Connect with us

Telecom

Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds

Published

on

Kindly share this post

Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.

Sophos logo

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.

After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.

While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.

“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.

“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.

“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.

“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”

Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.

While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.

In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.

Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.

Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.

However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.

“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.

“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.

To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).

For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

Over 65m GSM Lines Risk Disconnection over SIM-NIN Linkage

Published

on

Kindly share this post

About 65 million phone lines are at risk of disconnection after telecom operators refused to grant subscribers an extension to the National Identification Number (NIN) -Subscriber Identity Module (SIIM) linkage deadline.

Over 65m GSM Lines Risk Disconnection over SIM-NIN Linkage

The final deadline expired on September 14, 2024, and the Nigeria Communications Commission (NCC), the telecom regulator, expected that no SIM card would remain active without a verified NIN from September 15.

The Punch suggested that approximately 65 million lines remain at risk, as an estimated one million lines could not have been linked between the NCC’s deadline announcement and the actual cut-off date.

The telecom regulator’s data from March 2024 shows there were 219 million active lines across major networks such as MTN, Glo, Airtel, and 9mobile, with 153 million linked to NINs.

This means that about 66 million lines were unlinked to NIN after the NCC’s deadline announcement.

Meanwhile, , Gbenga Adebayo, chairman of the Association of Licensed Telecom Operators of Nigeria (ALTON), discarded the idea of a deadline extension and confirmed to The PUNCH on Monday that the disconnection process is already ongoing.

“It’s difficult to provide exact numbers for the lines disconnected so far, but it’s certainly less than 66 million because, even on the day of the deadline, people were still linking their SIMs,” Adebayo said.

He affirmed that mobile operators were adhering to the NCC’s directives, describing the deadline as “acceptable and reasonable.”

Adebayo urged subscribers to comply, stating, “We can’t keep extending deadlines and going back and forth on this issue. This is a national concern, and these data are critical for national development.”

However, the National Association of Telecoms Subscribers urged the NCC to extend the deadline.

Speaking with The PUNCH, the President of the association appealed to the NCC to push the deadline to September 22, allowing customer experience centres to operate over the weekend.

He said this would enable subscribers to resolve any registration issues on the NIN portal and avoid potential disruptions to telecom services.

“Given the NIN portal’s technical glitches that persisted for almost a week earlier, and the improvements made last week, it’s only fair that the NCC allows subscribers to make up for the lost time. This extension will provide a much-needed buffer for subscribers to resolve any registration issues,” he said.

Barely two weeks ago, Adeolu Ogungbanjo, president of the National Association of Telecommunications Subscribers (NATCOMS), expressed worry that there were challenges in linking NIN to SIM cards, with many subscribers expressing frustration over slow speeds and congestion on the NIMC portal.

Ogunbanjo emphasised that the current portal issues hinder the successful completion of the NIN-SIM linkage before the deadline, stating, “The current situation will not meet the deadline if not addressed urgently.”

Between July 28 and 29, millions of lines were temporarily barred due to unverified NINs, causing widespread disruptions in the country. The NCC had reversed its decision, giving subscribers more time to comply. However, with the deadline now expired, disconnections will commence.

Before the deadline elapsed, an NCC official, who requested anonymity as he was not authorised to comment on the matter, dismissed any possibility of an extension.

“We will disconnect anyone who refuses to comply; the grace period is over. The reason why we extended the last time was the misconception of Nigerians who claimed that the NCC wanted to frustrate the August 1 protest.”

In March, the NIMC and the NCC formed a strategic collaboration in a move at enhancing processes related to the NIN-SIM linkage.

According to their first-half 2024 financial results, MTN Nigeria and Airtel Africa collectively barred 13.5 million lines due to non-compliance with the NIN-SIM linkage directive.

MTN Nigeria reported blocking 8.6 million lines, while Airtel Africa stated that 4.8 million lines remained unverified, contrary to earlier reports of 8.7 million completed verifications.

The compulsory NIN-SIM linkage, initiated in December 2020, aimed to curb unregistered SIMs and those without NIN links. Following multiple deadline extensions by the NCC since December 2023, April 15, 2024, was set as the final deadline for fully barring subscribers with four or fewer SIMs having unverified NIN details.

 


Kindly share this post
Continue Reading

Telecom

Stakeholders Harp on Importance of Unified Infrastructure to Africa Digital Leap

Published

on

Kindly share this post

A robust infrastructure framework to drive digital transformation in Africa has been highlighted at the Hyperscalers Convergence Africa Conference that was held recently in Lagos.

Experts who gathered at the event concurred that Africa’s unique challenges require bespoke solutions, thus tasked authorities to invest in specialized infrastructure to secure the continent’s digital future.

Deremi Atanda, Managing Director of Remita Payment Services Limited (RPSL), during a panel session, themed, ‘Innovating Towards Africa’s Digital Future’ maintained that the quality of digital infrastructure embraced by African nations will go a long way in determining their depth of prosperity.

He pointed out how connectivity gaps were still affecting intra-African payment, despite numerous breakthroughs in the space.

Consequently, Atanda joined by other industry leaders in the panel stressed collaboration among leaders as well as stakeholders and community engagement to foster a unified digital infrastructure agenda.

Additionally, he suggested creating an African digital infrastructure investment bond, believing it would compel all parties to invest in a digital future.

He said, “There is still much work to be done in creating intra-African payment systems that facilitate trade and economic collaboration without relying on external channels. Pan-African payments have been a long time coming.

“It’s time to take ownership of our digital future and ensure that our solutions are designed by Africans, for Africans. At Remita, we remain committed to driving innovation and redefining the ease of connected payments digitally.”

He said further, “solving Africa’s problems within its context will yield multidimensional benefits. Improved digital infrastructure will enhance the quality of life across the continent, connecting Africa in unprecedented ways.

“Moreover, expanding digital infrastructure will significantly enhance skills development in Africa, connecting more people and creating vast opportunities for the continent’s growth.

“By integrating diverse skills and fostering collaboration, we can accelerate trade, expand local economies, and enhance the quality of life across the continent. Continuous monitoring and evaluation will ensure sustainable progress, making Africa a significant player in the global digital landscape.”

Corroborating Atanda’s perspective, Wabo Majavu, Executive, Strategy & Business Operations at Africa Data Centres, recognized the need for periodic communication and collaboration among the continent’s leaders to achieve a unified vision for the digital transformation agenda.

He underscored the necessity of expanding digital infrastructure to enhance digital inclusion, stating that some communities are still left behind.

 


Kindly share this post
Continue Reading

Telecom

Nnamani calls for Deliberate Moves Towards AI Regulation, Data Center Growth

Published

on

Kindly share this post

The need to develop Artificial Intelligence (AI) as an ethical solution has been highlighted by the Chief Executive Officer of Digital Realty, Nigeria, Engr. Ikechukwu Nnamani.

L-R: Mr.Chike Onwuegbuchi, Chairman,Nigerian Information Technology Reporters Association (NITRA), Engr.Ike Nnamani, CEO, Digital Reality, Mrs.Chioma Ezike, Treasurer of NITRA and Mr.Chidiebere Nwankwo,Secretary general of NITRA during a courtesy visit to Digital Reality head office in Lagos.

Speaking during a courtesy visit by the Executive Committee of the Nigeria Information Technology Reporters’ Association (NITRA) as a fall out of the Association’s ICT Growth Conference with the theme “Impact of AI On National Development: Prospects, Policies, and Challenges in Nigeria”, Nnamani noted that people developing ethical solutions for AI are few compared to people producing non-ethical solutions, but have come to take advantage and make money.

Nnamani explained that this trend is not peculiar to Nigeria, but also the reason most developed countries are seeking ways to regulate AI as soon as possible.

“Even the U.S. have a major effort, both in their congress as well as the Executive, to ensure there is work being done on AI Safety and Best Practices, reason being that some companies or individuals are only looking at AI from the value it adds to them, without thinking of what the consequence for any value is. One start looking at it from an ethical standpoint

U.S. and every other country, their governments are actively involved in creating the right policy, to be sure that it is not abused. But more importantly, to be sure they are able to answer it well.”

While applauding the regulators, he said that on the side of regulation in Nigeria, it is a work in progress. “I don’t even see it is a problem or challenge because to the best on my knowledge AI has not gone too far in its adoption in Nigeria. That means our government, across all areas, need to look back and ask; is there any potential harm from this service or technology? How do we mitigate it? What do we do to stop that harm? And these are things they are doing now by asking people to check things, just to be sure that whatever applications you are running, you are running it ethically.”

Nnamani however allayed fears of unnecessary job less, noting that the advent of AI will further drive up-skilling of Nigerians. “Some have said AI will take jobs away. So, should we stop? Truth is that it is not AI taking anybody’s job away, it is just a case of people needing to be re-trained and find out how to use AI for better efficiency and cost-effectiveness.

Also speaking on the state of Data Centers in Nigeria, Nnamani noted that although Nigeria have increased the number of Data Centers operational in the country in the past few years, it is not yet enough to take care of its bourgeoning data and digital economy.

“Some report that was published some years back indicated that Nigeria, as at now, should have at least 600 megawatts of IT load, giving the size of our economy, population, GDP, and what it should be if we are a truly digital economy.

“Today we have about 30 megawatts. So, you can see the percentage of what we have compared to what we need to have. That is even in terms of the size of IT load which is a matrix we use.

“Now in terms of quantity, for instance, if you go to a city like Toronto, last time I checked there were over 30 Data Centers in that city.

The reality is that we have not started, we are not even anywhere close to starting, if we really understand what needs to be done to have a truly digital economy.”

He observed that the Data Center sub-sector needs a lot of people with foresight to draw investors and put up infrastructure.

“And then, of course, from the government side, it requires a lot of support. Not just from regulation as a means to extracting income to the regulators, but regulation as actually a way of growth for that industry.

“Luckily we have very good regulators who understand this part of the telecom industry, so they are as supportive as can be, but we still need a lot. All these must come together for us to see a fully digital economy, which I believe is the goal of everybody,” he said.

“In Lagos, for instance, there is a lot of progress in the build-out of this infrastructure, but you hardly see much in every other State. So there is still a lot of work that still need to be done.

“There are still some cross-city service that still need to be run for the overall growth of the economy and social wellbeing of the people that the infrastructure still do not exist,” he said.

Nnamani listed some of the key challenges facing Data Center operation in Nigeria to include Power and FOREX, which he said the Federal Government should do good to tackle.

“The truth is that doing business in Nigeria is challenging. Everybody knows that. And the biggest challenge, probably, is FOREX. Initially, having access to FOREX was the issue.

“But for us that have access to FOREX, it is how is the FOREX trending? And does it create a measure of stability for you to be able to make business projections.

Look at power, for instance. Power that you assume should be available to you if you are a business person, you pay for the power and it won’t be delivered,” he concluded.

The NITRA ICT Growth Conference gathered industry stakeholders to discuss the way forward in the deployment and use of AI in the system.

 

 


Kindly share this post
Continue Reading

Trending