Telecom
Sophos’ Incident Response Report Shows How Cybercriminals Abuse Remote Desktop Protocol in 90% of Attacks
Sophos, a global leader of innovative security solutions that defeat cyberattacks, today released the Active Adversary analysis, “It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024.”
John Shier, senior security advisor at Sophos
The report, which analyzes more than 150 incident response (IR) cases handled by the Sophos X-Ops IR team in 2023, found that cybercriminals abused remote desktop protocol (RDP)—a common method for establishing remote access on Windows systems—in 90% of attacks.
This was the highest incidence of RDP abuse since Sophos began releasing its Active Adversary reports in 2021, covering data from 2020.
In addition, external remote services such as RDP were the most common vector by which attackers initially breached networks; they were the method of initial access in 65% of IR cases in 2023.
External remote services have consistently been the most frequent source of initial access for cybercriminals since the Active Adversary reports were launched in 2020, and defenders should consider this a clear sign to prioritize the management of these services when assessing risk to the enterprise.
“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond. Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise. It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side,” said John Shier, field CTO, Sophos.
In one Sophos X-Ops customer case, attackers successfully compromised the victim four times within six months, each time gaining initial access through the customer’s exposed RDP ports.
Once inside, the attackers continued to move laterally throughout the customer’s networks, downloading malicious binaries, disabling endpoint protection, and establishing remote access.
Compromised credentials and exploiting vulnerabilities are still the two most common root causes of attacks. However, the 2023 Active Adversary Report for Tech Leaders, released last August, found that in the first half of that year, for the first time, compromised credentials surpassed vulnerabilities as the most frequent root cause of attacks. This trend continued through the rest of 2023, with compromised credentials representing the root cause of over 50% of IR cases for the entire year. When looking at Active Adversary data cumulatively over the years from 2020 through 2023, compromised credentials were also the number one “all-time” root cause of attacks, involved in nearly a third of all IR cases. Yet despite the historical prevalence of compromised credentials in cyberattacks, in 43% of IR cases in 2023, organizations did not have multi-factor-authentication configured.
Exploiting vulnerabilities was the second most common root cause of attacks, both in 2023 and when analyzing data cumulatively from 2020 through 2023, accounting for the root cause in 16% and 30% of IR cases, respectively.
“Managing risk is an active process. Organizations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers. An important aspect of managing security risks, beyond identifying and prioritizing them, is acting on the information. Yet, for far too long, certain risks such as open RDP continue to plague organizations, to the delight of attackers who can walk right through the front door of an organization. Securing the network by reducing exposed and vulnerable services and hardening authentication will make organizations more secure overall and better able to defeat cyberattacks,” said Shier.
The Sophos Active Adversary Report for 1H 2024 is based on more than 150 incident response (IR) investigations spanning the globe across 26 sectors.
Targeted organizations are located in 23 different countries, including the United States, Canada, Mexico, Colombia, the United Kingdom, Sweden, Switzerland, Spain, Germany, Poland, Italy, Austria, Belgium, the Philippines, Singapore, Malaysia, India, Australia, Kuwait, the United Arab Emirates, Saudi Arabia, South Africa, and Botswana.
To learn more about the current adversary landscape, read It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024 on Sophos.com.
Central Bank of Nigeria (CBN) and the Nigerian Communications Commission (NCC) have ordered Deposit Money Banks and Mobile Network Operators to settle the long-standing N250bn USSD debt dispute before January 2, 2025.
The CBN and NCC also directed banks to pay the pre-Application Programming Interfaces (API) debt before July 2, 2025.
They also ordered that post-API debts be settled before December 31, 2024.
The directive was issued in a joint cirular titled, “2nd Joint Circular of the Central Bank of Nigeria and the Nigerian Communications Commission on the Resolution of the USSD Debt Issue Between Deposit Money Banks and Mobile Network Operators.”
The circular dated December 20, 2024, was signed by Oladimeji Taiwo, acting director of the Payments System Management Department, CBN, and Chizua Whyte, head of Legal and Regulatory Services, NCC.
The regulators said, “In view of the foregoing, the CBN and the NCC hereby direct DMBs and MNOs as follows: 1. That 60 per cent of all pre-API invoices must be paid as full and final settlement.
“Payment plans (lump sum or installments) must be agreed upon between a concerned DMB and MNO by January 2, 2025. Installments must be based on equal monthly payments, with full payment due by July 2, 2025.
“DMBs must pay 85 per cent of all outstanding invoices issued after the implementation of APIs (i.e., February 2022) by December 31, 2024.
“Similarly, 85 per cent of future invoices must be liquidated within one month of service.”
According to the regulators, the transition to end-user billing will be activated only for DMBs and MNOs that comply with the payment conditions cobtained in the circular.
CBN and the NCC said they would provide further guidance on public enlightenment initiatives related to the transition.
The regulators also directed MNOs to implement the “10-seconds rule” for USSD invoicing.
This implies that any session lasting less than ten seconds will not be billable.
The regulators added, “Failure to comply with the terms outlined in this directive will attract necessary sanctions, ensuring that both DMBs and MNOs uphold their obligations.”
Nigerian Communications Commission (NCC) has unveiled a draft regulatory framework aimed at addressing fraud, spam, and other challenges in the Application-to-Person messaging sector.
The telecom regulator made this announcement in a statement.
The proposed framework, which was introduced during a virtual Stakeholders’ Forum, is said to be a key step towards enhancing the sector’s integrity and ensuring a fair, transparent environment for all parties involved.
The draft framework, presented by Aminu Maida, executive vice chairman, NCC, who was represented by Chizua Whyte, NCC’s acting head of legal and regulatory services, seeks to regulate the A2P messaging space.
The A2P messaging, used for notifications such as bank alerts, promotional campaigns, and government updates, has become a vital communication tool in Nigeria.
However, the sector faces significant challenges, including consumer protection concerns, fraud, and data privacy issues, as well as an unequal distribution of value within the ecosystem.
“The international A2P messaging space in Nigeria faces gaps that have led to issues such as fraud, spam, and data privacy concerns. These challenges threaten the sustainable growth of this communication tool,” the NCC said.
The proposed framework aims to address these challenges by protecting consumers, promoting fair competition, and holding service providers accountable.
“This forum marks a pivotal step towards addressing these challenges. We are here to engage with all stakeholders—operators, aggregators, businesses, service providers, and consumers—to refine the framework and ensure it meets the needs of the entire ecosystem.”
The NCC stressed the importance of inclusivity and collaboration in creating an effective regulatory environment.
Airtel Africa, a provider of telecommunications and mobile money services, has announced the commencement of a second share buyback programme that will return up to $100m to shareholders.
The share buyback reflects the Board’s confidence in the Company’s continued growth potential, the strength of its balance sheet, and the consistent cash accretion at the holding company level.
Furthermore, the buyback remains in line with the Company’s existing capital allocation policy.
According to the company, the programme will be executed in accordance with applicable securities laws and regulations.
The share buy-back programme is expected to be phased over two tranches, with the first tranche commencing today and anticipated to end on or before 24 April 2025.
The first tranche will amount to a maximum of $50m.
The Company has entered into an agreement with Barclays Capital Securities Limited (Barclays) to conduct the first tranche of the buy-back and carry out on-market purchases of its ordinary shares with the Company subsequently purchasing its ordinary shares from Barclays.
Under this agreement, Barclays will act as riskless principal and will make decisions independently of the Company.
The sole purpose of the buy-back programme is to reduce the capital of the Company.
It noted that as such, all shares purchased under the buy-back programme will be cancelled.
In a statement signed by Simon O’Hara, group company secretary, the company noted that the share repurchase process will adhere to pre-set parameters agreed upon with Barclays Capital Securities Limited (Barclays), the executing partner for the first tranche of the buyback programme.
This partnership ensures that purchases are conducted transparently and in compliance with all regulatory requirements.
The buyback will be executed under the authority granted by shareholders during the Annual General Meeting held on July 3, 2024, which permits the repurchase of up to 374,141,187 ordinary shares.
Following the completion of a prior buyback programme, the remaining authority allows for the acquisition of up to 328,842,995 shares.
Additionally, Airtel Africa confirmed its commitment to adhering to the Financial Conduct Authority’s UK Listing Rules 9.6 and the provisions of the Market Abuse Regulation (EU) No. 596/2014, as incorporated into UK domestic law.
The company also clarified that share purchases may occur during closed periods, consistent with these regulations and the agreed parameters.
FG Gives Banks, Telcos Six-Month Deadline to Resolve N250Bn USSD Debt
NCC Launches Initiative to Combat Fraud, Spam Messaging
SEC Restates Commitment to Transparency in Fintech Regulation
Egueke, Former Bank Manager Jailed for $46,900 Fraud
Ecobank Warns against Fraud during Yuletide
UBA Group Sets Foot in France with Full Banking Services
FG Begins N50 Electronic Levy Deductions from Moniepoint, Other Digital Banks
Report Reveals Most Organisations Fear AI-driven Cyberattacks but Lack Key Defences
Nigeria Risks Missing out on $1.2 Trillion AI Opportunity- NigComSat
Firm Sues NIMC, Others On Digital Rights Breach Allegations
Telecom2 days agoFrom Niche App to Global Giant: TikTok’s Controversial Journey
Telecom2 days agoGroup Advocates for Digital Rights at 2024 Internet Governance Forum
Broadcasting2 days agoAero Contractors Celebrates Long-Serving Employees at Award Ceremony
E-Financial2 days agoCBN Permits BDC Operators to Buy FX from NAFEM During Festive Season
Telecom2 days agoPatricia Technologies Begins Repayments to Customers Affected by 2022 Security Breach
Broadcasting18 hours agoAfrica Magic Announces Call for Entries for 11th AMVCA
E-Business18 hours agoOzi Launches to Redefine $460Bn Global Package Delivery Market
Telecom18 hours agoHow Artificial Intelligence is Revolutionizing Business Plans for Entrepreneurs