Connect with us

News

Cyber criminals Promise Millions to Skilled Professionals

Published

on

Kindly share this post

Cyber criminals are willing to pay more than a million dollars a year to skilled information security professionals who are willing to don a black hat.

Skills including network management, penetration testing and programming skills are particularly in demand, reveals digital security company Dark Shadows in a recent report.

Research on the Dark Web revealed one attacker is promising to pay $768 000 per year to skilled professionals willing to help carry out acts of malfeasance. The salary is set to rise to $1 080 000 per year in the second year.

The report also revealed criminal underground groups are on the lookout for partners in crime who can help them extort money from high-worth individuals, such as executives, lawyers and doctors. For these roles, monthly salaries of $30 000 are on offer.

For extortion to work, attackers need something of value to barter, such as the details of someone’s private life, confidential company information, or total control over a company’s network, adds the firm.

Acquiring this information or privileged access has never been easier. “As businesses rush into digital transformation, and new individuals and services join the digital economy daily, it’s becoming harder and harder to manage our data and digital assets. Cyber criminals recognise this and have developed ways to profit from our unwanted online exposure through extortion-based attacks.”

Digital Shadows says there are several ways attackers are monetising online exposure. Firstly, through compromised credentials, where criminals use cheap and readily available breached credentials bought on the dark market to perform mass extortion campaigns and convince victims they have been breached.

Not only will they extort victims directly, attackers now have dedicated sections on online forums to sell sensitive data, including corporate documents and intellectual property.

Beating barriers

“In fact, the barriers to entry for extortion-based activity continue to fall. Extortionists come in all shapes and sizes, with varying levels of sophistication. With account, database and network accesses available on criminal forums, and extortion guides for sale at under $10, aspiring extortionists have a wealth of resources to get started,” adds Digital Shadows.

Attackers are also using technical vulnerabilities. Cyber crooks can carry out active and passive scanning to identify exploitable vulnerabilities on Internet-facing applications, and can deploy ransomware variants that disrupt business operations, damage business reputation, and demand huge ransoms in Bitcoin or other crypto-currency.

Ilia Kolochenko, CEO of Web security company High-Tech Bridge, says: “The shadow economy is not subject to governmental control or regulation. While in the past, cyber criminals were restrained by money-laundering difficulties in cyber space, the rise of crypto-currencies means virtually any illicit income of any size can be legalised without legal ramifications.”

Unlike lazy and inefficient cyber security start-ups that look for the next investment round as a universal resort for any past failures, cyber criminals are organised, disciplined and well-managed, says Kolochenko. “Their sole objective is maximising their short-term profit, not becoming a unicorn or running a successful IPO in 10 years.”

These numbers also undermine the long-term sustainability of commercially-motivated bug bounties, he notes. “We will likely see a decline in the number of skilled people involved in crowd security testing as they can either find a highly competitive salary in the industry, or alternatively shift to the dark side. At least their primary motivator will not be money.”


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Continue Reading
Advertisement
Comments

News

No More Leaks: FIRS Slaps ₦5m Fine on Info Disclosure

Published

on

Kindly share this post

Nigeria Revenue Service (NRS) Act has introduced strict penalties for the unauthorised disclosure of confidential information and documents by its staff, with offenders facing fines of up to N5 million, imprisonment for up to three years, or both.

The NRS Act is one of four bills recently signed into law by President Bola Tinubu, alongside the Nigeria Tax (Fair Taxation) Law, the Nigeria Tax Administration Law, and the Joint Revenue Board (Establishment) Law. The regulations will take effect on January 1, 2026.

In Part VI of the NRS Act, covering miscellaneous provisions, the law designates all internal records—including institutional information, memoranda, and communications—as confidential.

“Without prejudice to the provisions of any other Act concerning data privacy or data protection, institutional information or communication, all internal information, communications, documents or memoranda of the Service are confidential,” the law states.

It further warns that, “Except as otherwise provided under this Act, any other law or any enabling agreement or arrangement or as otherwise authorised by the Executive Chairman or management of the Service, any person who discloses or attempts to disclose institutional information, communication, document or memorandum of the Service is liable on conviction to a fine not exceeding N5,000,000 or imprisonment for a term not exceeding three years or both.”

The provision applies to all officials and individuals involved in the administration of the Act. The NRS also specified that business records, tax returns, notices, assessments, and documents relating to a person’s assets, liabilities, or profits must be “treated as secret.”

Exceptions to the confidentiality rule include disclosures authorised by the service, those mandated by court order, or situations where the information is needed for the enforcement of Nigeria’s tax laws.

The development follows a February 20, 2024, warning from the federal government cautioning civil servants in ministries, departments, and agencies (MDAs) against leaking sensitive documents to the public.


Kindly share this post
Continue Reading

News

FIRS Rolls out e-invoicing System for Large Corporate Taxpayers

Published

on

Kindly share this post

The Federal Inland Revenue Service (FIRS) has launched a national electronic invoicing system, seen as a significant step toward digitising the country’s tax infrastructure and boosting compliance among large corporate taxpayers.

The system, known as the Merchant-Buyer Solution (MBS), officially went live on August 1 after a successful pilot phase that began in November 2024. It is being rolled out in phases, starting with companies that have an annual turnover of at least ₦5 billion. According to FIRS, these large taxpayers represent over 5,000 businesses nationwide.

More than 1,000 companies — roughly 20% of eligible firms — have already integrated with the platform, including telecoms giant MTN Nigeria, which became the first to transmit live electronic invoices to the tax authority. Other major players such as Huawei Nigeria and IHS Towers are completing their onboarding and are expected to go live in the coming days.

“The launch of the e-invoicing regime ushers in a new era of transparency, accuracy, and real-time monitoring of commercial transactions,” Dare Adekanmbi, who is the spokesperson for Zacch Adedeji, FIRS Chairman, said in a statement on Sunday.

The e-invoicing solution forms part of the agency’s broader Electronic Fiscal System (EFS), which is designed to ensure authenticity and completeness of invoice data and limit opportunities for tax evasion. It also aligns with Nigeria’s Revenue Services Reform Act — a legislative framework aimed at harmonising revenue collection and providing a single source of truth for government receipts.

The FIRS said it is working in collaboration with the National Information Technology Development Agency (NITDA) to incorporate system integrators and access point providers into the onboarding ecosystem. These providers are tasked with supporting the integration process and helping companies manage their transition onto the e-invoicing platform.

While the original deadline for onboarding was set for August 1, the tax agency has granted a three-month grace period to allow companies facing operational challenges to comply. The new deadline for mandatory integration is November 1, 2025.

“In the spirit of encouraging voluntary compliance, the FIRS management has graciously approved a three-month extension of the deadline,” the agency said. “We also acknowledge the genuine efforts of many taxpayers who strove to meet the 1st of August 2025 deadline but encountered operational constraints.”

The system will eventually be extended to medium and smaller enterprises, but for now, the focus remains on onboarding the largest players, who contribute a significant share of Nigeria’s corporate tax base.

Nigeria, Africa’s largest population, has been ramping up efforts to boost non-oil revenues amid volatile crude prices and growing fiscal pressures. Tax-to-GDP ratio remains among the lowest globally, estimated at just over 10%, according to official figures.

The FIRS has increasingly leaned on technology to expand the tax net and reduce leakages.

“The e-invoicing platform gives us real-time visibility into the business-to-business segment, which has historically been under-reported,” a senior FIRS official familiar with the rollout said, requesting anonymity because he was not authorized to speak publicly. “It significantly enhances our ability to track transactions and enforce compliance.”

To facilitate onboarding, the FIRS e-Invoicing Implementation Team is conducting webinars, workshops, and town hall sessions across the country, targeting tax consultants, financial controllers, and compliance officers within affected firms.

The Federal Government expects the digitisation effort to streamline tax administration, reduce disputes and simplify audit processes for both taxpayers and regulators.

The FIRS has not disclosed projected revenue gains from the e-invoicing rollout, but industry experts believe it could yield significant medium-term improvements in tax efficiency and administration.

 


Kindly share this post
Continue Reading

News

Google Hit by AI-driven Cyber Attack

Published

on

Kindly share this post

Google has become the latest company to fall victim to cyber criminals increasingly using artificial intelligence (AI) to bypass security measures and trick users with highly-realistic documents that install malware on networks.

This Google attack, following a similar incident targeting Microsoft SharePoint servers globally, was confirmed earlier this week.

Google, one of the so-called “Magnificent Seven” US tech companies, revealed that one of its corporate Salesforce instances was compromised by a financially-motivated threat cluster known as UNC6040.

AI is rapidly becoming hackers’ tool of choice for crafting convincing e-mails and phone calls that mimic familiar voices or sound authentically human. E-mails often include attachments that appear legitimate, prompting recipients to click and unwittingly allow malware to infiltrate networks. Meanwhile, phone calls push targets to click links sent via SMS or WhatsApp.

Richard Cassidy, Europe, Middle East and Africa chief information security officer at Rubrik, says: “We are definitely seeing these incidents become more prevalent. What’s driving this surge is a combination of rapidly-evolving AI-enabled attack tools, and the ever-expanding attack surfaces created by widespread digitalisation, without proportional investment in cyber resilience.”

The UNC6040 group targets Salesforce environments by impersonating IT support to deceive employees into installing malicious connected apps, often disguised as Salesforce’s Data Loader. This enables the attackers to covertly access networks and extract sensitive data.

Quick response

In the most recent attack, Google said it “responded to the activity, performed an impact analysis and began mitigations”. The breach affected systems storing contact information and related notes for small and medium businesses.

“Analysis revealed that data was retrieved by the threat actor during a small window before access was cut off. The data retrieved was confined to basic and largely publicly available business information, such as business names and contact details,” Google said.

Google also reported that the extortion involved calls or e-mails to victim organisation employees demanding Bitcoin payments within 72 hours. During these communications, the threat actors have consistently claimed to be the group known as ShinyHunters.

Large-scale attacks

SentinelLABS and Beazley Security recently uncovered and analysed a rapidly-evolving series of infostealer campaigns delivering the Python-based PXA Stealer. This malware uses Telegram bots to sell stolen data in a manner that is nearly undetectable.

The actors, reportedly Vietnamese hackers, have compromised more than 4 000 unique victim IP addresses across at least 62 countries, including South Korea, the United States, the Netherlands, Hungary and Austria.


Kindly share this post
Continue Reading

Trending