E-Business
HP Threat Research Shows Attackers Exploiting Zero-Day Vulnerability Before Enterprises Can Patch
HP Inc. has released its latest global HP Wolf Security Threat Insights Report, providing analysis of real-world cybersecurity attacks. By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has a unique insight into the latest techniques being used by cybercriminals.
The HP Wolf Security threat research team found evidence that cybercriminals are mobilizing quickly to weaponize new zero-day vulnerabilities.
Exploits of the zero-day CVE-2021-40444 – a remote code execution vulnerability that enables exploitation of the MSHTML browser engine using Microsoft Office documents – were first captured by HP on September 8, a week before the patch was issued on September 14.
By September 10 – just three days after the initial threat bulletin – the HP threat research team saw scripts designed to automate the creation of this exploit being shared on GitHub.
Unless patched, the exploit enables attackers to compromise endpoints with very little user interaction. It uses a malicious archive file, which deploys malware via an Office document.
Users don’t have to open the file or enable any macros, viewing it in File Explorer’s preview pane is enough to initiate the attack, which a user often will not know has happened. Once the device is compromised, attackers can install backdoors to systems, which could be sold on to ransomware groups.
Other notable threats isolated by the HP Wolf Security threat insight team include a rise in cybercriminals using legitimate Cloud and web providers to host malware, JavaScript malware slipping past detection tools, and targeted campaign found posing as the Ugandan National Social Security fund. The team also that switching to HTA files spreads malware in a single click.
“The average time for a business to apply, test and fully deploy patches with the proper checks is 97 days, giving cybercriminals an opportunity to exploit this ‘window of vulnerability’.
While only highly capable hackers could exploit this vulnerability at first, automated scripts have lowered the bar for entry, making this type of attack accessible to less knowledgeable and resourced threat actors.
This increases the risk to businesses substantially, as zero-day exploits are commoditized and made available to the mass market in venues like underground forums,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.
“Such novel exploits tend to be effective at evading detection tools because signatures may be imperfect and become obsolete quickly as the understanding of the scope of an exploit changes.
“We expect threat actors to adopt CVE-2021-40444 as part of their arsenals, and potentially even replace common exploits used to gain initial access to systems today, such as those exploiting Equation Editor.”
“We are also seeing major platforms like OneDrive allowing hackers to conduct ‘flash in the pan’ attacks.
While malware hosted on such platforms are generally taken down quickly, this does not deter attackers because they can often achieve their objective of delivering malware in the few hours the links are live,” Holland continues. “Some threat actors are changing the script or file type they are using every few months.
“Malicious JavaScript and HTA files are nothing new, but they are still landing in employee inboxes, putting the enterprise at risk. One campaign deployed Vengeance Justice Worm, which can spread to other systems and USB drives.”
The findings are based on data from the millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro Virtual Machines (micro VMs) to understand and capture the full infection chain, helping to mitigate threats that have slipped past other security tools.
This has let customers click on over 10 billion email attachments, web pages, and downloads with no reported breaches. By better understanding the behavior of malware in the wild, HP Wolf Security researchers and engineers can bolster endpoint security protection and overall system resilience.
“We can’t keep relying on detection alone. The threat landscape is too dynamic and, as we can see from the analysis of threats captured in our VMs, attackers are increasingly adept at evading detection,” comments Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.
“Organizations must take a layered approach to endpoint security, following zero trust principles to contain and isolate the most common attack vectors like email, browsers, and downloads. This will eliminate the attack surface for whole classes of threats, while giving organizations the breathing room needed to coordinate patch cycles securely without disrupting services.”
National Identity Management Commission (NIMC) yesterday said that it has mandated security agencies to arrest and prosecute Nigerians printing what it described as ‘NIN cards’ ahead of its planned General Multipurpose Card (GMPC).
NIMC in a statement by Kayode Adegoke, head, Corporate Communications Unit, reiterated that the NIN slip is the only legal document authorized as a means of identification.
NIMC said it has observed that “some unscrupulous individuals, cyber cafes, and organizations” are indiscriminately printing unauthorized NIN cards and charging unsuspecting members of the public exorbitant fees.
Such activities, it warned, are a direct violation of the NIMC Act No. 23 of 2007.
NIMC urged the public and organizations to refrain from printing or accepting these unauthorized cards, emphasising that they are not legally recognised.
On no account should these counterfeit NIN cards be presented as valid means of identification.
The security agencies have been notified and mandated to apprehend those involved, with offenders set to face legal consequences.
The commission reaffirmed that the only valid document for identification is the NIN slip, which must be verified before accessing services.
To address public demand, NIMC has concluded plans to launch the Improved GMPC, a multifunctional card serving as both a physical identification document and a payment card, powered by the AfriGO local payment platform.
By Kehinde Ogundare, Country Head, Zoho Nigeria
Nigeria’s entrepreneurial spirit is undeniable. Amidst a dynamic and competitive market, businesses are brimming with potential, poised to become regional and even global powerhouses. However, realising this potential requires navigating a challenging landscape—one marked by limited IT resources, complex operational hurdles, and the inertia of traditional business practices. For Nigerian businesses, the path to sustainable growth lies in digital transformation, with cloud-based technologies serving as a key enabler.
With a burgeoning middle class and a tech-savvy population, Nigeria offers fertile ground for innovation and expansion. Yet, many businesses remain tethered to manual processes, limiting their ability to scale and compete effectively. This is where cloud technology and comprehensive digital toolsets become indispensable.
The need for digital transformation
Traditional growth models lack the agility needed to keep pace with an evolving market. Manual processes lead to inefficiencies, limited data insights hinder informed decision-making, and restricted IT resources stifle innovation. To overcome these hurdles, businesses must adopt digital tools that streamline operations, automate workflows, and provide actionable insights.
Digital transformation isn’t about adopting technology for its own sake—it’s about scaling efficiently. In today’s digital economy, scaling is critical for businesses seeking to expand their market reach, remain competitive, and meet evolving customer demands. Digital tools enable businesses to amplify their impact, drive revenue growth, and optimise costs, ensuring long-term sustainability.
The power of cloud-based solutions
Cloud-based platforms eliminate the need for costly infrastructure investments, offering businesses access to cutting-edge technology on a flexible, scalable basis. By automating repetitive tasks, streamlining workflows, and enhancing productivity, these platforms free up valuable resources, allowing businesses to focus on strategy and customer engagement.
An integrated SaaS platform offers a unified ecosystem to manage all facets of a business. By providing a centralised suite of applications, it automates workflows, reduces manual data entry, and improves team collaboration. Businesses can reduce operational costs and accelerate decision-making, ultimately enabling faster expansion into new markets.
With Zoho software, the emphasis is on contextual intelligence, leveraging AI to provide genuine customer value. In a market where customer experience is paramount, Zoho’s AI-powered insights enable businesses to personalise interactions, anticipate needs, and strengthen customer relationships. Zoho’s unwavering commitment to customer privacy also ensures that businesses can leverage data responsibly, fostering trust and long-term loyalty.
A holistic approach to business growth
Zoho’s philosophy of optimising the entire technology stack—from hardware to software—ensures seamless integration and optimal performance. This holistic approach translates into better technology for Nigerian businesses, enabling them to focus on their core competencies without being weighed down by technical complexities.
For Nigerian businesses, digital transformation is no longer optional—it’s a necessity. By embracing cloud-based technology, they can overcome traditional growth barriers, scale efficiently, and unlock their full potential.
The future of Nigerian business is digital. By adopting the cloud, businesses can transform challenges into opportunities, paving the way for sustainable growth in an increasingly competitive global marketplace.
All communities in Abia State are to be connected to Internet Service within the next 9 months, according to Dr. Alex Otti, state governor.
All communities in Abia State are to be connected to Internet Service within the next 9 months, according to Dr. Alex Otti, state governor.
Otti stated this at the Nnamdi Azikiwe State Secretariat premises at Umuahia, the state capital, while flagging off the first phase of the Umuahia Dedicated Internet Access/Wide Area Network And Managed Network Services Project (Project), saying that it promises to re-engineer efficiency and flexibility in operations and interactions within and amongst institutions, enhance policy execution, and engender a culture of outcome-oriented competition amongst civil servants.
The Project is being handled by iPNX, a major internet service provider.
At the ceremony, Otti, said the project includes distributing high-performance digital tools, laying fibre optic cables in public institutions, and installing infrastructure for high-speed data transmission.
He added that the initiative focuses on improving leadership efficiency, empowering civil servants with digital tools, and enhancing service delivery.
Transitioning to digital platforms would streamline government processes, enable faster communication among Ministries, departments, and Areas (MDAs), and improve engagement with development partners and the global community.
The governor also announced a mandatory digital literacy requirement for civil servants, making proficiency in technology essential for career growth.
Assuring that while the government would provide training, those unwilling to embrace technology risk becoming uncompetitive in the evolving civil service structure.
Plans are underway to expand digital access across Abia, with an agreement already in place to lay fiber optic cables in Aba, Umuahia, and Ohafia.
Otti directed Mr. Gerald Ilukwe, chief information officer to ensure that within nine months, every community in Abia must have reliable network service, enabling businesses to thrive virtually.
The Governor urged the people of Abia to embrace technology as a tool for empowerment rather than a replacement for human roles as the use of technology ought to be on enhancing service delivery and economic development, as well as keeping human decision-making at the core of governance.
The commencement of the initiative marks a major milestone in Abia’s journey towards a fully digital economy.
Ilukwe, described the project as a critical foundation for a digital government, emphasising its role in modernising service delivery.
Ilukwe said Phase I of the initiative prioritises multi-tenant buildings and complexes housing multiple MDAs and assured that MDAs not included in this phase would be covered in subsequent stages.
“Even as we are rounding off this phase, we are already preparing for the next, by the end of this service year, the entire government offices in Umuahia will be interconnected on a single network,” Ilukwe said.
Mr Ejovi Aror, group managing director, ipNX, expressed gratitude to Gov. Alex Otti for the opportunity to be part of the state’s digital transformation journey.
“This partnership signals the beginning of a new chapter in the journey towards building a digitally connected, technologically advanced, and economically empowered Abia State,” Aror said.
Authorities Seize 1842 Devices in African-Wide Cybercrime Crackdown
Police Arrest 4 Bank Staff over Alleged ₦270m Fraud, Money Laundering
Enza Raises $6.75m Seed Funding to Boost Embedded Payment Solutions Across Africa
NIMC to Prosecute Nigerians Printing ‘NIN Cards’, Says Only Slip is Legal
FG, UK FCDO, and Ghana Partner to Launch Sankore
General News3 days agoNigeria to Launch $40 Million Fund for Tech Startups
Broadcasting1 day agoNGO Blasts MultiChoice for Tariff Hike in Nigeria, Slash in South Africa
E-Business1 day agoOtti, Abia State Gov Promises Internet Access for all Abia Communities in 9 Months
News1 day agoNIPOST Explains Clamping Down on Illegal Logistics Services in Enugu
Telecom1 day agoTelcos Mull Introduction of Different Tariff Plans for Different States
E-Financial1 day agoCITN Seeks AI to Curb Revenue Leakage in Nigeria’s Tax System
News1 day agoNESREA Urges Nigerians to Dispose Batteries Properly to Avoid Hazards
News1 day agoTony Elumelu Foundation Grants $15m to 3,000 African Entrepreneurs