infrastructure Solutions at NITDA.
Their discussions focused on advancing technological innovation, fostering entrepreneurship, and enhancing venture capital development to support early-stage startups in Nigeria.
The Nigeria-Japan Startup Hub Project is designed to provide Nigerian startups with access to Japanese expertise, mentorship, and investment opportunities.
The initiative aims to create a collaborative environment where local entrepreneurs can scale their businesses by leveraging Japan’s advanced technology and business models.
By bridging Nigerian startups with Japanese investors and industry leaders, the project seeks to drive sustainable growth and innovation in Nigeria’s tech industry.
This partnership underscores the increasing economic and technological cooperation between the two nations, positioning Nigeria as a key player in the global startup landscape.
With the hub set to launch soon, stakeholders anticipate that it will provide critical resources for startups, enabling them to compete in the global market and contribute to Nigeria’s digital economy.
Kaspersky has identified and helped patch a sophisticated zero-day vulnerability in Google Chrome (CVE-2025-2783) that allowed attackers to bypass the browser’s sandbox protection system.
The exploit, discovered by Kaspersky’s Global Research and Analysis Team (GReAT), required no user interaction beyond clicking a malicious link and demonstrated exceptional technical complexity. Kaspersky researchers have been acknowledged by Google for discovering and reporting this vulnerability.
In mid-March 2025, Kaspersky detected a wave of infections triggered when users clicked personalised phishing links delivered via email. After clicking, no additional action was needed to compromise their systems.
Once Kaspersky’s analysis confirmed that the exploit leveraged a previously unknown vulnerability in the latest version of Google Chrome, Kaspersky swiftly alerted Google’s security team. A security patch for the vulnerability was released on March 25, 2025.
Kaspersky researchers dubbed the campaign “Operation ForumTroll”, as attackers sent personalised phishing emails inviting recipients to the “Primakov Readings” forum. These lures targeted media outlets, educational institutions, and government organisations in Russia.
The malicious links were extremely short-lived to evade detection, and in most cases ultimately redirected to the legitimate website for “Primakov Readings” once the exploit was taken down.
The zero-day vulnerability in Chrome was only part of a chain that included at least two exploits: a still-unobtained remote code execution (RCE) exploit that apparently launched the attack, while the sandbox escape discovered by Kaspersky constituted the second stage. Analysis of the malware’s functionality suggests the operation was designed primarily for espionage. All evidence points to an Advanced Persistent Threat (APT) group.
“This vulnerability stands out among the dozens of zero-days we’ve discovered over the years,” said Boris Larin, principal security researcher at Kaspersky GReAT. “The exploit bypassed Chrome’s sandbox protection without performing any obviously malicious operations – it’s as if the security boundary simply didn’t exist.
The technical sophistication displayed here indicates development by highly skilled actors with substantial resources. We strongly advise all users to update their Google Chrome and any Chromium-based browser to the latest version to protect against this vulnerability.”
Google has credited Kaspersky for uncovering and reporting the issue, reflecting the company’s ongoing commitment to collaboration with the global cybersecurity community and ensuring user safety.
Kaspersky continues to investigate Operation ForumTroll. Further details, including a technical analysis of the exploits and malicious payload, will be released in a forthcoming report once Google Chrome user security is assured.
Meanwhile, all Kaspersky products detect and protect against this exploit chain and associated malware, ensuring users are shielded from the threat.
This discovery follows Kaspersky GReAT’s previous identification of another Chrome zero-day (CVE-2024-4947), which was exploited last year by the Lazarus APT group in a cryptocurrency theft campaign.
In that case, Kaspersky researchers found a type confusion bug in Google’s V8 JavaScript engine that enabled attackers to bypass security features through a fake cryptogame website.
NNPC Ready to Go to Capital Market for IPO- CFIO
Again, Labour Fumes, Threatens Shutdown of Telcos over Non-Implementation of 15 Percent Tariff Reduction
FG Launches Online Visa Approval Centre
Court Fixes May 8 for Judgment in MultiChoice, FCCPC Dispute over Price Hike
NITDA Partners JICA to Launch Nigeria-Japan Startup Hub
E-Business3 days agoFG Plans to Link Social Register to NIN for Humanitarian Crisis
Broadcasting3 days agoWe’re Confident in the Super Eagles – Karl Toriola
Telecom3 days agoKeystone Bank Seeks to Join Suit in Tussle over 9Mobile Shares Ownership
E-Business3 days agoFive WhatsApp Business Features Every Small Business Should Be Using
E-Financial3 days agoFG to Harmonise Fiscal Data Across MDAs
News3 days agoSenate Probes Federal Character Violations by NDIC, Others
News2 days agoCourt Throws Out Falana’s Fraud Case against Ekeh, Zinox Boss and Others
E-Financial3 days agoZumax Files N4.1Bn Suit against CBN over ‘Fraudulent’ Receivership