News
Mobile Devices Targeted as Cyberattacks Increase by 13%
Research from European managed security services provider Orange Cyberdefense has revealed a 13% increase in cyberattacks on enterprises over the past 12 months, with a rise in ransomware incidents and, for the first time, a noticeable wave of attacks against mobile devices.
This is according to the Orange Security Navigator 2022, which provides a detailed analysis of more than 50 billion security events analysed daily over the past year (October 2020 to October 2021) by Orange Cyberdefense’s 18 Security Operation Centres (SOCs) and 14 CyberSOCs across the globe.
Of the 94,806 incidents flagged as being potential threats, analyst investigation confirmed 34,156 (36%) to be legitimate security incidents – a 13% increase on the year before.
More than a third (38%) of all confirmed security incidents were classified as malware, including ransomware – an increase of 18% on 2020.
The report found that almost two thirds (64%) of the security alerts dealt with by Orange Cyberdefense analysts turned out to be ‘noise’ and did not represent a genuine threat – an increase of 5% on the previous year.
The findings suggest that many organisations, particularly small and medium sized businesses, will require more resources to filter this massive amount of data for potential threats. The risk is that these businesses will become increasingly vulnerable to attack as the level and volume of activity continues to rise.
The Security Navigator also reports that mobile operating systems like iOS and Android in a business context are an increasingly popular target for exploits. Many of the activities appear to be related to commercial companies contracted by law enforcement and intelligence agencies.
However, the vulnerabilities and exploits developed will likely not stay in that realm, but have in the past and will likely in the future find their way into the criminal ecosystem as well (mind the WannaCry attack of 2017).
Orange Cyberdefense predicts attacks targeting mobile devices are likely to continue on this upward trajectory. This is a development that security professionals will need to pay closer attention to.
Mobile platforms are key in modern access protection concepts, namely multi-factor authentication (MFA), which is commonly used in corporate environments to protect cloud access for instance.
Another key finding of the new Security Navigator is that malware, including ransomware, was the most common type of threat reported across the analysis period, with 38% of all confirmed security incidents classified as malware – an increase of 18% on 2020.
Among the key malware trends are:
- A decrease in confirmed downloader activity (malware that downloads and runs other malware on affected systems) in November and December 2020 after the Trickbot botnet was taken down by law enforcement, and in January and February 2021, directly after Emotet was taken down;
- An inverse correlation between the stringency of Covid-19 lockdowns and the volumes of downloader and ransomware activity: the more stringent the lockdowns, the less of this activity, running contrary to the prevailing narrative that attacks increase when users work from home;
- Large organisations see more than double (43%) the amount of confirmed malware incidents than medium-sized businesses.
Hugues Foulon, CEO of Orange Cyberdefense, said: “Attacks like Solorigate show that even trusted software from reliable vendors can turn into a trojan horse for cunning attackers. Technology alone cannot be the solution to this problem.
As our data shows, we have seen a 13% increase in the number of incidents in just one year, and these incidents keep increasing year on year.
A large proportion of the tech-driven security alerts that our analysts deal with are just noise but this puts a tremendous strain on already stretched IT and security teams. Indeed, not all businesses have the means or resources to employ managed security services providers to help them sift through the ‘noise’ and find the actionable security ‘signals’. We thus believe that security technologies can, and must, do better.”
Senator David Umahi, the Minister of Works, has announced that a section of the Lagos-Calabar Coastal Highway will be tolled starting in December.
Umahi disclosed this during an interview for a forthcoming State House documentary marking the second anniversary of President Bola Tinubu’s administration.
He said: “By December, we will toll Section 1 of the Lagos-Calabar coastal highway. We project a 10-year return on investment.
“The road has solar-powered lighting and CCTV infrastructure, and offers carbon credit advantages.
“It is more than a road; it is an economic corridor and a catalyst for regional growth.”
According to the minister, 30 kilometres of Section 1 have already been completed, with an additional 10 kilometres in Section 2 nearing delivery. Both segments feature six-lane concrete-paved carriageways, designed to meet modern standards for safety and durability.
Umahi further revealed that construction had commenced on Sections 3 and 3B of the highway, spanning a total of 65 kilometres, covering 38 kilometres in Cross River State and 27 kilometres in Akwa Ibom.
He described the positive response from local communities as a clear indication of the project’s wide-reaching socioeconomic benefits.
“Just days ago, we flagged off Sections 3 and 3B—65 kilometres in total, covering 38 kilometres in Cross River State and 27 kilometres in Akwa Ibom. The host communities’ excitement speaks to these projects’ transformative impact,” he said.
Umahi also highlighted the administration’s renewed focus on the Sokoto-Badagry superhighway, which he noted was part of a broader vision dating back to colonial-era trade plans.
“The Trans-Saharan trade route dates back to colonial-era planning. President Tinubu is now bringing these long-abandoned visions to life,” the minister explained.
Kaspersky Security Services experts have identified a sophisticated cyberattack campaign targeting containerized environments to deploy a miner for the Dero cryptocurrency.
The attackers abuse exposed Docker APIs — parts of Docker, an open-source container development platform. In 2025, there are a significant number of Docker API default ports that are insecurely published, accounting for almost 500 occurrences worldwide on average each month.
In the discovered campaign, cybercriminals inject two types of malwares into the compromised systems: one is the miner itself and the other is a propagation malware that can spread the campaign to other insecure container networks.
Kaspersky experts discovered this malicious campaign as part of a compromise assessment project. According to expert estimates, any organisation that operates containerized infrastructure — while exposing Docker APIs without robust security controls — can be a potential target. These may include technology companies, software development firms, hosting providers, cloud service providers and more enterprises.
According to Shodan, in 2025, there are 485 published Docker API default ports¹ worldwide each month on average. This figure illustrates the campaign’s potential attack surface by tallying the “entry points” — or insecurely exposed ports that attackers might target.
Once attackers identify an insecurely published Docker API, they either compromise existing containers or create new malicious ones based on a legitimate standard Ubuntu image. They then inject two malware types into the compromised containers: “nginx” and “cloud”.
The latter is a Dero cryptocurrency miner, while “nginx” is a malicious software that maintains persistence, ensures execution of the miner and scans for other exposed environments. This malware allows attackers to operate without traditional Command-and-Control (C2) servers; instead, each infected container independently scans the Internet and can spread the miner to new targets.
“The campaign has the potential for exponential growth of infections, with each compromised container acting as a new source of attack, if security measures are not immediately put in place in the potentially targeted networks,” explains Amged Wageh, an incident response and a compromise assessment expert at Kaspersky Security Services.
“Сontainers are foundational to software development, deployment, and scalability. Their widespread use across cloud-native environments, DevOps, and microservices architectures makes them an attractive target for cyber attackers. This growing reliance demands organisations adopt a 360-degree approach to security — combining robust security solutions with proactive threat hunting and regular compromise assessments”.
The attackers embedded the names “nginx” and “cloud” directly in the binary — an inflexible executable file composed of instructions and data for the processor, not for humans. This is a classic masquerading tactic that lets the payload pose as a legitimate tool, trying to deceive both analysts and automated defenses.
Economic and Financial Crimes Commission (EFCC), on Tuesday, charged five defendants before a Federal High Court in Lagos for allegedly hacking into the server of Premium Trust Bank.
The defendants are listed as the bank’s e-payment service manager, Matthew Adeniyi; Kehinde Odeyemi, a nursing mother; Samson Latshin, Bolaji Omotosho and Sunday Okunnola.
They were charged before Justice Alexander Owoeye, on a six-count charge bordering on conspiracy, cybercrime and unlawful access to the bank’s database.
They, however, pleaded not guilty to the charge.
Mrs. Zeenat Atiku, prosecutor, alleged that they committed the offence between April and May this year, in collaboration with three others, now at large.
Those still at large are Isa Ismaila, Victor Joshua, also known as ‘Oracle’ as well as one other, simply identified as Humble.
According to the charge, the first defendant unlawfully disclosed sensitive credentials, including the bank’s server IP and domain details, to these parties.
She said this enabled an unauthorised access to the bank’s database and the consequent data breach allegedly resulted in financial gains of $10,000.
The prosecutor also alleged that the defendants attempted to intercept the bank’s network and procured a Hewlett-Packard ProBook 440 G9 laptop (serial No. SN#5CD2473N6G) configured to bypass the bank’s security systems.
The anti-graft agency said the alleged offences contravened the provisions of sections 12(1)(b), 27, 28(1)(b)(c) and 28(3) of the Cybercrimes (Prohibition Act, 2015 (as amended in 2024).
Following their pleas, the prosecutor, requested for a trial date and sought an order to remand the defendants in custody.
Meanwhile, the court declined an oral bail by the defence counsel and directed that a formal bail application be filed.
He adjourned the case until June 30, for trial and ordered that the defendants be remanded at the Nigerian correctional centre, pending bail.
The court, however, added that the defence may apply for an earlier trial date, upon filing their bail applications.
Toll Collection on Lagos-Calabar Highway Begins December
CBN Introduces AML to Fight Financial Terrorism, Gives Banks Deadline
Peter Obi Denies Secret Meeting with Tinubu over Fidelity Bank
Luft Pay TV Launches in Lagos, Promises to Revolutionize Entertainment
INEC Sets Up AI Division to Strengthen Electoral System
Telecom2 days agoTelcos Warn of Nationwide Telecom Blackout over Diesel Shortage
E-Financial2 days agoCBN, SEC Fine Access Holdings N1.21Bn for Infractions
Telecom2 days agoNigerians Spend N5.3 Trillion on Telecom Services
News2 days agoKaspersky Uncovers Dero Crypto Miner Spreading via Exposed Container Environments
E-Financial2 days agoFirst Asset Management Launches N100 Billion Infrastructure Fund to Provide Sustainable Capital for Infrastructural Development Across Sectors
Telecom2 days ago13 New Things Google Launched at I/O 2025
Broadcasting2 days agoCanal+ Buyout Of South Africa’s MultiChoice one Step Closer
General News2 days agoIFC, Standard Chartered Expand Lending in Local Currencies