Telecom
Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.
The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.
The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.
Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.
Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.
“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.
“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.
“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.
“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.
“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”
Highlights of the Report
● On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”
● In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.
● After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.
● Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.
● A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.
● In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.
“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.
“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.
“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.
“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.
“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”
Industry Quotes About Sophos’ Pacific Rim Report
“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.
“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.
“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.
“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”
“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.
“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”
“At NCSC-NL, one of our tasks is to share information and connect organisations.
“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.
“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.
Advice for Defenders
Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.
● Minimize internet-facing services and devices when possible
● Prioritize patching with urgency for internet-facing devices and monitor these devices
● Enable hotfixes for edge devices to be allowed and applied automatically
● Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs
● Create a plan for how your organization deals with EOL devices
“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.
In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.
Nigeria may bring back a 5per cent excise tax on telecom services, according to the 2024 Finance Bill passed by the Senate last week.
Gbenga Adebayo, chairman, ALTON
The tax would apply to data transmission and voice calls.
First introduced in 2020 under the Mohammadu Buhari administration to widen the tax base, the measure was suspended in 2023 by President Bola Tinubu due to rising inflation.
With the budget under pressure, the government is now considering reinstating it.
Telecom operators warn that the tax would raise service costs and make it harder to close Nigeria’s digital divide, which still leaves more than 40% of the population without internet access.
Gbenga Adebayo, chairman, Association of Licensed Telecoms Operators of Nigeria (ALTON), said the proposal lacks detail and would increase the financial burden on users.
“We’ve had no clarity on how the 5% tax would be implemented, but the burden will fall on the consumer. Telecoms should be treated as a social good, not taxed like luxury items. No one taxes telecoms like this in countries where infrastructure is taken seriously,” he said.
ALTON also noted that operators are already subject to 54 different taxes nationwide.
The Nigerian Communications Commission (NCC) has not yet received the official version of the bill for review.
Telecom
GSMA Urges Governments to Prioritise Affordable Spectrum Costs to Support Global Digital Growth
The GSMA released its latest ‘Global Spectrum Pricing Report’, highlighting that average spectrum prices have not reduced in line with operator revenues over the last decade — putting significant pressure on their ability to invest in essential network infrastructure.
The report shows that, whilst both consumer prices for mobile services and the average cost of spectrum have fallen, the overall cost burden on mobile network operators (MNOs) has actually risen sharply. Global cumulative spectrum costs now account for 7% of operator revenues, a 63% increase over the past ten years.
Meanwhile, the average revenue generated per megahertz (MHz) of spectrum has declined by 60% over the same period. Although costs per MHz have fallen by up to 75% in some bands since 2014, operators have increased spectrum holdings by 80% over the same period to cope with bandwidth demand, driving up the overall cost.
A gigabyte of data is far more affordable today than ten years ago, with operators experiencing a staggering 96% fall in revenue per GB between 2014 and 2024. However, these falling revenues, when combined with the proportionately high cost of acquiring spectrum, restrict operators’ ability to invest in expanding and improving mobile networks, particularly 4G and 5G. The report shows that higher spectrum costs correlate directly with lower network coverage and reduced mobile speeds, impacting consumers and slowing the development of digital economies worldwide.
Vivek Badrinath, Director General of the GSMA, said: “The mobile industry sits at the heart of the digital economy, enabling services and opportunities that transform lives. But a dollar can only be spent once, and high spectrum costs can choke investment at a time when the need for affordable, reliable connectivity has never been greater. Governments and regulators must prioritise spectrum pricing that reflects market realities and fosters long-term digital growth. By ensuring spectrum is affordable, they can unlock faster network expansion, better service quality, and greater digital inclusion for all of their citizens.”
The Global Spectrum Pricing Report also highlights that public policy choices — such as setting artificially high reserve prices, creating artificial scarcity, and attaching onerous licence obligations — have often contributed to inflated spectrum costs. In some countries, spectrum costs can reach as high as 25% of operator revenues.
The GSMA urges policymakers to adjust spectrum prices in line with current market conditions and the economic realities faced by operators. With nearly 1,000 spectrum licences set to expire worldwide by 2030, upcoming renewals present a critical opportunity to reset pricing policies to drive investment in the next generation of mobile networks.
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today launched MSP Elevate, a new business-accelerating program for managed service providers (MSPs). With the new program, Sophos enables MSPs to expand their business with high-value, differentiated cybersecurity offerings that elevate their customers’ cyber defenses and rewards growth with additional investment to fuel further success.
With the increasing complexity and sophistication of today’s cyberattacks, organizations are increasingly turning to MSPs for 24/7, human-led monitoring and management of their cybersecurity environments. This has made Managed Detection and Response (MDR) a major focus for MSPs with 81% currently offering a MDR service, according to the Sophos MSP Perspectives 2024 report.
MSP Elevate helps MSPs to differentiate themselves as a high-value provider to customers by delivering unique business-enhancing benefits, including an exclusive high-value Sophos MDR service offering.
Managing multiple cybersecurity platforms is a major overhead for MSPs and consumes valuable billable hours. MSPs estimate that consolidating on a single platform would slash their day-to-day management time by 48%.
MSP Elevate includes Network-in-a-Box bundles that enable MSPs to manage the full network stack through the unified Sophos Central platform, freeing-up staff for business generation activities.
Furthermore, the single biggest perceived risk to MSP’s businesses is the shortage of in-house cybersecurity expertise.
Sophos’ network solutions respond automatically to threats across the customer environment, enabling MSPs to elevate their customers’ defenses without adding workload.
“MSP Elevate is the first of many business-driving MSP programs following the powerhouse union of Sophos and Secureworks,” said Chris Bell, senior vice president of global channel, alliances and corporate development.
“As a channel-first organization that defends more than 250,000 customers of MSPs, we are constantly looking for opportunities to reward our partners and invest in their success when they grow their business with us.
“MSP Elevate fuels long-term growth for our partners by providing MSPs with exclusive solution access, discounts, rebates and training to deliver the best possible value to customers.”
Sophos MSP Elevate program benefits include:
· Exclusive Access to the Sophos MDR Bundle for MSP: Includes access to Sophos MDR Complete premium service tier with 24/7 incident response, 1 year data retention, Sophos Network Detection and Response (NDR), and all Sophos integration packs, enabling defenders to leverage all available telemetry from across the customer environment to accelerate threat detection and response.
· Simplified Sales Process: Speeds up time to deployment and reduces MSP overhead. With the new MDR Bundle for MSP, partners can quickly and easily allocate a single SKU to the customer for all their current and future MDR needs.
· Discounted Network-in-a-Box Hardware Bundle: Access to Sophos’ advanced network security solutions, including Sophos Firewall, Sophos Switch and Sophos Wireless Access Points at a significant discount. These products work together to automate threat response and are managed through Sophos Central.
· Growth-Based Rebates: As part of our commitment to grow with and invest in our partners, the program will recognize and reward MSPs that increase their Sophos MSP monthly billings.
· Architect-Level Training Courses: Equip MSPs to increase their in-house services delivery capabilities with trainings on Sophos Endpoint and Sophos Firewall.
· Invite-Only Access to Sophos Summits: Gain exclusive access to hands-on training and enablement, Ask the Experts sessions, attend exclusive Sophos events and meet with Sophos executive leadership to influence the Sophos roadmap and MSP strategy.
· Future benefits: Introduction of new program benefits to increase MSP’s profitability, customer defenses and overall value as a service provider.
“MSP Elevate enables MSPs to quickly deploy a comprehensive MDR service that eliminates blind spots by leveraging all available telemetry from across the customers’ environment,” said Raja Patel, chief product officer, Sophos. “This enhanced visibility accelerates threat detection and response while delivering improved return for customers on their existing technology investments. Furthermore, the service adapts seamlessly as the technology environment evolves over time, future-proofing customers’ defenses and providing both commercial and cybersecurity peace of mind.”
MSP Elevate is a non-exclusive commitment to sell Sophos’ best-in-class cybersecurity solutions available on the Sophos Central platform, including Sophos MDR, Sophos Endpoint powered by Intercept X, and Sophos Firewall. To access the program benefits, MSPs need to commit to a minimum monthly spend for a 12-month period. As a pre-requisite to joining MSP Elevate, partners need to be part of the MSP Flex program, which enables MSPs to offer Sophos solutions on a monthly billing basis.
“Joining MSP Elevate is a no-brainer. This new program adds further rocket fuel to the MSP growth trajectory we’ve enjoyed with Sophos over the last 17 years. Not all MDR offerings are the same, and I’m excited to be able to offer a superior service based around value and quality of outcomes that will elevate my customers’ defenses and differentiate my business in this increasingly crowded market,” said Craig Faiers, sales director, Arc.
With 80% of MSPs offering MDR through a specialist vendor for delivery*, partners can choose to have Sophos fully deliver the MDR service or to use Sophos to augment in-house teams, including for the provision of out-of-hours coverage. This is particularly important considering 88% of ransomware attacks start outside of standard business hours, according to Sophos’ Active Adversary report.
Sophos MDR is the service most trusted by MSPs to secure their clients and currently defends more than 18,000 MSP-managed customer environments against advanced threats, including ransomware. This unmatched breadth of customer coverage delivers unparalleled insights into attacks on MSP-managed environments that are continually leveraged to update customers’ defenses in real-time, optimizing their protection from ever-evolving attacks.
To learn more about MSP Elevate, visit www.sophos.com/elevate. Sophos partners can sign up for the MSP Elevate Program on the Sophos Partner Portal at https://www.sophos.com/en-us/partners/partner-portal.
Telcos Worry over Possible 5 Percent Tax Return
FirstBank Hikes SMS Alert Fee from N4 to N6
IFC Invests $5m in Husk Nigeria to Build 108 Solar Mini Grids
Why and How Banks Fail in Nigeria by CIoD Chair
NFIU Warns Against Use of BNBEX over False Claims
Broadcasting2 days ago5 Things You Absolutely Need to Know About BBNaija Season 10
Telecom2 days agoNigerians May Pay More for Calls, Data as Senate Okays 5 Percent Excise Duty
E-Financial2 days agoW’Bank Says Cash Transfer Missed Millions of Needy Nigerians
E-Business2 days agoNCC to Checkmate $3Bn Digital Piracy Market
E-Business2 days agoNIMC Launches NINAuth Digital Identity Verification App for Govt Services
General News2 days agoEFCC Tells Nigerians to Shun Ponzi Schemes Like CBEX, Others
Telecom2 days agoMastercard Report Reveals Top Travel Trends Shaping Africa in 2025
E-Financial2 days agoCBN, NIBSS Unveil BVN Platform for Diaspora Nigerians