Telecom
Sophos Research Reveals that Attackers Are Using Log4Shell Vulnerability to Deliver Backdoors to Virtual Servers
Sophos, a global leader in next-generation cybersecurity, has released findings on how attackers are using the Log4Shell vulnerability to deliver backdoors and profiling scripts to unpatched VMware Horizon servers, paving the way for persistent access and future ransomware attacks. A new technical paper, “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers,” details the tools and techniques used to compromise the servers and deliver three different backdoors and four cryptominers. The backdoors are possibly delivered by Initial Access Brokers.
Log4Shell is a remote code execution vulnerability in the Java logging component, Apache Log4J, which is embedded in hundreds of software products. It was reported and patched in December 2021.
“Widely used applications such as VMware Horizon that are exposed to the internet and need to be manually updated, are particularly vulnerable to exploitation at scale,” said Sean Gallagher, senior security researcher at Sophos. “Sophos detections reveal waves of attacks targeting Horizon servers, starting in January, and delivering a range of backdoors and cryptominers to unpatched servers, as well as scripts to collect some device information. Sophos believes that some of the backdoors may be delivered by Initial Access Brokers looking to secure persistent remote access to a high value target that they can sell on to other attackers, such as ransomware operators.”
The multiple attack payloads Sophos detected using Log4Shell to target vulnerable Horizon servers include:
· Two legitimate remote monitoring and management tools, Atera agent and Splashtop Streamer, likely intended for malicious use as backdoors
· The malicious Sliver backdoor
· The cryptominers z0Miner, JavaX miner, Jin and Mimu
· Several PowerShell-based reverse shells that collect device and backup information
Sophos’ analysis revealed that Sliver is sometimes delivered together with Atera and PowerShell profiling scripts and is used to deliver the Jin and Mimu variants of the XMrig Monero miner botnet.
According to Sophos, the attackers are using several different approaches to infect targets. While some of the earlier attacks used Cobalt Strike to stage and execute the cryptominer payloads, the largest wave of attacks that began in mid-January 2022, executed the cryptominer installer script directly from the Apache Tomcat component of the VMware Horizon server. This wave of attacks is ongoing.
“Sophos’ findings suggest that multiple adversaries are implementing these attacks, so the most important protective step is to upgrade all devices and applications that include Log4J with the patched version of the software. This includes patched versions of VMware Horizon if organizations use the application in their network,” said Gallagher.
“Log4J is installed in hundreds of software products and many organizations may be unaware of the vulnerability lurking in within their infrastructure, particularly in commercial, open-source or custom software that doesn’t have regular security support. And while patching is vital, it won’t be enough if attackers have already been able to install a web shell or backdoor in the network. Defense in depth and acting upon any detection of miners and other anomalous activity is critical to avoid falling victim to such attacks.”
For further information read the article “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers” on Sophos News.
Sophos has closely monitored attack activity related to the Log4Shell vulnerability and has published a number of in depth technical and advisory reports, including Log4Shell Hell – Anatomy of an Exploit Outbreak, Log4Shell Response and Mitigation Recommendations, Inside the Code: How the Log4Shell Exploit Works, and Log4Shell: No Mass Abuse, But No Respite, What Happened?
Additional Resources
· Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of attackers
. Further details on the evolving cyberthreat landscape can be found in the Sophos 2022 Threat Report
. Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLabs Uncut, which provides Sophos’ latest threat intelligence
. Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps
. Learn more about Sophos’ Rapid Response Service that contains, neutralizes and investigates attacks 24/7
The four top tips for responding to a security incident from Sophos Rapid Response and the Managed Threat Response Team
Telecom
USSD Dispute: FG May Blacklist 18 Banks Allegedly Owing Telcos N250Bn
Indications have emerged that federal government may this week list names of 18 banks owing almost N250 billion naira to Nigerian telecom operators on Unstructured Supplementary Service Data (USSD), and have remained adamant towards settling it for several years.
Nigerian Communications Commission (NCC) has reportedly been given the nod to publish the names and approve that telcos withdraw services to them if after two weeks they fail to settle the debts, according to Vangaurd.
Recall that the issue of banks’ multi billionnaira USSD debt to telcos has lingered since 2020, rising from below N40 billion to N57 billion by the end of 2021 and N80 billion in 2022.
But now, the telcos claim the debt has risen above N250 billion and accused the banks of not complying with the repayment plan.
The recent development, cannot be unconnected with a December joint meeting between the two regulators, NCC and the Central Bank of Nigeria (CBN) which resolved that the banks pay part of the money by December 31, last year and defray the remaining gradually.
However, Vanguard gathered authoritatively that only four banks complied with the directive, while 18 others are still adamant.
Similarly, when the matter brewed heavily a few years ago, the National Assembly, Central Bank of Nigeria, CBN, and the Nigerian Communications Commission, waded in and also generated such a gentleman’s agreement, which gave the banks leverage to defray the debts gradually.
However, that did not also happen as the banks allegedly reneged.
A few weeks ago Gbenga Adebayo, chairman, Association of Licensed Telecommunications Operators of Nigeria (ALTON), accused the banks of deliberately frustrating any move to resolve the issue and threatened that the only option, since the banks have consistently failed to honour the agreements, would be to withdraw the support that gives the USSD platform life.
Telecom
Suspected Lakurawa Terrorists Kill 3 Telcoms Workers in Kebbi
Terrorists belonging to Lakurawa group have reportedly killed three staff of a leading telecommunication firm.
The insurgents were said to have invaded a construction site at Gumki village in Arewa Local Government Area of Kebbi State.
The bandits reportedly attacked a construction site at Gumki village in Arewa Local Government Area of Kebbi State when their victims were installing a surveillance mast for the Nigeria Immigration Service and killed them and one other person who is yet to be identified.
There was a conflicting report of which organization the victims belonged as the police said three of the deceased were Airtel staff and the residents identified them to be Immigration staff.
A staff of Sir Yahaya Specialist Hospital however corroborated the villagers, saying the three victims brought to the hospital were Immigration staff.
But SP Nafiu Abubakar, police spokesperson, said four persons lost their lives, one indigene and three staff of Airtel.
He said from the report the police got, Bello M Sani, state Commissioner of Police, alongside with CIS Muhammad Bashir, Comptroller, Nigeria Immigration Service, Kebbi State Command, Lawali mobilized their men to the scene to evacuate the corpses to Sir Yahaya Memorial Hospital in Birnin Kebbi.
He said his CP has deployed additional tactical teams to the area and charged them to decisively deal with the suspected bandits operating in the area.
He said the CP also had meeting with people in the area and appealed to them to always assist the police and other security agencies with relevant information for their prompt response.
Telecom
Nigeria Has World’s Most Affordable Data Costs – GSMA
Nigeria has an average data cost of $0.38 per gigabyte, making her the most affordable countries globally and one of the cheapest in Africa for mobile data services.
United States averages $6 per gigabyte and South Africa with $1.77 per gigabyte rank the highest globally and in Africa respectively.
According to the GSMA, Nigerian data costs, as a percentage of Gross National Income (GNI) per capita, are among the lowest across Africa.
The reports by the body lends weight to telecom operators advocacy for tariff adjustments to address economic pressures threatening the sector’s sustainability.
The GSMA report, titled “The Role of Mobile Technology in Driving the Digital Economy in Nigeria,” highlighted Nigeria’s competitive data pricing, which is significantly lower than other African nations, such as Kenya ($0.59 per gigabyte), Ethiopia ($0.68 per gigabyte), and South Africa ($1.77 per gigabyte).
By contrast, the United States averages $6 per gigabyte, underscoring Nigeria’s advantage in offering cost-effective connectivity.
The cost of mobile data in Africa varies greatly by country and region.
Data costs can refer to the cost of mobile data or the cost of acquiring, maintaining, and using business data.
In 2023, the average cost of 1 GB of mobile data in Sub-Saharan Africa was $3.31, while in Northern Africa it was $0.86.
Telecommunications operators in Nigeria have been requesting some policy changes as well as tariff rebalancing to enable them deliver support to the Government’s digital economy objectives.
They have called for the simplification and improvement of the Right of Way (RoW) charging and administration process, harmonised across the country
According to them, all government authorities (at national and sub-national levels) should apply the national maximum RoW fee of N145 per/LSQM adopted by the National Economic Council (NEC) for the deployment of fibre across all states in Nigeria.
There should be a single point of contact in each state for the RoW application process while the duration for the approval process should be digitalised and limited to a maximum of one month.
Simplification and reduction of the tax burden on the mobile sector
On tariff, recall that the Association of Licensed Telecommunications Operators of Nigeria (ALTON) and the Association of Telecommunications Companies of Nigeria (ATCON) had urged the Nigerian Communications Commission (NCC) to consider reviewing tariffs upward to address rising operational costs.
Nodding in agreement, Bismarck Rewane, chief executive officer, Financial Derivatives, said the proposed tariff hike by telecommunications will help reduce inflation in the country.
He said it would help to reduce inflation because it increases productivity, stressing that the price of MTN shares went up by 10% to 220.
Rewane reiterated that investors had already factored that in, adding that they are expecting a lot of good goodies.
“But more important to think about is the fact that because of an increase in tariff and an increase in investment to make the industry sustainable, they’re going to see an increase in productivity, not directly but indirectly.
“Any increase in productivity and output is likely to allow inflation to moderate, which is the goal. So, we heard from the policymaker, Bosun Tijani, who was very clear that we want a sustainable sector. But we also heard from the regulator saying that we will hold these guys to quality of service.
“We also heard from the operators, MTN that they are all revving up. So in all, there are economic benefits because of increased output and productivity. Two, policymakers are aligned because they want this to lead to a moderation in inflation,” he added.
He further said that it was not a bad deal and re-echoed the minister’s comment that the tariff hike will not be 100 per cent.
“Will they get 100%? No, they will definitely not. We suspect that we are going to likely see something between 40 and 50% which is fair after so many years of static changes,” Rewane added.
- Telecom2 days ago
Suspected Lakurawa Terrorists Kill 3 Telcoms Workers in Kebbi
- General News2 days ago
Lagos State Sets Strict Deadline for 2024 Tax Returns Filing
- E-Financial2 days ago
BudgIT Queries Irregularities in FG’s Proposed 2025 Budget
- News2 days ago
SERAP Drags FG, Govs to ECOWAS Court over ‘Misuse of Cybercrimes Act’
- E-Financial2 days ago
NAICOM Seeks Police’s Support to Enforce Third-party Motor Insurance
- E-Business2 days ago
Lagos, NIPOST Partner to Transform e-Commerce Delivery
- E-Financial2 days ago
GAIM 6: Fidelity Bank Rewards 10 Customers with N10m
- News2 days ago
GOCOP Applauds Edo Gov for Appointing Edomaruse, SA, Int’l Development