Telecom
Sophos CryptoGuard Technology Reveals How Attackers Increased Their Use of Remote Ransomware by 62% Annually
Sophos, a global leader in innovating and delivering cybersecurity as a service, has released a report, titled “CryptoGuard: An Asymmetric Approach to the Ransomware Battle,” which found that some of the most prolific and active ransomware groups, including Akira, ALPHV/BlackCat, LockBit, Royal, Black Basta, are deliberately switching on remote encryption for their attacks.
In remote encryption attacks, also known as remote ransomware, adversaries leverage a compromised and often underprotected endpoint to encrypt data on other devices connected to the same network.
Sophos CryptoGuard is the anti-ransomware technology that Sophos acquired in 2015* and is included in all Sophos Endpoint licenses. CryptoGuard monitors the malicious encryption of files and provides immediate protection and rollback capabilities, including when the ransomware itself never appears on a protected host.
The unique anti-ransomware technology is a last line of defense in Sophos’ layered endpoint protection, only activating if an adversary triggers it later in the attack chain.
CryptoGuard detected a 62% year-over-year increase in intentional remote encryption attacks since 2022.
“Companies can have thousands of computers connected to their network, and with remote ransomware, all it takes is one underprotected device to compromise the entire network. Attackers know this, so they hunt for that one ‘weak spot’—and most companies have at least one. Remote encryption is going to stay a perennial problem for defenders, and based, on the alerts we’ve seen, the attack method is steadily increasing,” said Mark Loman, vice president, threat research at Sophos, and the co-creator of CryptoGuard.
Since this type of attack involves encrypting files remotely, traditional anti-ransomware protection methods deployed on remote devices don’t “see” the malicious files or their activity, failing to protect them from unauthorized encryption and potential data loss. Sophos CryptoGuard technology, however, takes an innovative approach to stopping remote ransomware, as explained in the Sophos X-Ops article: analyzing the contents of files to see if any data became encrypted to detect ransomware activity on any device in a network, even if there is no malware on the device.
In 2013, CryptoLocker was the first prolific ransomware to utilize remote encryption with asymmetric encryption, also known as public-key cryptography. Since then, adversaries have been able to escalate the use of ransomware, due to ubiquitous, ongoing security gaps at organizations worldwide and the advent of cryptocurrency.
“When we first noticed CryptoLocker taking advantage of remote encryption ten years ago, we foresaw that this tactic was going to become a challenge for defenders. Other solutions focus on detecting malicious binaries or execution. In the case of remote encryption, the malware and execution reside on a different computer (unprotected) than the one having the files encrypted. The only way to stop it is watching the files and protecting them. That’s why we innovated CryptoGuard,” said Loman.
“CryptoGuard does not hunt for ransomware; instead, it zeroes in on the primary targets—the files. It applies mathematical scrutiny to documents, detecting signs of manipulation and encryption. Notably, this autonomous strategy deliberately does not depend on indicators of breach, threat signatures, artificial intelligence, cloud lookups, or prior knowledge to be effective. By focusing on the files, we can change the power balance between the attackers and the defenders. We’re increasing the cost and complexity for the attackers to successfully encrypt data, so that they will abandon their objectives. This is a part of our asymmetric defense approach strategy.
“Remote ransomware is a prominent problem for organizations, and it is contributing to the longevity of ransomware in general. Given that reading data over a network connection is slower than from a local disk, we have seen attackers, like LockBit and Akira, strategically encrypt only a fraction of each file. This approach aims to maximize impact in minimal time, further reducing the window for defenders to notice the attack and respond. Sophos’ approach to anti-ransomware technology stops both remote attacks and those that encrypt just 3% of a file. We’re hoping to inform defenders about this persistent attack method, so they can properly protect devices.”
For more information, read “CryptoGuard: An Asymmetric Approach to the Ransomware Battle” on Sophos.com.
Nigerian Communications Commission (NCC) is in talks with the Central Bank of Nigeria (CBN) over the Unstructured Supplementary Service Data (USSD) debt totalling N250 billion between the telecom operators and the commercial banks in the country.
USSD, known as quick or feature codes, is a global system for mobile communications (GSM) protocol used to send text messages and initiate financial transactions such as cash transfers, balance inquiries, payments for services and others.
However, the USSD platform, which is widely relied upon by millions of Nigerians for quick and efficient mobile transactions, has become a point of disagreement between the banks and telecom operators.
The crisis dates back to 2019 when telcos proposed charging N4.50 per 20 seconds of USSD usage in order to cover operational costs after years of providing the service for free.
But the banks kicked against this, saying a 450% increase in transaction costs will significantly grow the debt and strain relations between the two vital industries.
However, Dr Ikechukwu Adinde, director of Consumer Affairs Bureau, NCC, who disclosed this move, said commission was hopeful the issue would soon be settled.
According to him, “The NCC remains committed to ensuring that the interests of all stakeholders—consumers, telcos, and banks—are protected.”
He insisted that a resolution is critical to maintaining the seamless operation of mobile financial services that millions of Nigerians depend on daily.
Adinde, who also said plans are on to introduce reforms at enhancing tariff transparency in the telecommunications industry, believed the new move between the NCC and the CBN would put the debt issue finally to rest.
On transparency and responsibility policy, Adinde said the changes, set to roll out in the coming months, will require telecom operators to provide consumers with clear, easily accessible tables outlining tariff plans, billing rates, and the terms and conditions associated with their services.
Indeed, Karl Toriola, chief executive officer (CEO) of MTN Nigeria, had said in October that banks might be disconnected from the USSD platform due to debt arising from the use of the quick codes by their customers.
Toriola had said mobile network operators (MNOs) might, subject to regulatory approval, suspend use of the service on the network for banking operations, as the debt had continued to pile up and was becoming unsustainable to the operators.
Also, Gbolahan Awonuga, executive secretary of the Association of Licensed Telecommunication Operators of Nigeria (ALTON), said in October that the debt between telecoms operators and commercial had hit N250billion.
Earlier, the telcos had lamented that they could no longer provide the services free, proposing a cut of N4.50k per 20 seconds from the charges paid by customers to the banks.
But the banks kicked against this, adding that it would raise costs by 450 percent.
Credit: Daily Post
Obafemi Banigbe, CEO of 9mobile, recently shared his expertise at the Alliance for Innovative Regulation (AIR) virtual conference, tackling the pressing issue of digital payment fraud in West Africa.
His insightful perspectives offered valuable insights into combating identity theft, a major threat to electronic money transfer security across the African continent.
Speaking as a panellist in a session moderated by Nick Cook, Chief Innovation Officer at AIR, Banigbe outlined how telcos play a pivotal role in protecting financial transactions.
“Fraud is fundamentally a human challenge, not just a technological one,” he remarked, emphasising that identity theft remains central to electronic money transfer fraud and requires a community-driven, human-centred approach.
He emphasized the critical role of telecommunications companies as guardians of security in the financial ecosystem. He outlined the proactive measures 9mobile and other telcos are taking to fortify financial systems, focusing on several key areas.
Banigbe highlighted the integration of Know Your Customer (KYC) systems, which leverage collaborations with national ID databases, banking records, and mobile number registries to enhance customer verification.
He also stressed the importance of robust security tools, including SIM registration, Biometric authentication (fingerprint and facial recognition) and One-Time Password (OTP)-based authentication. These measures he said collectively strengthen verification processes, ensuring a more secure financial ecosystem.
Banigbe reiterated the importance of partnerships between financial institutions and payment platforms. These collaborations enable the secure sharing of intelligence, ensuring compliance with data protection laws.
This, in turn, facilitates the detection of suspicious activities while maintaining privacy. He also highlighted the need to address delays in fraud tracking. To achieve this, he advocated for the deployment of real-time blacklisting mechanisms. This would enable swift action on reported incidents, preventing fraudsters from exploiting time gaps.
While highlighting the need for industry-wide collaboration, Banigbe pointed to the cost-effectiveness of shared investments in advanced security architecture. “No single organisation can tackle this alone. A united effort among telcos, financial institutions, and regulators is key to safeguarding our financial systems,” he asserted.
The panel discussion, which featured other notable speakers, including Ikenna Ndugbu (Moniepoint), Sheila Senfuma (Consumers International), and Modupe Ladipo (Prosperar Consulting), explored diverse aspects of combating digital payment fraud.
They discussed the role of robust compliance frameworks and transaction monitoring tools; addressed accessibility challenges for vulnerable populations, including people with disabilities like visual impairment that disallows them from baseline financial literacy; highlighted the specific vulnerabilities faced by women in informal financial systems and advocated for culturally sensitive financial inclusion strategies.
Banigbe further remarked on the need for proper access control within organisations to combat possible internal staff collusion with external fraudsters to make security systems more vulnerable.
“Regulating access will help prevent fraudulent activities within organisations,” he said, pointing to the need for stronger internal controls to safeguard sensitive processes.
He spotlighted the crucial role of telcos in creating a secure and inclusive digital financial ecosystem. Collaboration, Banigbe stressed, is essential to achieving lasting results in the fight against fraud.
“It is an ecosystem, and there should be a joint effort to enlighten the public on digital payment fraud and advocate for victims of fraud,” he concluded, calling for unified action among telcos, financial institutions, and regulators.
With over 100 participants attending the conference, the collective commitment to combat digital payment fraud is evident. Discussions continue to focus on leveraging technology, driving public awareness, and strengthening collaborative frameworks to address the pervasive threat of identity theft.
Professor Adewale Obadare, a renowned cybersecurity expert and the first Professor of Practice in Cybersecurity in Nigeria, shared his valuable insights on how to break into the cybersecurity industry. With over 58 professional certifications and numerous awards, including the Outstanding Digital Trust Leader Award, Obadare’s expertise is unparalleled.
Dr. Obadare Peter Adewale
Speaking at FirstBank’s Cybersecurity Career Webinar that was held over the weekend, Prof. Obadare emphasized that cybersecurity is a field with numerous opportunities, including job security, competitive salaries, and global recognition.
However, he noted that many individuals struggle to break into the industry due to a lack of understanding of their strengths and weaknesses.
To succeed in cybersecurity, Obadare advised individuals to identify their cognitive strengths and choose a career path that aligns with their skills.
He emphasized that there are two primary paths in cybersecurity: technical and governance, risk, and compliance (GRC).
Obadare debunked the myth that certifications are unnecessary, stating that they provide a structured way of learning and are essential for building cognitive competence.
He defined cognitive competence as the acquisition of knowledge and theoretical understanding, which is synonymous with knowledge and mastery of concepts and theoretical knowledge.
Obadare shared a personal anecdote to illustrate the importance of cognitive competence. He recalled a situation where a colleague, who was practically skilled but lacked cognitive competence, deleted a critical system file (NTLDR) while backing up a critical system.
Obadare, who had acquired cognitive competence through certification, knew that deleting the file would prevent the system from booting up. He intervened, recovered the file, and restored the system.
He further emphasized that cognitive competence is essential for making informed decisions and taking effective actions in cybersecurity.
He encouraged individuals to acquire certifications, such as CompTIA Security+, to build their cognitive competence and provide a structured way of learning.
In addition to cognitive competence, Obadare highlighted the importance of functional competence, which is the ability to translate theoretical knowledge into practical skills.
He emphasized that individuals need to strike a balance between cognitive and functional competence to succeed in cybersecurity.
While advising prospective Nigerians seeking to take up career in cybersecurity, Obadare advised them to be humble, open-minded, and willing to learn from others.
According to him, “My advice to individuals seeking to break into cybersecurity is to acquire certifications to build cognitive competence. Cultivate behavioral competence by being humble, open-minded, and willing to learn from others. Continuously learn and self-improve, as cybersecurity education and career is a journey, not a destination”.
In conclusion, Obadare’s insights provided a valuable roadmap for individuals seeking to break into the cybersecurity industry. By acquiring certifications, developing practical skills, and cultivating a positive attitude, individuals can set themselves up for success in this rapidly evolving field.
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
First Women Radio Virtual Assistant Makes a Debut in Nigeria
9mobile CEO Highlights Key Solutions for Securing Electronic Money Transfers in Africa
NITDA DG Harps on the Role of Innovation in Nigeria’s Sustainable Development
PalmPay Reaffirms Commitment to Ensuring a Safe Financial Ecosystem @ Anti-Fraud Walk
First Bank Proposes New Name after Upgrading Banking Platforms
Edo State Launches Data Centre in Benin
Echefu Launches LUFT TV, another Pay TV after Failed TSTV Project
Nigeria Makes List of Top 10 Countries with Highest Cases of Internet Scams
UBA, Mastercard Launch Special Debit Card for 75th Anniversary
E-Financial2 days agoEFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
Telecom2 days agoNASENI Retreat Focuses on Aligning Development Institutes’ Goals
News2 days agoHead of Civil Service Celebrates 100 Days in Office with the Launch of Galaxy Backbone’s “Govmail”
News2 days agoTEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
Uncategorized2 days agoNIMC Introduces Paid National ID Card Amid Low Revenue
E-Business2 days agoData Commission, NAICOM Partner to Safeguard Data in Insurance Industry
E-Financial2 days agoN159m Up for Grabs in Fidelity Bank’s GAIM 6 Promo
Telecom2 hours agoProf. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity