E-Business
Cyber Attackers Getting More Undetected in Target Networks – Sophos Report
New report released by Sophos has revealed that Cyber attackers are not only becoming sophisticated now, they are even getting more time undetected in target networks.
John-Shier, Senior-Security-Advisor-at-Sophos
Sophos, a global leader in next-generation cybersecurity, which released the “Active Adversary Playbook 2021,” detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020.
The TTP detection data also covers early 2021. The findings show that the median attacker dwell time before detection was 11 days – or 264 hours – with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
The playbook is based on Sophos telemetry as well as 81 incident investigations and insight from the Sophos Managed Threat Response (MTR) team of threat hunters and analysts and the Sophos Rapid Response team of incident responders.
The aim is to help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on their network.
Key findings in the playbook include:
- The median attacker dwell time before detection was 11 days – To put this in context, 11 days potentially provide attackers with 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
Considering that some of these activities can take just minutes or a few hours to implement – often taking place at night or outside standard working hours – 11 days offers attackers plenty of time to cause damage in an organization’s network.
It is also worth noting that ransomware attacks tend to have a shorter dwell time than “stealth” attacks, because they are all about destruction
- 90% of attacks seen involved the use of the Remote Desktop Protocol (RDP) – and in 69% of all cases, attackers used RDP for internal lateral movement – Security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access.
However, these don’t work if the attacker is already inside the network. The use of RDP for internal lateral movement is increasingly common in active, hands-on-keyboard attacks such as those involving ransomware
- Interesting correlations emerge among the top five tools found in victim networks. For instance, when PowerShell is used in an attack, Cobalt Strike is seen in 58% of cases, PsExec in 49%, Mimikatz in 33%, and GMER in 19%.
Cobalt Strike and PsExec are used together in 27% of attacks, while Mimikatz and PsExec occur together in 31% of attacks. Lastly, the combination of Cobalt Strike, PowerShell and PsExec occurs in 12% of all attacks.
Such correlations are important because their detection can serve as an early warning of an impending attack or confirm the presence of an active attack
- Ransomware was involved in 81% of the attacks Sophos investigated. The release of ransomware is often the point at which an attack becomes visible to an IT security team. It is, therefore, not surprising that the vast majoirty of the incidents Sophos responded to involved ransomware.
Other attack types Sophos investigated included exfiltration only, cryptominers, banking trojans, wipers, droppers, pen test/attack tools, and more
“The threat landscape is becoming more crowded and complex, with attacks launched by adversaries with a wide range of skills and resources, from script kiddies to nation-state backed threat groups. This can make life challenging for defenders,” said the Senior Security Advisor at Sophos, John Shier. “Over the last year, our incident responders helped to neutralize attacks launched by more than 37 attack groups, using more than 400 different tools between them. Many of these tools are also used by IT administrators and security professionals for their everyday tasks and spotting the difference between benign and malicious activity isn’t always easy.
“With adversaries spending a median of 11 days in the network, implementing their attack while blending in with routine IT activity, it is critical that defenders understand the warning signs to look out for and investigate. One of the biggest red flags, for instance, is when a legitimate tool or activity is detected in an unexpected place. Most of all, defenders should remember that technology can do a great deal but, in today’s threat landscape, may not be enough by itself. Human experience and the ability to respond are a vital part of any security solution.”
Other topics covered in the playbook include the tactics and techniques most likely to signpost an active threat and warrant closer investigation, the earliest signs of attack, the most widely seen stagers, threat types and malicious artefacts, the most prevalent adversary groups seen, and more.
To learn more about attacker behaviors, tactics, techniques and procedures (TTPs) read the Sophos Active Adversary Playbook 2021 on Sophos News.
To further enhance global efforts to combat cyber offenses, Kaspersky and AFRIPOL have signed a cooperation agreement in preventing and fighting cybercrime.
Covering a period of five years, the document formalises and facilitates cooperation between the company and the law enforcement agency in sharing threat intelligence data on the latest cybercriminal activities.
The landscape of cyberthreats in Africa has constantly been evolving, with the continent having been especially susceptible to industrial threats. The region, in particular, has the highest share of Industrial Control Systems (ICS) computers on which malicious objects were blocked by Kaspersky solutions, compared to other regions.
Africa’s vigorous cyberthreat environment requires enhanced collaboration of the parties concerned to safeguard against potential risks.
Strengthening the existing relationship between the two organisations, the agreement provides for enhanced data exchange on cyberthreats and cybercrime trends, with Kaspersky handing over such data to AFRIPOL for the further criminal intelligence analysis by the organisation.
Another aspect of collaboration includes the provision of assistance, know-how and technical knowledge in information security analysis by Kaspersky’s vastly experienced teams of experts.
The official signing ceremony took place at AFRIPOL’s headquarters in Algiers on November 18, with the agreement signed by Kaspersky founder and CEO, Eugene Kaspersky and AFRIPOL’s Acting Executive Director, Ambassador Jalel Chelba.
Kaspersky founder and CEO, Eugene Kaspersky, noted: “An effective fight against cybercrime is inconceivable without cooperation. Our company has always put collaborative effort first – sharing its expertise with the widest range of stakeholders: the security expert community, law enforcement agencies, and also the general public to empower them with knowledge about acute cyberthreats.
“Hence, by advancing our cooperation with AFRIPOL and by equipping the agency with both the information and technology required for responding to emerging cyberthreats, we hope to enhance our contribution in fostering greater cyber-resilience and a safer cyberspace for all.”
AFRIPOL Acting Executive Director Ambassador Jalel Chelba stated: “This agreement with Kaspersky represents a major step forward in strengthening Africa’s digital defenses.
By leveraging Kaspersky’s expertise and resources, we are not only enhancing AFRIPOL’s ability to counter cyber threats, but also contributing to the protection of a secure digital space for all African citizens.
This collaboration brings substantial added value to both our organisations: it strengthens AFRIPOL’s operational framework in combating cybercrime, while allowing Kaspersky to play a key role in the digital security of a strategically important continent in terms of cybersecurity. Together, we are taking a significant step towards resilience and digital trust in Africa, by mobilising the best of both partners.”
Kaspersky and AFRIPOL have a long record of joint cooperation projects. The two organisations have been active contributors to the assessment of the African threat landscape, while also being active participants in INTERPOL-led actions to disrupt cybercrime on the African continent, namely Africa Cyber Surge Operation and Africa Cyber Surge Operation II.
The two organisations have also been advocating for greater digital trust, with AFRIPOL having endorsed Kaspersky’s first Transparency Center in the African region in Rwanda. Learn more at the website.
The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud-native software, along with Linux Foundation Education, the training and certification arm of the Linux Foundation, has partnered with Andela, home to the world’s largest private tech talent marketplace, to train 20,000 to 30,000 African technologists in cloud native basics to enable them to excel in jobs globally as cloud-native development grows.
The training—done at no cost to the participants—will begin next year and unfold over two to three years. Participants will have the opportunity to train for the Kubernetes and Cloud Native associate (KCNA) certification, which demonstrates a user’s foundational knowledge and skills in Kubernetes and the wider cloud native ecosystem, and the Certified Kubernetes Application Developer (CKAD), which certifies that users can design, build, configure, and expose cloud native applications for Kubernetes.
“This partnership showcases the global impact of CNCF’s education programs. By standardizing cloud native knowledge, developers across the globe can confidently work toward certifications that will enable them to land developer positions both within their own countries and globally,” said Chris Aniszczyk, CTO at the CNCF.
“By partnering with Andela, which has a long history of training technologists in Africa, we see great opportunity in providing our training to communities that may otherwise not have access. Together, we can create a win-win for companies that need workers and workers that need opportunities.”
According to Google’s Africa Developer Ecosystem Report 2021, the increased global demand for remote tech talent, which was accelerated by the pandemic, created more remote employment opportunities for African developers. Now, 38% of African software developers work for at least one company based outside the continent.
“We are excited to partner with CNCF to extend training and, ultimately, enhance job opportunities for African workers. The continent is emerging as one of the most important markets in the world.
“It has the fastest-growing population of developers, and its young workforce will be key to solving the tech talent shortage,” said Carrol Chang, Andela CEO. “Organizations are looking for talent with advanced skill sets like AI and cloud-native, and this particular skill set is a perfect addition to the Andela marketplace.”
Training participants will take six to nine months to achieve the KCNA and CKAD certifications and will be selected from Andela’s talent marketplace, which includes 150,000 technology professionals globally, with a large percentage from Africa. Andela’s talent marketplace in Africa spans 49 countries, including Nigeria, Kenya and Ghana.
The company fosters an active community for marketplace participants and has worked with numerous companies, including Google, Meta, Microsoft, AWS, and Nvidia, to train talent in technologies that offer vast workplace opportunities.
The need for cloud-native developers continues to increase and a recent study by CNCF revealed that almost 55% of developers landed a new job as a result of training and certification courses.
Almost 7 in 10 (67%) said it made them feel more engaged and fulfilled in their work. However, 8 in 10 (81%) also said cost prevented them from completing certifications.
“As a non-profit focused on growing open source and cultivating the IT talent needed to sustain it, partnerships – like this one with Andela – help us train and certify underrepresented groups, which is crucial to both our long-term success and amplify our impact,” said Clyde Seepersad, Senior Vice President and General Manager of Linux Foundation Education.
QNET, a global lifestyle and wellness-focused direct-selling company, in partnership with Transblue Nigeria Ltd, hosted a successful Product Expo at Anchor Events Place, Ikeja, Lagos.
The event showcased QNET’s diverse product line, addressing misconceptions and empowering Nigerian entrepreneurs.
Mr. Akeem Ajisafe, Managing Director of Transblue Nigeria Ltd, emphasized the expo’s significance: “This is our opportunity to showcase our products, tackle misconceptions, and educate people about QNET’s direct-selling approach.”
QNET’s partnership with Transblue has yielded multiple workshops and exhibitions, promoting economic viability and youth empowerment.
Ajisafe highlighted the benefits: “QNET has contributed significantly to Nigeria’s tax revenue, and our programs teach entrepreneurship skills, enabling individuals to build their own businesses.”
Commander Mitchell Ofoyeju, Tincan Island Port Strategic Command, Lagos, praised QNET’s potential: “The product line is amazing, people-centric, and has great potential in Nigeria. It’s impressive, and I recommend it to young Nigerians.”
Ofoyeju emphasized QNET’s capacity-building opportunities: “This can generate wealth, increase productivity, and engage youth meaningfully, keeping them away from crime and illicit activities.”
The expo featured health products, luxury watches, jewelry, and educational materials, demonstrating QNET’s commitment to enhancing lives through innovative products.
As QNET continues to expand its presence in Nigeria, the partnership with Transblue is poised to empower entrepreneurs, promote economic growth, and foster a positive impact on Nigerian youth.
CBN Issues Scam Alert, Warns of Fake SWIFT Messages Linked to Transfer Claim
Global Telco, Pay-TV Spend Up 2.4 Percent in 2024- IDC
FG to Establish National Youth Development Bank to Support Young Nigerians
MTN Plans Satellite-Internet Rollout
Kaspersky, AFRIPOL Strengthen Partnership in Combating Cybercrime
First Bank Proposes New Name after Upgrading Banking Platforms
TD Africa to Empower 400 Young Women with TecHERdemy
Edo State Launches Data Centre in Benin
GSMA, Automotive Edge Computing Consortium Partner to Drive Forward Interoperable Connected Vehicle Services
Echefu Launches LUFT TV, another Pay TV after Failed TSTV Project
E-Financial2 days agoCBN Orders Banks to Load ATMs, Warns Against Cash Disbursement to Naira Hawkers
News2 days agoExperts Highlight Blockchain, AI, eCommerce Potentials for Africa @ AfriTECH 4.0
E-Financial2 days agoInuwa Tasked Fintech Stakeholders on Collaboration to Deepen Financial Literacy
Telecom2 days agoKarl Toriola Champions MTN’s Digital Transformation @TeXcellence 2024
E-Financial1 day agoNGX Proposes Amendment to Trading License Holders Rules
Telecom2 days agoEU Hits Meta with $840M Fine for Abusive Facebook Ad Practices
E-Business2 days agoBreaking Barriers: QNET’s Product Expo Opens Doors for Nigerian Entrepreneurs
Telecom2 days agoTD Africa Launches TecHERdemy to Empower 400 Nigerian Women in Tech