News
HP Wolf Security Threat Insights Report Shows How Cybercriminals Are Tricking Users
HP Inc. has released its latest global HP Wolf Security Threat Insights Report, providing analysis of real-world cybersecurity attacks. By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals.
The HP Wolf Security threat research team identified a wave of attacks utilizing Excel add-in files to spread malware, helping attackers to gain access to targets, and exposing businesses and individuals to data theft and destructive ransomware attacks.
There was a huge six-fold increase (+588%) in attackers using malicious Microsoft Excel add-in (.xll) files to infect systems compared to last quarter – a technique found to be particularly dangerous as it only requires one click to run the malware.
The team also found adverts for .xll dropper and malware builder kits on underground markets, which make it easier for inexperienced attackers to launch campaigns.
Additionally, a recent QakBot spam campaign used Excel files to trick targets, using compromised email accounts to hijack email threads and reply with an attached malicious Excel (.xlsb) file.
After being delivered to systems, QakBot injects itself into legitimate Windows processes to evade detection.
Malicious Excel (.xls) files were also used to spread the Ursnif banking Trojan to Italian-speaking businesses and public sector organizations through a malicious spam campaign, with attackers posing as Italian courier service BRT. New campaigns spreading Emotet malware are now using Excel instead of JavaScript or Word files too.
Other notable threats isolated by the HP Wolf Security threat insight team include:
- The return of TA505? HP identified a MirrorBlast email phishing campaign sharing many tactics, techniques, and procedures (TTPs) with TA505, a financially motivated threat group known for massive malware spam campaigns and monetizing access to infected systems using ransomware. The attack targeted organizations with the FlawedGrace Remote Access Trojan (RAT).
- Fake gaming platform infecting victims with RedLine: A spoofed Discord installer website has been discovered, tricking visitors into downloading the RedLine infostealer and stealing their credentials.
- Switching up uncommon file types is still bypassing detection: The Aggah threat group targeted Korean-speaking organizations with malicious PowerPoint add-in (.ppa) files disguised as purchase orders, infecting systems with remote access Trojans. PowerPoint malware is unusual, making up 1% of malware.
“Abusing legitimate features in software to hide from detection tools is a common tactic for attackers, as is using uncommon file types that may be allowed past email gateways.
Security teams need to ensure they are not relying on detection alone and that they are keeping up with the latest threats and updating their defenses accordingly.
For example, based on the spike in malicious .xll sightings we are seeing, I’d urge network administrators to configure email gateways to block incoming .xll attachments, only permit add-ins signed by trusted partners or disable Excel add-ins entirely,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.
“Attackers are continually innovating to find new techniques to evade detection, so it’s vital that enterprises plan and adjust their defenses based on the threat landscape and the business needs of their users. Threat actors have invested in techniques such as email thread hijacking, making it harder than ever for users to tell friend from foe.”
The findings are based on data from the many millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro Virtual Machines (micro-VMs) to understand and capture the full infection chain, helping to mitigate threats that have slipped past other security tools.
This has let customers click on over 10 billion email attachments, web pages, and downloads with no reported breaches. By better understanding the behaviour of malware in the wild, HP Wolf Security researchers and engineers can bolster endpoint security protection and overall system resilience.
Other key findings in the report include:
- 13% of email malware isolated had bypassed at least one email gateway scanner.
- Threats used 136 different file extensions in their attempts to infect organizations.
- 77% of malware detected was delivered via email, while web downloads were responsible for 13%.
- The most common attachments used to deliver malware were documents (29%), archives (28%), executables (21%), spreadsheets (20%).
- The most common phishing lures were related to the New Year or business transactions such as “Order”, “2021/2022”, “Payment”, “Purchase”, “Request” and “Invoice”.
“Today, low-level threat actors can carry out stealthy attacks and sell access onto organized ransomware groups, leading to large-scale breaches that could cripple IT systems and grind operations to a halt,” comments Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.
“Organizations should focus on reducing the attack surface and enabling quick recovery in the event of compromise. This means following Zero Trust principles and applying strong identity management, least privilege and isolation from the hardware level.
For example, by isolating common attack vectors such as email, browsers or downloads using micro-virtualization, any potential malware or exploits lurking within are contained, rendering them harmless.”
The Nigerian Insurers Association has urged the House Committee on Capital Market and Institutions to respect the constitutional separation of powers as it carries out a probe on over 20 insurance firms.
In a statement on Tuesday night, the Director General/Chief Executive Officer of NIA, Mrs Bola Odukale, said the decision of NIA and the affected firms to approach the court was to seek clarity on the constitutional limits of the House Committee’s probe.
It would be recalled that the House of Representatives on Monday is investigating no fewer than 25 insurance companies operating in the country for various financial infractions spanning financial reporting, claims settlement, premium remittance, and issuance of policies.
The Chairman, House Sub-Committee on Capital Market and Institutions, Kwamoti Laori, during a meeting with the management of the insurance companies at the National Assembly Complex in Abuja, said the meeting was convened following the receipt of a petition on infractions by the insurance companies.
In the statement, Odukale said, “The Association wishes to state unequivocally that all actions taken by the NIA and the affected member companies in response to the Committee’s invitations and pronouncements were based entirely on legal advice by its Solicitors. It was on the firm instruction of legal counsel that recourse was made to the courts.
“The objective of approaching the Court is to seek judicial guidance on the legality, propriety, and constitutional limits of the Committee’s intervention in order to safeguard institutional integrity, uphold regulatory independence, and ensure that legislative oversight remains within the bounds of law.
“The Court action seeks to determine whether the current posture of the Committee reflects an exercise of legislative judgment, which, by constitutional design, is the exclusive province of statutory regulators, such as the National Insurance Commission, Securities and Exchange Commission, Nigerian Exchange, Financial Reporting Council, Nigeria Data Protection Commission, and the National Information Technology Development Agency.
“This raises serious questions about legislative overreach and an erosion of the doctrine of separation of powers, a cornerstone of Nigeria’s constitutional democracy.”
Odukale maintained that the NIA was committed to lawful and constructive engagement with all arms of government, provided that such engagement respects the autonomy of statutory regulators and the boundaries established by the Constitution.
“The NIA will continue to provide its full support to all member companies while upholding the principles of legal compliance and sector-wide integrity,” Odukale concluded.
17 of the companies that went to court were represented by their lawyer, Mr Abimbola Kayode, at the meeting with the committee.
Finance ministers and development partners from the Horn of Africa have called for enhanced digital integration to boost trade, drive economic growth and promote regional stability during the 25th Ministerial Meeting of the Horn of Africa Initiative (HoAI).
Held in Nairobi, on July 14, the meeting was co-chaired by the African Development Bank’s Vice President for Regional Development, Integration and Business Delivery, Nnenna Nwabufo and Somalia’s Minister of Finance, Bihi Iman Egeh. Discussions underscored the critical role of digital integration in reducing trade barriers, boosting government service delivery and creating employment — particularly for the region’s youth.
“Digital technologies are shaping today’s economy and tomorrow’s industries. By embedding these technologies into our programs, we can not only improve inclusion but also leapfrog outdated development models,” said Nwabufo.
She called for digital integration a “central enabler” in each of the Horn of Africa Initiative’s pillars – trade, infrastructure, resilience, and human capital,
Learning through experience
Drawing from global and regional success stories, speakers highlighted the transformative potential of technology-led development. The ministers pointed to the Philippines as a strong example, where ICT has generated millions of jobs in business process outsourcing. Similarly, Kenya’s fintech innovation—especially the success of M-PESA—was cited as a model for scaling digital financial services across the region.
Participants urged governments to proactively foster digital ecosystems by capitalizing on the demographic dividend, identifying infrastructure upgrades, tighter regulatory reforms, and digital skills trainings as priorities to enable broader participation in the digital economy.
Minister Egeh reiterated the need for more coordinated regional efforts to create the enabling environment required for accelerated digital integration and expansion. He referenced the HoAI Digital Policy Matrix, adopted in 2023 which provides a blueprint on how to address key obstacles to achieving effective digital integration across the region.
Barack Makokha, Kenya’s Cabinet Secretary for National Treasury, underscored the importance of regionally-aligned public private partnerships and advocated for blended financing to reduce investment risk and expand digital access in underserved areas.
World Bank Vice President for Eastern and Southern Africa, Ndiame Diop, called for a comprehensive multi-pronged approach, combining cross-border coordination, large-scale financing, robust policy support, and digital infrastructure investments. He pointed out that such measures could transform digital integration into, “a powerful engine of economic transformation” for the Horn of Africa—ensuring no one is left behind in the digital era.
The meeting concluded with a shared recognition that sustained political will and the determination to implement a multifaceted approach are essential to unlocking the region’s economic potential and driving long-term growth.
The event also welcomed observers from the East African Community, Agence française de développement, and Shelter Afrique, reflecting strong regional and international backing for the HoAI in the development community.
Central Securities Clearing System Plc (CSCS), Nigeria’s capital market infrastructure provider, has launched its Custodian Portal, a user-centric digital solution designed to optimise custodian operations through intuitive, secure and efficient features.
Haruna Jalo-Waziri, Chief Executive Officer (CEO), CSCS, announced this in a statement on Monday.
The CSCS is a Public Limited Company with a diversified shareholder base, which serves as the Central Securities Depository for the Nigerian Capital Market.
It serves as the Central Depository for Equities, Commercial Papers, Corporate Bonds, Sub-National Bonds, certain Sovereign Bonds like the FGN Sukuk and the FGN Savings Bond, Equity-traded Funds, Real Estate Investment Trusts, Mutual funds and Commodities.
Jalo-Waziri said that the custodian portal offered a streamlined experience for market participants with powerful tools that facilitate comprehensive portfolio and trade management, document tracking, share transfer operations, client symbol search, and real-time access to vital data.
He explained that the portal, designed to operate through a flexible subscription-based model, empowered users to manage their records effortlessly and securely through convenient payment channels such as GTPay and Paystack.
According to him, “Digital transformation remains at the core of our strategy to enhance the efficiency, transparency and accessibility of Nigeria’s capital market services.
“The custodian portal is a significant leap in that direction, offering custodians a centralised platform to manage critical processes in real-time.
“We are excited about the value this innovation brings to our stakeholders, and we will continue to evolve the platform in line with users’ needs and industry trends.”
The CEO also explained that the portal was designed with user experience in mind with feature tools like portfolio viewing and downloads in PDF or Excel format.
He further said that it also featured tracking of stock movements across date ranges, inbox messaging and request tracking, as well as robust user management capabilities including role assignment and status tracking.
Similarly, the Divisional Head, Business Technology and Digital Innovation, CSCS Plc, Tobe Nnadozie, said that the portal aligned with CSCS’s drive to automate the market.
“In addition to the normal features, the platform is a part of an omnichannel platform for custodians, and includes API services.
“It also connects to the market-wide workflow, which CSCS has built to ensure secured communication and approvals across all major stakeholders in the market.
“The platform is well secured with best-of-breed cybersecurity solutions and our SOC,” he said.
The Custodian Portal reinforces CSCS’s commitment to leveraging technology to streamline back-office functions and support a more agile, data-driven capital market ecosystem.
All custodians in the Nigerian capital market have now been successfully on-boarded on the Custodian Portal, marking a significant milestone in CSCS’s ongoing drive to enhance collaboration, standardise operational processes, and promote digital adoption across the market.
Kuda Unveils New Wallet for Multiple Currencies
Telcos Resume SIM Card Sales after 2-Week Halt
NITDA, API Partner Against Harmful Online Content
NCAA Orders Airlines to Enforce $10,000 Currency Declaration Rule
NIA Questions Legality of Reps’ Financial Probe
E-Financial2 days agoUBA’s LEO Becomes Africa’s First Chatbot to Enable Cross-Border Payments
News2 days agoUN Appoints Sa’id, Nigerian to Nuclear Panel
E-Business2 days agoNIMC Enrolls 122m for NIN, Cuts Extortion by 40 Percent
Telecom1 day agoMTN Nigeria Rewards 1,500+ Winners with ₦290m in Mega Billion Promo
Telecom2 days agoMTN Urges Nigerian to Regards Telecom Infrastructure as National Assets
General News2 days agoAppeal Court Nullifies Registration of ‘KPMG Professional Services’
E-Financial1 day agoNaira Slides Again, Hits ₦1,532.34/$ Despite CBN’s Dollar Push
Telecom2 days agoBitget Launches $6M Global Crypto Trading Contest with New Competitive Segments