News
HP Wolf Security Threat Insights Report Shows How Cybercriminals Are Tricking Users
HP Inc. has released its latest global HP Wolf Security Threat Insights Report, providing analysis of real-world cybersecurity attacks. By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals.
The HP Wolf Security threat research team identified a wave of attacks utilizing Excel add-in files to spread malware, helping attackers to gain access to targets, and exposing businesses and individuals to data theft and destructive ransomware attacks.
There was a huge six-fold increase (+588%) in attackers using malicious Microsoft Excel add-in (.xll) files to infect systems compared to last quarter – a technique found to be particularly dangerous as it only requires one click to run the malware.
The team also found adverts for .xll dropper and malware builder kits on underground markets, which make it easier for inexperienced attackers to launch campaigns.
Additionally, a recent QakBot spam campaign used Excel files to trick targets, using compromised email accounts to hijack email threads and reply with an attached malicious Excel (.xlsb) file.
After being delivered to systems, QakBot injects itself into legitimate Windows processes to evade detection.
Malicious Excel (.xls) files were also used to spread the Ursnif banking Trojan to Italian-speaking businesses and public sector organizations through a malicious spam campaign, with attackers posing as Italian courier service BRT. New campaigns spreading Emotet malware are now using Excel instead of JavaScript or Word files too.
Other notable threats isolated by the HP Wolf Security threat insight team include:
- The return of TA505? HP identified a MirrorBlast email phishing campaign sharing many tactics, techniques, and procedures (TTPs) with TA505, a financially motivated threat group known for massive malware spam campaigns and monetizing access to infected systems using ransomware. The attack targeted organizations with the FlawedGrace Remote Access Trojan (RAT).
- Fake gaming platform infecting victims with RedLine: A spoofed Discord installer website has been discovered, tricking visitors into downloading the RedLine infostealer and stealing their credentials.
- Switching up uncommon file types is still bypassing detection: The Aggah threat group targeted Korean-speaking organizations with malicious PowerPoint add-in (.ppa) files disguised as purchase orders, infecting systems with remote access Trojans. PowerPoint malware is unusual, making up 1% of malware.
“Abusing legitimate features in software to hide from detection tools is a common tactic for attackers, as is using uncommon file types that may be allowed past email gateways.
Security teams need to ensure they are not relying on detection alone and that they are keeping up with the latest threats and updating their defenses accordingly.
For example, based on the spike in malicious .xll sightings we are seeing, I’d urge network administrators to configure email gateways to block incoming .xll attachments, only permit add-ins signed by trusted partners or disable Excel add-ins entirely,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.
“Attackers are continually innovating to find new techniques to evade detection, so it’s vital that enterprises plan and adjust their defenses based on the threat landscape and the business needs of their users. Threat actors have invested in techniques such as email thread hijacking, making it harder than ever for users to tell friend from foe.”
The findings are based on data from the many millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro Virtual Machines (micro-VMs) to understand and capture the full infection chain, helping to mitigate threats that have slipped past other security tools.
This has let customers click on over 10 billion email attachments, web pages, and downloads with no reported breaches. By better understanding the behaviour of malware in the wild, HP Wolf Security researchers and engineers can bolster endpoint security protection and overall system resilience.
Other key findings in the report include:
- 13% of email malware isolated had bypassed at least one email gateway scanner.
- Threats used 136 different file extensions in their attempts to infect organizations.
- 77% of malware detected was delivered via email, while web downloads were responsible for 13%.
- The most common attachments used to deliver malware were documents (29%), archives (28%), executables (21%), spreadsheets (20%).
- The most common phishing lures were related to the New Year or business transactions such as “Order”, “2021/2022”, “Payment”, “Purchase”, “Request” and “Invoice”.
“Today, low-level threat actors can carry out stealthy attacks and sell access onto organized ransomware groups, leading to large-scale breaches that could cripple IT systems and grind operations to a halt,” comments Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.
“Organizations should focus on reducing the attack surface and enabling quick recovery in the event of compromise. This means following Zero Trust principles and applying strong identity management, least privilege and isolation from the hardware level.
For example, by isolating common attack vectors such as email, browsers or downloads using micro-virtualization, any potential malware or exploits lurking within are contained, rendering them harmless.”
Tony Elumelu Foundation (TEF) has announced a $15 million grant to support 3,000 budding entrepreneurs from 52 African countries.
Tony Elumelu, founder, TEF, made this known on Sunday in Abuja during the unveiling of the 2025 cohort of the foundation’s Entrepreneurship Programme.
He stated that each beneficiary would receive a $5,000 seed grant to kick-start their businesses.
Elumelu, who is also chairman of Heirs Holdings, Transcorp, and United Bank for Africa (UBA), reaffirmed his commitment to empowering African entrepreneurs and transforming the continent’s economic landscape.
According to Elumelu, the foundation aims to democratise opportunity across the continent, fostering economic growth and providing young Africans with access to funding and mentorship.
“We had a vision that started in 2010; one that envisions a self-sustaining Africa, driven by the energy, vision, and resilience of young entrepreneurs.
“We understand the challenges they face in contributing to Africa’s economic transformation.
“If empowered and encouraged, these young Africans can drive meaningful change,” he said.
He noted that capital alone was not enough, highlighting the importance of business education, mentorship, and training in building successful entrepreneurs.
The entrepreneurship programme, which began in 2015, originally set out to economically empower 10,000 young Africans over 10 years, each receiving $5,000 in seed capital.
“This year marks the 15th anniversary of the foundation, and we have made a considerable impact across all 54 African countries.
“In the 21st century, Africa does not need aid; what it needs is investment in its youth,” Elumelu said.
Somachi Chris-Asoluka, chief executive officer (CEO), TEF, noted that since the programme’s launch in 2015, the foundation had.disbursed over $100 million to more than 21,000 young entrepreneurs across Africa.
According to Chris-Asoluka, these businesses have collectively created 1.5 million enterprises, and generated $4.5 billion in revenue.
“Our entrepreneurs have demonstrated that ideas are the lifeblood of the African continent.
“For the 2025 cohort, we received over 200,000 applications, and from this pool, 3,000 entrepreneurs from 52 African countries will receive $15 million in funding.
“Each entrepreneur will receive a $5,000 non-refundable seed grant; this is neither a loan nor equity,” she stated.
She further assured that the foundation had a monitoring and evaluation platform in place to track progress after disbursement, ensuring that beneficiaries adhered to their approved business plans.
National Environmental Standards and Regulations Enforcement Agency (NESREA) has urged Nigerians to dispose of used batteries responsibly to prevent environmental and health hazards.
Innocent Barikor, director-general of NESREA, stressed the need to upgrade the lead-acid battery recycling sector in Nigeria and Africa.
He told Vanguard Newspaper recently that improper disposal of batteries poses severe risks to public health and called for strict adherence to environmental regulations.
He noted that Nigeria had already introduced regulations for the battery sector and emphasized the need for enforcement.
Barikor also highlighted the importance of standardizing battery recycling regulations across Africa, stressing that non-uniform policies hinder progress.
He further noted that the recent international conference was organized to bring together stakeholders and experts from other countries to discuss solutions and best practices for improving lead-acid battery recycling in Africa.
He said, “Nigerians should simply avoid breaking batteries. There are registered collectors trained to handle used batteries. If you’re through with your battery, send it to the people who know how to collect and dispose of it properly.
“The regulation is not meant to shut down businesses but to ensure batteries are handled responsibly. More batteries will be needed due to the transition to green energy, but we must prevent lead contamination.
“Part of the challenge we have today is the lack of standardization among African countries. If regulations are uniform, companies will have no choice but to comply,” he said.
Also speaking, Dr. Leslie Adogame, executive director, Sustainable Research and Action for Environmental Development (SRADeV), called for cleaner recycling technologies in the lead-acid battery sector.
According to Adogame, a policy framework was developed following global concerns over Nigeria’s lead recycling practices, which led to increased scrutiny from international investors.
He explained that European investors buying lead from Nigeria had cut ties with some facilities due to pollution concerns, which prompted regulatory changes.
He said, “When we examined the industry, we found many sharp practices under the guise of recycling. While recycling is good, brown recycling—where pollution is not controlled—is harmful.
“You cannot put the economy above people’s health. If facilities must be shut down to protect lives, then that’s what should be done,” he stated.
On the adoption of cleaner technologies, Adogame added, “We are not promoting a particular technology, but industries must embrace best practices. If you must recycle, use equipment that does not pollute the environment.”
Meanwhile, Andreas Manhart, coordinator of the Partnership for Responsible Battery and Metal Recycling (ProBaMet), highlighted efforts to improve lead-acid battery recycling in Nigeria.
He noted that informal recycling practices contribute to severe pollution and called for sustained efforts to protect public health.
“The project has introduced improved recycling technologies, trained recyclers, and worked with government agencies to enforce stricter regulations.
“Continuous enforcement of environmental laws, investment in modern recycling facilities, and stronger collaboration between stakeholders are necessary to minimize lead contamination,” he added.
Nigerian Postal Service (NIPOST) has explained the reasons why it is clamping down on illegal and unlicensed courier and logistics operators in Enugu State.
The Courier and Logistics Regulatory Department (CLRD) team of NIPOST, began the enforcement operations by sealing offices of unlicensed operators and confiscating some motorbikes belonging to illegal and unlicensed operators.
It was gathered that some of the affected operators had been issued with demand notices since 2023, with them not showing any interest in complying with the provisions of the law.
Gideon Shonde, general manager, CLRD, who spoke to newsmen during the exercise in Enugu, said NIPOST was enforcing its regulatory mandates with the exercise, which he said was necessary to sanitize the sector especially as the Postal, Express, Courier and Logistics industry in Nigeria had been proliferated and infiltrated with so many unlicensed and illegal courier and logistics operators, posing serious threats to Nigerians.
While disclosing that he and his team had visited Enugu before now with compliance level still very low, he lamented that there had been unethical practices, such as price undercutting, pilfering, broaching, damages, loss and dumping of customers items, poaching and subletting of operating licenses with a mountain of public complaints about customers being duped or obtaining money from them under pretences, no traceable office address nor registered brand name.
Shonde pointed out the issue of public safety and security threats, due to carriage of illicit drugs and prohibited items like small arms and ammunition, guns, gold, monies, and obscene items, among other illicit items.
He, however, said any interested private investors into the Postal, Express, Courier and Logistics business should follow due process and obtain a grant of operating Licenses from the Federal Government.
He advised that they should obtain a grant of Operating License from the NIPOST postmaster general as stipulated by the extant laws or risk facing the full wrath of the law, and prosecution.
NGO Blasts MultiChoice for Tariff Hike in Nigeria, Slash in South Africa
Tony Elumelu Foundation Grants $15m to 3,000 African Entrepreneurs
SEC Declares War on Capital Market Fraudsters
Telcos Mull Introduction of Different Tariff Plans for Different States
NESREA Urges Nigerians to Dispose Batteries Properly to Avoid Hazards
General News3 days agoNigeria, Kenya among Nations Running out of HIV Drugs – WHO
News3 days agoNAFDAC Destroys over N1 Trillion Fake Drugs in Anambra
Telecom3 days ago9mobile Denies Shutdown Rumours, Promises Improved Services
Telecom3 days agoTikTok and Truecaller Face NDPC Investigation Amid Data Protection Concerns
E-Business3 days agoVisa to Establish Data Centre in Nigeria to ‘Boost Digital Economy’
E-Financial3 days agoNigeria Still Open Crypto Business despite $80Bn Lawsuit against Binance – FG
News3 days agoBolt Shares the Spirit of Ramadan with Kano Drivers-Partners
General News2 days agoNigeria to Launch $40 Million Fund for Tech Startups