Customize Consent Preferences

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.

The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... 

Always Active

Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

No cookies to display.

Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

No cookies to display.

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

No cookies to display.

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

No cookies to display.

Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns.

No cookies to display.

Connect with us

Telecom

Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries

Published

on

Kindly share this post

Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.

The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.

The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.

Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.

After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.

While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.

Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.

Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.

“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.

“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.

“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.

“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.

“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”

Highlights of the Report

●        On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”

●        In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.

●        After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.

●        Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.

●        A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.

●        In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.

“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.

“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.

“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.

“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.

“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”

Industry Quotes About Sophos’ Pacific Rim Report

“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.

“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.

“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.

“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”

“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.

“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”

“At NCSC-NL, one of our tasks is to share information and connect organisations.

“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.

“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.

Advice for Defenders

Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.

●        Minimize internet-facing services and devices when possible

●        Prioritize patching with urgency for internet-facing devices and monitor these devices

●        Enable hotfixes for edge devices to be allowed and applied automatically

●        Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs

●        Create a plan for how your organization deals with EOL devices

“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.

In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

MTN’s ₦31.75Bn Investment in Health Lauded at Arthur Mbanefo Lecture

Published

on

ARTHUR MBANEFO
Kindly share this post

MTN Foundation has been spotlighted as a model for private sector-driven healthcare development in Nigeria, following commendations at the 6th Arthur Mbanefo Lecture held at the University of Lagos, Akoka.

ARTHUR MBANEFO

Themed “A Healthy Nation is a Wealthy Nation: The Role of Impact Investments and Sustainable Financing in Nigeria,” the lecture featured Dr. Tolulope Adewole, Managing Director of NSIA Advanced Medical Services Limited (MedServe), as keynote speaker.

Dr. Adewole praised the Foundation’s strategic investments, noting that MTN commits 1% of its profit after tax annually to development sectors. “They’ve invested ₦31.75 billion, reaching over 32 million Nigerians. Though only 25% went to health, it accounted for 51% of all lives impacted. That’s catalytic,” he said.

He cited MTN’s dialysis centre programme as a transformative intervention for patients with kidney disease, and highlighted community-focused initiatives like the Y’ello Doctor mobile scheme and ‘What Can We Do Together’ (WCWDT) programme, which revitalised 164 Primary Healthcare Centres, including 44 in 2024 alone.

Executive Director of MTN Foundation, Odunayo Sanya, reflected on the COVID-19 pandemic’s exposure of systemic health vulnerabilities. “When COVID hit, we realised a health emergency is also an economic and social emergency,” she said.

Sanya revealed that of the 52 PHCs remodeled in 2024, only one had clean water. “I’m not a doctor, but I know you can’t live a good life without clean water,” she added, reaffirming the Foundation’s commitment to bridging healthcare gaps in underserved communities.


Kindly share this post
Continue Reading

Telecom

PIN to Empower 20 Million Youths with New Digital Rights Board Game

Published

on

Kindly share this post

Hundreds of university students across Africa are set to benefit from a new gamified learning experience on digital rights and inclusion launched by the leading pan-African non-profit organisation, Paradigm Initiative (PIN).

The Digital Rights and Inclusion Board Learning Experience (DRIBLE) is a game developed by Paradigm Initiative with support from the Open Society Foundations (OSF). The custom-designed board game provides young individuals with a fun and engaging entry point into digital rights and inclusion conversations, training sessions and storytelling tools.

The board game aims to build digital literacy, deepen understanding of online safety, and introduce young individuals to the organisation’s tools of impact. Currently being piloted in three universities: University of Lagos, Nigeria, the Catholic University of Eastern Africa (CUEA) in Nairobi, Kenya and the Dakar American University of Science and Technology (DAUST) in Dakar, Senegal, it will enhance interactions and create a holistic experience.

Speaking at the event launch at the University of Lagos, Nigeria, ‘Gbenga Sesan, Paradigm Initiative’s Executive Director, said: “PIN’s vision is to reach 20 million people through our Digital Inclusion and Digital Rights interventions. From Lagos, to Dakar, to Nairobi.. we will use the vehicle of our new Digital Rights and Inclusion Board Learning Experience (DRIBLE) which entails using gamification, training, multimedia materials, tools and other interventions to connect African youth with digital opportunities and protect their digital rights.”

‘Gbenga gave the keynote address on “Digital inclusion at PIN, our Past, Present and Future” and Nnenna Paul-Ugochukwu, the organisation’s Chief Operating Officer, said the goal of the learning experience would be instrumental in raising awareness of digital rights among the youth, building their capacity to address digital rights and inclusion issues in their communities. Prof. Olunifesi Adekunle Suraj shared a goodwill message with the students and other stakeholders.

Paradigm Initiative, which has been operational since 2007, started in a tiny cybercafe in Ajegunle, Lagos, Nigeria. Today, the organisation has expanded its wings to cover six African countries; Cameroon, Kenya, Nigeria, Senegal, Zambia and Zimbabwe, impacting the livelihoods of over 150,000 young Africans.

The launch of DRIBLE builds on the progress the organisation has made over the years in tackling the challenge of digital exclusion across Africa.

Paradigm Initiative’s tools of impact include Ripoti, a platform that enables individuals to report digital rights violations, Ayeta, a platform that provides digital security resources for stakeholders, more so human rights activists, defenders, journalists and other vulnerable groups, and the organisation’s latest short film, Whispers in the Wires.

Targeted at students, PIN rolled out a Campus Tour in the three universities on the continent starting July 15th, 2025.


Kindly share this post
Continue Reading

Telecom

Meta Cracks Down on Fake Accounts, Deletes 10m Profiles

Published

on

Kindly share this post

Meta, the parent company of Facebook, has intensified its crackdown on fake accounts and spam, announcing it removed over 10 million fake profiles and roughly 500,000 spam accounts in the first half of 2025.

The sweeping purge is part of Meta’s broader effort to combat impersonation, fake engagement, and content duplication, aiming to elevate authentic creators and improve the quality of content across its platforms.

In a blog post, Meta said: “We’re making progress. In the first half of 2025, we took action on around 500,000 accounts engaged in spammy behaviour or fake engagement. We also removed about 10 million profiles impersonating large content producers.”

Meta stressed that accounts which primarily repost or recycle content without meaningful edits will face penalties such as reduced reach and the loss of monetisation tools.

The company also warned that repeatedly sharing unoriginal content — whether videos, photos, or text — undermines the platform’s integrity by crowding out genuine voices and making it harder for new creators to grow.

To support authentic creators, Meta is rolling out new tools that automatically trace reposted content back to its original source. The company says this will help ensure rightful credit and give higher visibility to original posts.

“Pages and profiles that post mostly original content tend to enjoy wider distribution across Facebook. Simply stitching clips together or adding a watermark will no longer count as meaningful editing. Content that provides real value and tells an authentic story is likely to perform better,” Meta explained.

Creators are also being cautioned against uploading content that includes watermarks from other platforms. Such posts could see their reach restricted or lose monetisation privileges altogether.

As part of its latest update, Meta introduced post-level insights on the Professional Dashboard, allowing creators to monitor how individual posts perform. They can also check their Support Home screen to see if their content or earnings are facing restrictions.

In a parallel development, Google’s YouTube updated its monetisation guidelines, stating that content deemed mass-produced or excessively repetitive will no longer qualify for ad revenue. The announcement initially sparked concern among creators, who feared it was a blanket ban on AI-generated content. YouTube later clarified:

“We welcome creators using AI tools to enhance their storytelling, and channels that use AI in their content remain eligible to monetise.”

Both tech giants say these new policies are aimed at raising content standards and safeguarding genuine creators in a crowded and rapidly evolving digital landscape.


Kindly share this post
Continue Reading

Trending