E-Business
Check Point Identifies Trickbot, Emotet and the Log4j Plague as December 2021’s Most Wanted Malware
Check Point Research, the Threat Intelligence arm of Check Point Software Technologies, a leading provider of cyber security solutions globally, has published its latest Global Threat Index for December 2021.
In a month that saw the Apache Log4j vulnerability sweep the internet, researchers reported that Trickbot is still the most prevalent malware, albeit at a slightly lower rate affecting 4% of organizations worldwide (5% in November).
The recently resurgent Emotet has swiftly risen from seventh position to second. CPR also reveals that the most attacked industry continues to be Education/Research.
This month “Apache Log4j Remote Code Execution” is the most exploited vulnerability, affecting 48.3% of organizations globally. The vulnerability was first reported on December 9th in the Apache logging package Log4j – the most popular Java logging library used in many Internet services and apps with over 400,000 downloads from its GitHub project.
The vulnerability caused a new plague, impacting almost half of all companies worldwide in a very short space of time. Attackers are able to exploit vulnerable apps to execute cryptojackers and other malware on compromised servers.
Until now, most of the attacks have focused on the use of cryptocurrency mining at the expense of the victims however, advanced attackers have started to act aggressively and take advantage of the breach on high-quality targets.
“Log4j dominated headlines in December. It is one of the most serious vulnerabilities we have ever witnessed, and due to the complexity in patching it and its easiness to exploit, it is likely to stay with us for many years to come unless companies take immediate action to prevent attacks,” said Maya Horowitz, VP Research at Check Point Software. “This month we have also seen the Emotet botnet move from the seventh most prevalent malware to the second.
Just as we suspected, it has not taken long at all for Emotet to build a strong foothold since it resurfaced in November. It is evasive and is spreading fast via phishing emails with malicious attachments or links.
It is now more important than ever to have a robust email security solution in place and to ensure that users know how to identify a suspicious looking message or attachment.”
CPR revealed this month that Education/Research is the most attacked industry globally, followed by Government/Military and ISP/MSP. “Apache Log4j Remote Code Execution” is the most commonly exploited vulnerability, impacting 48.3% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which affects 43.8% of organizations worldwide. “HTTP Headers Remote Code Execution” remains in third place in the top exploited vulnerabilities list, with a global impact of 41.5%.
Top malware families
*The arrows relate to the change in rank compared to the previous month.
This month, Trickbot is the most popular malware impacting 4% of organizations worldwide, followed by Emotet and Formbook, both with a global impact of 3%.
In Nigeria, Ramnit is the most popular malware impacting 12.64% of organizations in the country, followed by Phorpiex at 10.34% and Formbook with a country impact of 8.05%.
- ↔ Ramnit – Ramnit is a banking Trojan which incorporates lateral movement capabilities. Ramnit steals web session information, enabling the worm operators to steal account credentials for all services used by the victim, including bank accounts, corporate and social networks accounts.
- ↑ Phorpiex – Phorpiex is a botnet (aka Trik) has been since 2010 and at its peak controlled more than a million infected hosts. Known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.
- ↔ Formbook – First detected in 2016, FormBook is an InfoStealer that targets the Windows OS. It is marketed as MaaS in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
Top Attacked Industries Globally:
This month, Education/Research is the most attacked industry globally, followed by Government/Military and ISP/MSP. In Africa the most attacked industry is Communications followed by ISP/MSP and Finance/Banking.
|
|
|
Top exploited vulnerabilities
This month, “Apache Log4j Remote Code Execution” is the most commonly exploited vulnerability, impacting 48.3% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which affects 43.8% of organizations worldwide. “HTTP Headers Remote Code Execution” remains in third place in the top exploited vulnerabilities list, with a global impact of 41.5%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↔ Web Server Exposed Git Repository Information Disclosure- An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
- ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
Top Mobile Malwares
This month, AlienBot takes first place in the most prevalent Mobile malwares, followed by xHelper and FluBot.
- AlienBot – AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker, as a first step, to inject malicious code into legitimate financial applications. The attacker obtains access to victims’ accounts, and eventually completely controls their device.
- xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisements. The application is capable of hiding itself from the user and can even reinstall itself in the event that it was uninstalled.
- FluBot – FluBot is an Android botnet distributed via phishing SMS messages, most often impersonating logistics delivery brands. Once the user clicks the link inside the message, FluBot is installed and gets access to all sensitive information on the phone.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.
A $60 billion Africa AI Fund is set to be established, leveraging public, private, and philanthropic capital. The goal is to build a secure, inclusive, and competitive African AI economy through foundational and catalytic investment, according to a declaration made at the recent Global AI Summit on Africa in Kigali, Rwanda.
The declaration seeks to leverage the potential of AI to drive innovation and competitiveness to advance Africa’s economies, industries, and societies. Second, to position Africa as a global leader in ethical, trustworthy, and inclusive AI adoption.
The declaration also seeks to foster the sustainable and responsible design, development, deployment, use, and governance of AI technologies in Africa.
The memorandum was facilitated by Qhala, Smart Africa, Rwanda’s Centre for the Fourth Industrial Revolution, and supported by the Gates Foundation.
Qhala is an AI enabler dedicated to driving innovation and digital transformation across Africa.
In a statement, Qhala said the declaration outlines shared commitment among African nations to align national strategies with continental goals, safeguard data sovereignty, build digital infrastructure, and foster a sustainable AI innovation ecosystem.
The organisation went on to say Africa’s AI landscape is changing at a fast pace and it is projected to contribute $2.9 trillion to the African economy by 2030.
Shikoh Gitau, CEO of Qhala, said: “This declaration is timely, as Africa’s AI ecosystem is rapidly evolving but remains fragmented and underfunded. This will ensure that Africa takes its place in a leadership role in global AI development.”
Lacina Koné, CEO of Smart Africa, added: “AI is not just technology to us, it’s an African arrow that, when thrown with the right ethical frameworks and inclusive policies, can pierce the way to African digital prosperity and resilience for the benefit of every citizen.”
Federal government has announced plans to roll out an electronic visa (e-visa) system by May 1, 2025, in a major step towards modernising Nigeria’s immigration processes.
The initiative, a collaborative effort between the Ministry of Aviation and Aerospace Development and the Ministry of Interior, is designed to tighten border security while simplifying travel procedures for visitors.
Speaking at a press conference in Abuja on the implementation of immigration protocols under the Migration Visa Policy (MVP) 2025, Olubunmi Tunji-Ojo, minister of Interior, outlined the far-reaching benefits of the new system.
He explained that the e-visa platform, alongside the automation of landing and exit card processes, would strengthen background checks and deter unauthorised entry into the country.
“With the e-visa, applications will be processed online, and a centralised visa approval centre is already operational at the Immigration headquarters,” Tunji-Ojo revealed.
“Officers have been trained and equipped with integrated solutions connected to global criminal databases such as Interpol, enabling thorough background checks for all incoming travellers.”
The new procedure mandates that passengers must complete an online landing and exit card before boarding their flight.
This information will be cross-verified by airlines in collaboration with the Nigerian Civil Aviation Authority (NCAA).
According to the minister, this integration ensures that anyone attempting to enter or exit Nigeria without proper clearance will be flagged immediately.
“The responsibility of coordinating and verifying this process rests with the NCAA. They are fully committed, as we all are, to safeguarding our nation’s borders and upholding our sovereignty,” he added.
The collaboration between the ministries has already yielded tangible results through initiatives like the EPIC Solution, an advanced passenger information system that has led to the interception of individuals flagged by Interpol at Nigerian borders.
Furthermore, e-gates have been installed at key terminals in Lagos and Abuja airports to support automated, efficient, and secure passenger clearance.
Tunji-Ojo announced that in the coming weeks, the NCAA and the Nigeria Immigration Service (NIS) will jointly establish a dedicated team to finalise the implementation framework, regulatory guidelines, and protocols for airlines.
“This is not a task for one agency alone. It is an inter-ministerial effort requiring seamless cooperation,” he emphasised.
Mr. Festus Keyamo, SAN, minister of Aviation, described the partnership as a model of effective governmental collaboration. He highlighted that both the e-visa and the automated landing and exit card systems will be free of charge, ensuring accessibility while reinforcing security.
Keyamo provided further details on the operational flow of the new system, explaining that travellers will be required to complete an entry card online before their arrival.
The digital system will store their details, including visa type, entry date, and permitted duration of stay. Upon departure, passengers must present their exit cards at the airline’s check-in desk, where the NCAA’s protocol will be applied.
“As you prepare to leave Nigeria, the first checkpoint will be the airline’s boarding desk,” Keyamo explained.
“If you’re a foreign traveller, they will ask for your exit card. Without it, you won’t be issued a boarding pass.”
The process is designed to trigger automatic verification: once the traveller enters their passport number, the system retrieves their entry data and duration of stay.
Should any irregularities arise—such as overstaying a visa – the airline, following NCAA protocol, will refuse to board the passenger and refer them to immigration authorities.
“When you approach immigration, officers will have complete visibility of your travel history and status. Depending on the nature of the violation, they may issue fines, cancel visas, or impose travel bans of up to 10 years,” Keyamo stated.
Both ministers underscored that the overarching goal is to enhance Nigeria’s national security, curb illegal immigration, and create a seamless, digital travel experience.
With this modernised approach, the country aims to align with global best practices while maintaining its sovereignty.
As preparations advance toward the official launch date, authorities are optimistic that the e-visa system will not only improve efficiency but also bolster Nigeria’s reputation as a secure and welcoming destination for legitimate travellers.
National Identity Management Commission (NIMC), has announced that operatives of the Department of State Security and Nigeria Police Force have arrested suspects involved in the illegal collection of National Identity Numbers (NIN), in Anambra State.
This comes as the commission also warned Nigerians against sharing their National Identity Number with unauthorised persons in exchange for money.
Dr. Kayode Adegoke, spokesman for NIMC issuedthis warning in a statement on Wednesday.
This follows reports of some Anambra residents submitting their NIN to unauthorised individuals in exchange for money.
Reacting, NIMC said the activities contravene NIMC Act No. 23, 2007, the Data Protection Act, and the Cyber Crime Act.
The commission said individuals involved in the act have been arrested by operatives of the Department of State Security and the Nigeria Police Force.
“Upon receiving the information on the activities of the unscrupulous individuals, NIMC, in conjunction with the Department of State Services (DSS) and the Nigeria Police Force (NPF), swiftly arrested the culprits behind the illegal collection of the NIN.
“They are currently being interrogated and will be made to face the full wrath of the law. The commission, therefore, advises Anambra State residents and Nigerians to avoid submitting their NINs to unauthorised individuals, organisations, or platforms, as the Federal Government and NIMC have not authorised this. Anyone caught will be sanctioned appropriately.
“At no time should NIN holders give out their NINs for monetary compensation. This is against the laws of the Federation. Anyone caught will be dealt with appropriately.
“The Commission had earlier issued a statement warning Nigerians against sharing their NIN or data with anyone or on any fictitious sites. The NIN can only be used by the holders to access government or private sector services, and it must be verified.
“The Commission has taken necessary measures to kerb the activities of these unscrupulous individuals,” NIMC stated.
AFD Commits €3m to Africa’s Financial Inclusion
EU Aims to Remove Barriers to AI Development
Africa Plans to Establish a $60Bn AI Fund
FG Inaugurates Board of Galaxy Backbone
Verve Expands Payment Frontiers with Global Partnerships, Contactless Innovation
E-Financial3 days agoAfDB Mobilizes $2.2Bn to Support Nigeria’s Agriculture
News3 days agoMTN Pens Moving Tribute to Pascal Gabriel Dozie, Former Chairman
E-Business3 days agoNatasha: TMG Demands Probe of Alleged Data Breach in Failed Recall
General News3 days agoNIPOST Threatens Courier, Logistics Service Providers
E-Business3 days agoCJN Warns Judicial Officials against Data Breaches, Cyber Attacks
Telecom3 days agoNCC Issues 90 Days Deadline to Telcos to Resolve Subscribers’ Unclaimed Airtime
News3 days agoNIGCOMSAT, Jigawa State Empower 150 Youths on Satellite New Innovations
Broadcasting2 days agoStarlink, DStv, Others Pay “Peanuts” to Operate in Nigeria- Minister