Telecom
Sophos Research Reveals that Attackers Are Using Log4Shell Vulnerability to Deliver Backdoors to Virtual Servers

Sophos, a global leader in next-generation cybersecurity, has released findings on how attackers are using the Log4Shell vulnerability to deliver backdoors and profiling scripts to unpatched VMware Horizon servers, paving the way for persistent access and future ransomware attacks. A new technical paper, “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers,” details the tools and techniques used to compromise the servers and deliver three different backdoors and four cryptominers. The backdoors are possibly delivered by Initial Access Brokers.

Log4Shell is a remote code execution vulnerability in the Java logging component, Apache Log4J, which is embedded in hundreds of software products. It was reported and patched in December 2021.
“Widely used applications such as VMware Horizon that are exposed to the internet and need to be manually updated, are particularly vulnerable to exploitation at scale,” said Sean Gallagher, senior security researcher at Sophos. “Sophos detections reveal waves of attacks targeting Horizon servers, starting in January, and delivering a range of backdoors and cryptominers to unpatched servers, as well as scripts to collect some device information. Sophos believes that some of the backdoors may be delivered by Initial Access Brokers looking to secure persistent remote access to a high value target that they can sell on to other attackers, such as ransomware operators.”
The multiple attack payloads Sophos detected using Log4Shell to target vulnerable Horizon servers include:
· Two legitimate remote monitoring and management tools, Atera agent and Splashtop Streamer, likely intended for malicious use as backdoors
· The malicious Sliver backdoor
· The cryptominers z0Miner, JavaX miner, Jin and Mimu
· Several PowerShell-based reverse shells that collect device and backup information
Sophos’ analysis revealed that Sliver is sometimes delivered together with Atera and PowerShell profiling scripts and is used to deliver the Jin and Mimu variants of the XMrig Monero miner botnet.
According to Sophos, the attackers are using several different approaches to infect targets. While some of the earlier attacks used Cobalt Strike to stage and execute the cryptominer payloads, the largest wave of attacks that began in mid-January 2022, executed the cryptominer installer script directly from the Apache Tomcat component of the VMware Horizon server. This wave of attacks is ongoing.
“Sophos’ findings suggest that multiple adversaries are implementing these attacks, so the most important protective step is to upgrade all devices and applications that include Log4J with the patched version of the software. This includes patched versions of VMware Horizon if organizations use the application in their network,” said Gallagher.
“Log4J is installed in hundreds of software products and many organizations may be unaware of the vulnerability lurking in within their infrastructure, particularly in commercial, open-source or custom software that doesn’t have regular security support. And while patching is vital, it won’t be enough if attackers have already been able to install a web shell or backdoor in the network. Defense in depth and acting upon any detection of miners and other anomalous activity is critical to avoid falling victim to such attacks.”

For further information read the article “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers” on Sophos News.
Sophos has closely monitored attack activity related to the Log4Shell vulnerability and has published a number of in depth technical and advisory reports, including Log4Shell Hell – Anatomy of an Exploit Outbreak, Log4Shell Response and Mitigation Recommendations, Inside the Code: How the Log4Shell Exploit Works, and Log4Shell: No Mass Abuse, But No Respite, What Happened?
Additional Resources
· Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of attackers
. Further details on the evolving cyberthreat landscape can be found in the Sophos 2022 Threat Report
. Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLabs Uncut, which provides Sophos’ latest threat intelligence
. Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps
. Learn more about Sophos’ Rapid Response Service that contains, neutralizes and investigates attacks 24/7
The four top tips for responding to a security incident from Sophos Rapid Response and the Managed Threat Response Team
Telecom
FG Taps Quest Merchant Bank for Advisory on 90,000km Fibre Project

Quest Merchant Bank has been appointed as Transaction Advisor for Project BRIDGE, a broadband infrastructure initiative of the Federal Ministry of Communications, Innovation and Digital Economy (FMCIDE), led by Bosun Tijani, the minister.

Project BRIDGE, short for Broadband Infrastructure Development for Digital Economy, is designed to deepen Nigeria’s digital backbone through the deployment of about 90,000 kilometres of open-access fibre-optic cables nationwide.
The initiative is expected to boost broadband penetration, strengthen connectivity and drive inclusive economic growth.
Under the mandate, Quest Merchant Bank will work with the ministry and the Project Implementation Unit to structure the project’s financial and commercial framework.
This includes developing bankable investment models, engaging investors and designing a public-private partnership structure to ensure efficient execution and sustainability.
Afolabi Olorode, acting managing director, described the project as a critical intervention for Nigeria’s digital economy.
“Project BRIDGE represents a critical step in strengthening Nigeria’s digital backbone and unlocking the immense opportunities within the country’s digital economy. We are honoured to partner with the FMCIDE under the leadership of Honourable Minister, Dr Bosun Tijani on this important initiative,” he said.
He added that the bank would leverage its expertise in infrastructure finance to develop “a robust and investable framework that will attract private capital and support long-term national development.”
Also speaking, Yetunde Falore, head of Investment Banking at Quest Merchant Bank, said the project comes at a defining moment for Nigeria’s digital economy.
“Nigeria’s digital economy is entering a defining phase, and infrastructure initiatives such as Project BRIDGE will play a central role in expanding connectivity, deepening digital inclusion, and supporting sustainable economic growth,” she stated.
Falore noted that the bank would focus on ensuring the timely and efficient delivery of the project in its advisory role.
The initiative aligns with the Renewed Hope agenda of President Bola Ahmed Tinubu, which prioritises digital infrastructure expansion and private sector participation in critical national assets.
Telecom
Court Bans Kenyan Telcos from Recycling SIM Cards

Kenya’s High Court has ruled that mobile phone numbers are not disposable assets, but constitutionally protected digital identifiers, striking at the core of a long-standing industry practice of arbitrarily reassigning inactive SIM cards without the owners’ consent.

In a landmark decision that could reshape telecom regulation and digital identity frameworks across Africa, sitting at Milimani Law Courts in Nairobi, Justice Lawrence Mugambi declared that reassigning a phone number without the original owner’s consent violates the right to privacy.
The ruling effectively elevates a SIM card into the same legal category as personal data tied to an individual’s private life.
At the heart of the ruling is Article 31 of the Constitution, which safeguards citizens from unnecessary disclosure of private information and interference with communications.
The court found that in today’s digital economy, a registered mobile number functions as a critical gateway to sensitive personal data, linking users to mobile money platforms like M-PESA, banking systems, email accounts, and social media profiles.
“When mobile digital identity is lost through reallocation or recycling without interrogating the reasons behind inactivity, it creates an avenue for unauthorised disclosure of delicate information,” the judgment stated.
The case, brought by Erastus Ngura Odhiambo, petitioner and former prisoner, challenged the routine telecoms practice of deactivating SIM cards after prolonged inactivity and reassigning them to new users.
Odhiambo lost access to his mobile phone number due to inactivity while serving his lengthy sentence.
He argued that the practice exposes individuals to serious risks, including misdirected financial transactions, intercepted one-time passwords, and unintended access to private communications.
The court agreed, highlighting how recycled numbers can result in strangers receiving confidential messages, authentication codes, and even being added to private messaging groups, effectively inheriting fragments of another person’s digital life.
Justice Mugambi also criticised the rigidity of SIM deactivation policies, calling them “arbitrary” for failing to consider legitimate reasons for inactivity such as incarceration, studying in restricted environments, or living abroad.
“Incarceration does not strip an individual of their constitutional rights to privacy and identity,” he noted.
For telecom operators, including Safaricom, the ruling introduces a significant compliance burden. The court outlined three strict conditions before any number can be reassigned.
Telcos must obtain informed and verifiable consent from the original owner, issue a public notice and conduct traceability efforts over a reasonable period.
More importantly, the court further directed that telecoms firms must implement technical safeguards to prevent data exposure to the new user.
The Office of the Attorney General has been given six months to translate these directives into enforceable regulations.
Telecom
Binance Earn: Simple Way to Earn Rewards on Idle Crypto Holdings

Binance Earn offers cryptocurrency users an accessible way to generate rewards on idle digital assets without active trading or constant market monitoring.

Binance Earn
As the crypto market matures, more holders seek productive uses for their assets rather than leaving them dormant in wallets. Binance addresses this through Binance Earn, where users allocate supported cryptocurrencies to various reward products for automatic yield generation.
The platform emphasises simplicity with a “set-and-forget” model: users select assets, pick a product, and rewards accrue passively in the background. This appeals especially to long-term holders aiming to enhance portfolio value over time without day-to-day involvement.
Binance Earn provides flexible options for instant liquidity access alongside fixed-term products for defined commitments, catering to diverse strategies and risk appetites.
“We’re seeing growing interest across Africa in ways to make crypto holdings more productive without active trading,” said Larry Cooke, Africa Head of Legal at Binance. “Simple, ‘set-and-forget’ solutions are becoming increasingly relevant as more users take a longer-term approach to digital assets.”
The feature reflects shifting user behaviour towards holding and gradual growth amid volatile markets, where reward rates fluctuate based on conditions, liquidity, and structures.
Users must assess risks and alignment with personal goals, as crypto remains volatile. Binance Earn positions itself as a key tool in Africa’s rising digital asset adoption, enabling hands-off participation in the ecosystem.
News3 days agoAfrican Tech Start-ups to Receive $46m of Speedinvest Africa Fund
Telecom3 days agoCourt Bans Kenyan Telcos from Recycling SIM Cards
E-Financial3 days agoProvidus Bank Fully Meets CBN Capital Requirement, Sets Record Straight
E-Financial3 days agoUBA UK, BII Sign Letter of Intent to Slash Africa’s $80Bn Trade Finance Gap
Telecom3 days agoBinance Earn: Simple Way to Earn Rewards on Idle Crypto Holdings
News3 days agoUK, Nigeria Unveil Three-Year Plan to Combat Immigration Crime
News3 days agoU.S. Charges Three in $2.5 Billion Plot to Smuggle Nvidia AI Chips to China
General News3 days agoCourt Jails ‘Colonel’, ‘Major’ of Global Money-Laundering Ring



















