Telecom
Sophos’ Incident Response Report Shows How Cybercriminals Abuse Remote Desktop Protocol in 90% of Attacks
Sophos, a global leader of innovative security solutions that defeat cyberattacks, today released the Active Adversary analysis, “It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024.”
John Shier, senior security advisor at Sophos
The report, which analyzes more than 150 incident response (IR) cases handled by the Sophos X-Ops IR team in 2023, found that cybercriminals abused remote desktop protocol (RDP)—a common method for establishing remote access on Windows systems—in 90% of attacks.
This was the highest incidence of RDP abuse since Sophos began releasing its Active Adversary reports in 2021, covering data from 2020.
In addition, external remote services such as RDP were the most common vector by which attackers initially breached networks; they were the method of initial access in 65% of IR cases in 2023.
External remote services have consistently been the most frequent source of initial access for cybercriminals since the Active Adversary reports were launched in 2020, and defenders should consider this a clear sign to prioritize the management of these services when assessing risk to the enterprise.
“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond. Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise. It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side,” said John Shier, field CTO, Sophos.
In one Sophos X-Ops customer case, attackers successfully compromised the victim four times within six months, each time gaining initial access through the customer’s exposed RDP ports.
Once inside, the attackers continued to move laterally throughout the customer’s networks, downloading malicious binaries, disabling endpoint protection, and establishing remote access.
Compromised credentials and exploiting vulnerabilities are still the two most common root causes of attacks. However, the 2023 Active Adversary Report for Tech Leaders, released last August, found that in the first half of that year, for the first time, compromised credentials surpassed vulnerabilities as the most frequent root cause of attacks. This trend continued through the rest of 2023, with compromised credentials representing the root cause of over 50% of IR cases for the entire year. When looking at Active Adversary data cumulatively over the years from 2020 through 2023, compromised credentials were also the number one “all-time” root cause of attacks, involved in nearly a third of all IR cases. Yet despite the historical prevalence of compromised credentials in cyberattacks, in 43% of IR cases in 2023, organizations did not have multi-factor-authentication configured.
Exploiting vulnerabilities was the second most common root cause of attacks, both in 2023 and when analyzing data cumulatively from 2020 through 2023, accounting for the root cause in 16% and 30% of IR cases, respectively.
“Managing risk is an active process. Organizations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers. An important aspect of managing security risks, beyond identifying and prioritizing them, is acting on the information. Yet, for far too long, certain risks such as open RDP continue to plague organizations, to the delight of attackers who can walk right through the front door of an organization. Securing the network by reducing exposed and vulnerable services and hardening authentication will make organizations more secure overall and better able to defeat cyberattacks,” said Shier.
The Sophos Active Adversary Report for 1H 2024 is based on more than 150 incident response (IR) investigations spanning the globe across 26 sectors.
Targeted organizations are located in 23 different countries, including the United States, Canada, Mexico, Colombia, the United Kingdom, Sweden, Switzerland, Spain, Germany, Poland, Italy, Austria, Belgium, the Philippines, Singapore, Malaysia, India, Australia, Kuwait, the United Arab Emirates, Saudi Arabia, South Africa, and Botswana.
To learn more about the current adversary landscape, read It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024 on Sophos.com.
Telecommunications operators in Nigeria are considering shifting from the current national tariff structure to a regional tariff regime that accounts for state-specific operational challenges.
They say this is because the challenges and costs of running their businesses vary significantly from state to state.
Currently, phone companies in Nigeria have a single national tariff for their services, meaning everyone pays the same amount no matter where they live.
However, the telcos argue that this system doesn’t account for the fact that some states have higher operating costs due to issues like attacks on their equipment and multiple taxes.
This proposal was discussed at the 7th edition of the Policy Implementation Assisted Forum (PIAFo) in Lagos, where industry leaders highlighted the need for a pricing model that reflects the ease—or difficulty—of doing business in each state.
Gbenga Adebayo, chairman, Association of Licensed Telecommunications Operators of Nigeria (ALTON), specifically pointed out that the high cost of doing business in some states is a major concern and increases their expenses. He suggested that if negotiating with certain states to reduce these costs is impossible, then the added expense of operating there should be reflected in the service prices in those areas.
“We may have to reconsider the issue of our national tariffs and look at regional tariffs. If you are aware that the cost of doing business is high in a particular state and it’s impossible to negotiate with them, factor the cost of deployment in those areas into the cost of providing services,” he said.
Tony Emoekpere, president, Association of Telecommunications Companies of Nigeria (ATCON), agreed that the current national tariff is unfair because operational costs are not the same across the country.
He believes that states that make it easier for telecom companies to operate should be rewarded, while those that create difficulties should see higher service costs.
9mobile, telecommunications operator, has described as untrue the rumors suggesting that it has shut down its operations.
according to the telcos, these claims are entirely baseless and aimed at causing unnecessary panic among our valued subscribers, the mobile operator said in a statement.
“We understand that some customers have recently faced challenges, particularly with Mobile Number Portability (MNP), a service that enables seamless network switching.
“We want to clarify that 9mobile has never restricted customers from porting to other networks. We remain fully compliant with industry regulations and committed to delivering fair, transparent, and customer-focused services.
“While there have been temporary technical challenges affecting MNP, these issues have now been largely resolved. Some minor delays may still occur due to ongoing system optimizations, but we are actively working to ensure a smoother experience for all users.
“As a proudly Nigerian brand, we embody the resilient spirit of our people and remain steadfast in our commitment to overcoming challenges. We acknowledge the temporary service disruptions some customers may have experienced in different locations.
“However, we assure you that these disruptions are part of a broader transformation effort aimed at modernizing our infrastructure and improving overall service quality.
“Our ongoing investments in network upgrades and service expansion will soon yield significant improvements, ensuring reliable connectivity for individuals, businesses, and communities.
“We sincerely appreciate the patience and loyalty of our subscribers during this transition. While challenges exist, we are making significant progress and are confident that brighter days are ahead. We remain dedicated to providing exceptional service and keeping you connected to limitless opportunities”.
Nigeria Data Protection Commission (NDPC) has initiated an investigation into the data processing practices of Tiktok and Truecaller, following growing concerns about potential privacy violations.
Dr. Vincent Olatunji, the Chief Executive Officer of the NDPC, made the announcement today during a press conference in Abuja, where he also revealed the issuance of the Nigeria Data Protection Act – General Application and implementation directive (NDPC Act – GAID), 2025.
Dr Olatunji stated that the commission’s primary concern is how these platforms manage Nigerian users’ personal data, including potential breaches of consent, data sharing with third parties, and overall compliance with the Nigeria Data Protection Act (NDPA), 2023. He confirmed that the NDPC is actively investigating Tiktok and Truecaller’s data processing activities to ensure they comply with Nigeria’s data protection laws.
“The goal is to safeguard the privacy rights of Nigerians and hold organizations accountable for how they collect, store, and use personal data,” he added.
This investigation comes amid increasing scrutiny of global tech companies regarding data privacy, especially concerning how personal information is processed, stored, and transmitted beyond national borders.
The NDPC act – GAID, 2025, issued today, provides a detailed framework for implementing Nigeria’s data protection law, outlining compliance guidelines, enforcement mechanisms, and obligations for both public and private organizations.
Dr Olatunji emphasized that the directive aims to strengthen Nigeria’s digital economy by fostering trust in data governance while ensuring individuals’ rights to privacy are respected in accordance with international best practices.
He reiterated that companies operating in Nigeria must comply with the country’s data protection regulations or face regulatory actions, including fines and potential restrictions.
The NDPC has urged the public to report any data privacy violations and reaffirmed its commitment to transparency and due process in its investigations.
The commission noted that reporting data breaches has become more accessible through dedicated channels on its official website.
NGO Blasts MultiChoice for Tariff Hike in Nigeria, Slash in South Africa
Tony Elumelu Foundation Grants $15m to 3,000 African Entrepreneurs
SEC Declares War on Capital Market Fraudsters
Telcos Mull Introduction of Different Tariff Plans for Different States
NESREA Urges Nigerians to Dispose Batteries Properly to Avoid Hazards
General News2 days agoNigeria, Kenya among Nations Running out of HIV Drugs – WHO
News2 days agoNAFDAC Destroys over N1 Trillion Fake Drugs in Anambra
Telecom2 days ago9mobile Denies Shutdown Rumours, Promises Improved Services
Telecom2 days agoTikTok and Truecaller Face NDPC Investigation Amid Data Protection Concerns
E-Business2 days agoVisa to Establish Data Centre in Nigeria to ‘Boost Digital Economy’
E-Financial2 days agoNigeria Still Open Crypto Business despite $80Bn Lawsuit against Binance – FG
News2 days agoBolt Shares the Spirit of Ramadan with Kano Drivers-Partners
General News2 days agoNigeria to Launch $40 Million Fund for Tech Startups