E-Business
Qbot Emerges Most Prevalent Malware in First Half of 2023, Mobile Trojan SpinOk Makes its Debut
Check Point® Software Technologies, a provider of cybersecurity solutions globally, has published its Global Threat Index for June 2023. Researchers found that the Trojan Qbot has been the most prevalent malware so far in 2023, ranking first in five out of the six months to date.
Meanwhile, mobile Trojan SpinOk made its way to the top of the malware list for the first time after being detected last month, and ransomware hit headlines following a zero-day vulnerability in file sharing software MOVEIt.
Qbot, which initially emerged in 2008 as a banking Trojan, has undergone consistent development, acquiring additional functionalities for the purpose of stealing passwords, emails, and credit card details.
It is commonly propagated through spam emails and employs various techniques such as anti-VM, anti-debugging, and anti-sandbox methods to impede analysis and avoid detection.
Presently, its primary role is to act as a loader for other malware and establish a presence within targeted organizations, serving as a stepping stone for ransomware group operators.
Meanwhile, researchers discovered a prolific mobile malware that has so far amassed 421 million downloads. Last month, for the first time, Trojanized Software Development Kit (SDK) SpinOk made its way to the top of the mobile malware families. Used by numerous popular apps for marketing purposes, this malicious software has infiltrated highly popular apps and games, some of which were available on the Google Play Store.
Capable of stealing sensitive information from devices and monitoring clipboard activities, SpinOk malware poses a serious threat to user privacy and security, underscoring the need for proactive measures to protect personal data and mobile devices. It also serves as a stark reminder of the devastating potential of software supply chain attacks.
Last month also saw the launch of a large-scale ransomware campaign that impacted organizations worldwide. In May 2023, Progress Software Corporation disclosed a vulnerability in MOVEit Transfer and MOVEit Cloud (CVE-2023-34362) that could allow unauthorized access to the environment.
Despite it being patched within 48 hours, cybercriminals associated with Russian-affiliated ransomware group Clop exploited the vulnerability and launched a supply chain attack against MOVEit users.
To date, 108 organizations – including seven US universities – have been listed publicly, following the incident, with hundreds and thousands of records obtained.
“The MOVEit exploit proves that 2023 is already becoming a significant year in ransomware. Prominent groups like Clop are not operating tactically to infect a single target, but instead, making their operations more efficient by exploiting software that is widely used in a corporate environment.
This approach means they can reach hundreds of victims in a single attack.” said Maya Horowitz, VP Research at Check Point Software. “This attack pattern emphasizes the importance for companies to implement a multi-layered cyber security strategy and to prioritize patching quickly when vulnerabilities are disclosed.”
CPR also revealed that “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability last month, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.
Top malware families
Globally, Qbot was the most prevalent malware last month with an impact of 7% worldwide organizations, followed by Formbook with a global impact of 4% and Emotet with a global impact of 3%.
In Nigeria, Qbot was the most prevalent malware last month with an impact of 19.72%, followed by Expiro with an impact of 15.49% and FormBook with an impact of 7.04%.
- Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection.
- Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
- FormBook – FormBook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
Top Attacked Industries Globally
Last month, Communications remained in first place as the most exploited industry globally, followed by Utilities and Transportation.
- Communication
- Utilities
- Transportation
Top exploited vulnerabilities
Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.
- ↔ Web Servers Malicious URL Directory Traversal – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.
- ↔ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↔ HTTP Headers Remote Code Execution (CVE-2020-10826, CVE-2020-10827, CVE-2020-10828, CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
Top Mobile Malwares
Last month SpinOk rose to first place in the most prevalent Mobile malware, followed by Anubis and AhMyth.
- SpinOk – SpinOk is an Android software module that operates as spyware. It collects information about files stored on devices and is capable of transferring them to malicious threat actors. The malicious module was found present in more than 100 Android apps and downloaded more than 421,000,000 times until May 23.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which usually used to steal sensitive information.
Media Rights Agenda (MRA), has unveiled a visual brief emphasizing the critical need for responsible and ethical use of Artificial Intelligence (AI) in journalism, particularly within Nigeria’s evolving media environment.
This is coming ahead of World Press Freedom Day today.
The visual brief, developed under this year’s global theme, “Reporting in the Brave New World – The Impact of Artificial Intelligence on Press Freedom and the Media,” explores the opportunities and dangers AI poses to media freedom in Nigeria and across the world.
In a statement released in Lagos by John Gbadamosi, its programme officer,MRA noted that AI is quickly changing the way news is produced and consumed, adding that it offers powerful tools that can assist journalists in analysing data, translating stories into local languages, and extend the reach of vital information, especially to underserved areas with limited media infrastructure.
Gbadamosi added that AI can help to ensure that essential news and information are also disseminated to local communities.
However, Gbadamosi warned that the same technology is being weaponised to undermine truth and press freedom, saying: “While AI can be used to advance journalism, it can just as easily be exploited to spread disinformation, create deepfakes, and drown out independent voices with algorithmically generated propaganda.”
According to him, “In Nigeria, journalists face threats that go beyond just physical dangers; such threats now also encompass digital, algorithmic, and systemic harms and challenges, which requires media professionals to ensure that AI enhances, rather than undermines, media freedom and that technology is used to promote the truth, not distort it.”
“The visual brief breaks down key concepts like misinformation, disinformation, mal-information, and information overload, which are increasingly shaping Nigeria’s digital media ecosystem. It also raises concerns about AI-enabled surveillance, political manipulation, and the marginalisation of community-based journalists.”
Gbadamosi stated that the visual brief also advocates support for independent media, transparent AI regulations aligned with Nigeria’s context, increased digital literacy, and stronger accountability from tech companies regarding platform content and influence.
He therefore urged all stakeholders to advocate for responsible AI usage and a free, independent, professional and vibrant media environment in Nigeria, stressing that “when media freedom thrives, democracy lives.”
The National Identity Management Commission (NIMC) has raised the fees for all its products and services, including charges related to data modification on the National Identification Number (NIN) database.
In a statement issued in Abuja, Kayode Adegoke, NIMC’s Head of Corporate Communications, announced that the updated service fees are published on the commission’s official website.
Adegoke noted that the new pricing structure for NIMC’s services and products marks the first comprehensive review of its fees in over a decade.
The statement stated that the revised pricing is designed to align with prevailing operational costs and industry standards, while continuing to ensure that services remain accessible and affordable for all Nigerians.
The statement warned its Front-End Partners (FEPs) to comply with the newly approved rates, stating that any failure to do so could attract strict sanctions, including possible license revocation.
“The new structure ensures that the quality and integrity of our services remain uncompromised. We are committed to protecting the interests of Nigerians through fair and transparent pricing,” the statement read.
NIMC urged the public to report any Front-End Partners (FEPs) found charging beyond the approved rates. Reports can be directed to the Commission’s Inspectorate and Enforcement Unit via email at ieu@nimc.gov.ng
It further reaffirmed its commitment to delivering secure and dependable identity services. A complete list of the revised service fees can be accessed on its official website at www.nimc.gov.ng.
In a related development, Abisoye Coker-Odusote, Director General of the National Identity Management Commission (NIMC), expressed sincere appreciation to President Bola Ahmed Tinubu for his unwavering support in enhancing the National Identity Database (NIDB).
She also extended her gratitude to the Minister of Interior, Dr. Olubunmi Tunji-Ojo, and other key partners for their pivotal roles in advancing a sustainable and effective identity management system.
Artificial intelligence (AI) adoption could boost Africa’s gross domestic product by an additional 4.9 percentage points by 2035, as the African economy is reshaped by the emerging technology.
This is according to PwC’s recently released report: Value in Motion. It is based on data-driven scenario analysis, which reveals that globally, AI has the potential to boost economic output by up to 15 percentage points over the next decade.
The global growth dividend from AI varies according to the region and depends on more than technical success – it also hinges on responsible deployment, clear governance, and public and organisational trust, notes the report.
This would effectively add one percentage point to annual growth rates − on par with the growth increment the world began enjoying with 19th century industrialisation.
In other scenarios analysed by PwC, characterised by lower trust and co-operation, the incremental boost to the economy from AI would be more muted at 8%, or in a pessimistic scenario just 1%.
The research finds that rapid reconfiguration of the economy is already under way. PwC analysis indicates the pressure for African businesses to reinvent themselves is at some of the highest levels seen in the last 25 years across six out of nine sectors in Africa.
The $150.54 billion in revenue in Africa is set to shift between companies in 2025 alone, a trend that begun prior to the recent global increase in tariffs.
PwC’s research suggests that over the next decade, industries will reconfigure to meet human needs in new ways, leading to the formation of new ‘domains’ that cross traditional sector lines.
Dion Shango, PwC Africa CEO, explains: “As the structure of the economy transforms, value will increasingly come from organisations that can connect the dots across traditional industry boundaries. By focusing on evolving customer needs and using technology to dramatically change the way business operates, business leaders can unlock a step change in growth.”
According to Google’s Digital Opportunity of Africa report, AI could contribute up to $30 billion to Sub-Saharan Africa’s economy by 2030. Africa stands to accelerate its growth through AI as more people gain connectivity and harness technology for good, it notes.
“Across the continent, a new generation of innovators are harnessing technology to solve some of the world’s most pressing challenges,” says Google.
In terms of AI’s impact on the climate, PwC’s analysis shows that while AI is set to accelerate growth, the costs of physical climate threats will impose economic constraints.
PwC’s economic modelling suggests that physical climate impacts could result in the African economy being over 12%smaller (globally: 7%) by 2035 in all scenarios than it would have been otherwise.
“Increased AI adoption is expected to lead to increased energy use by data centres. However, modest use of AI to drive energy-efficiency could offset this increased use of energy. PwC estimates that the energy use and emissions impact of AI would be neutral if each additional percentage point of AI use led to innovations which cut energy intensity by just 0.1% globally,” says the report.
Fines: Meta Threatens to Shut Down Facebook, Instagram in Nigeria
History as TVC News Unveils Nigeria’s First AI-Powered News Anchors
Court Rejects Bid to Stop CBN from Using e-Naira Trademark
MRA Flags AI Concerns ahead of Press Freedom Day Today
NITDA, RHI, Commission IT Community Centre in Ibadan
E-Financial2 days agoCBN Slams ₦250m Fine on Paystack Over Zap Wallet Operations
General News2 days agoNITDA Inaugurates Start-up Consultative Forum
Telecom2 days agoGBB Reaffirms Commitment to Driving Public Sector Innovation @ the 5th Public Service Innovation Competition Awards
Telecom1 day agoSterling Bank Introduces AlwaysOn, Offering Nigerians Up to ₦1 Million Monthly
General News2 days agoNFIU Alerts Nigerians of Rising Ponzi Schemes, Unregulated Crowdfunding Scams
News2 days agoFirm Warns Against AI Password Generation @ World Password Day
Telecom2 days ago5 tips to start taking digital payments as a business in Africa
Telecom1 day agoBanks Settle ₦160Bn USSD Debt to Telcos, Ending Five-Year Dispute