Telecom
Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers
Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.
John Shier, senior security advisor at Sophos
The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.
The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.
“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”
Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.
“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”
Additional key findings in the playbook include:
- The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
- Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
- Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
- Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
- Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
- Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021
“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”
The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).
The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.
The need for Nigeria to think outside the box in its need to drive towards global relevance with innovations and scientific developments will be on the front burner at the NITRA Innovative & Scientific Conference scheduled to hold on Thursday July 23, 2026 in Ikeja, Lagos.
NITRA
The Nigerian Communications Commission (NCC) will lead other delegates to discuss and take far-reaching decisions at the event, which has its theme as “Bridging Nigeria’s Digital Divide With Scientific Innovation”.
Other companies that have indicated interest in partnering with NITRA include mobile communications company, Tecno; Africa’s premier end-to-end AI solutions company, Hyperspace; and telecommunications data infrastructure company, Digital Realty.
Speaking on the proposed event, the Chairman, Nigeria Information Technology Reporters Association (NITRA), Chike Onwuegbuchi noted that the event will seek to create a platform for government and private organisations to deliberate on policies around scientific innovations in Nigeria, challenges, place of indigenous and foreign collaboration, roles of each stakeholder, and grassroots development in that regard, among others.
According to him: “The Federal government, with series of programmes and partnerships, has established the urgent need to create an ecosystem that thrives on scientific innovation, breeding institutions and individuals with a target of placing the country at the fore-front of Next-Gen development.
It is a known fact that digital and scientific innovations are crucial, not only to the survivability of a nation, but also to the sustainability of its growth and development, with significant effect on economic strength, global image, defense and security, government capabilities to function, and public health and safety, communication and digital footprint, among others.
The federal government is actively driving scientific innovation to foster economic diversification and build a $1 trillion economy by 2030. Efforts are heavily focused on commercializing research, establishing massive research funds, and funding strategic infrastructure, particularly in technology, biotechnology, and healthcare. Core government initiatives and policies include the newly instituted National Research and Innovation Development Fund (NRIDF), which aims to mobilize about $500 million annually to support research and the commercialization of scientific outputs; and the Nigeria Genomic City, a multi-ministerial initiative aimed at transforming Nigeria into a leading hub for genomics, precision medicine, and biotechnology. It is designed to protect indigenous data, stimulate artificial intelligence in health, and develop a highly skilled scientific workforce.
According to the General Secretary of NITRA, Mr. Chidiebere Nwankwo, the forum will also be a vehicle to propagating the views of decision makers to the public, thereby furthering the cause of public awareness and information dissemination on the topic.
The focus, he said will be on how Nigeria can sustain digital innovative growth and scientific development in Nigeria
The board of global payments company, PayPal, says a 53 billion dollars takeover offer from financial technology firm, Stripe, and private equity company, Advent International, does not adequately reflect the company’s long-term value.
PayPal
According to reports, the proposed acquisition, valued at 60.50 dollars per share, remains under consideration, with the board yet to formally respond to the offer.
The directors are said to be evaluating not only the financial value of the proposal but also the structure of the financing, the timeline for completing the transaction and the likelihood of obtaining regulatory approvals.
They are also considering the possibility of competing bids emerging.
Although the offer represents a premium of about 28 per cent above PayPal’s recent share price, the board believes the company could deliver greater value to shareholders if its ongoing turnaround strategy succeeds.
Following reports of the bid, PayPal shares gained about two per cent to close at 56.73 dollars.
Sources familiar with the discussions said Stripe and Advent have secured approximately 50 billion dollars in debt financing from JPMorgan and Morgan Stanley, while both firms would jointly contribute 17 billion dollars in equity.
Under the proposal, the two companies would jointly own PayPal instead of dividing its operations.
PayPal, Stripe, Advent International, JPMorgan and Morgan Stanley have all declined to comment on the proposed transaction.
The discussions come as PayPal seeks to strengthen its business after years of increasing competition from rivals including Apple Pay, Google Pay and emerging financial technology firms.
The company, which was valued at about 360 billion dollars in 2021, now has a market capitalisation of approximately 36 billion dollars.
Since assuming office as Chief Executive Officer in March 2026, Enrique Lores has embarked on a restructuring programme aimed at improving operational efficiency and restoring growth.
The restructuring includes the creation of three business divisions comprising Checkout, Venmo and Consumer Financial Services, and Payments and Crypto.
The company is also targeting 1.5 billion dollars in cost savings through the deployment of artificial intelligence technologies.
PayPal’s latest financial results indicated signs of recovery, with first-quarter revenue rising seven per cent year-on-year to 8.35 billion dollars, while total payment volume increased by eight per cent to 464 billion dollars.
If approved, the transaction would combine two of the world’s largest digital payments companies.
The combined business would process an estimated 3.7 trillion dollars in annual payment volume, significantly strengthening its position in the global online payments market.
However, analysts expect the proposed acquisition to face intense regulatory scrutiny because of the companies’ combined market share in merchant payment services.
To address possible antitrust concerns, the bidders have reportedly considered options, including separating PayPal’s Braintree business or other assets if required by regulators.
Sources said Stripe and Advent remain interested in pursuing the acquisition despite the board’s reservations, although negotiations are expected to continue.
Market observers are also awaiting PayPal’s earnings report scheduled for July 28 for further indications of the company’s financial recovery and future growth prospects.
Concerns over network reliability and its impact on Nigeria’s growing creator economy took centre stage at MTN Nigeria’s Data on Trial event, where content creator and streamer, Jarvis, challenged telecommunications operators to improve connectivity for digital creators.
Speaking during the event, Jarvis asked whether there were locations in Nigeria where uninterrupted internet connectivity could support real-life (IRL) streaming without network disruptions.
“Are there places where there is no breakage when streaming IRL?” she asked.
Her question highlighted the challenges faced by content creators who depend on stable internet services for live streaming, content uploads and real-time engagement with audiences.
Responding, MTN Nigeria’s Chief Technical Officer, Mr Yahaya Ibrahim, said network performance depends on several factors, including location, network coverage, device capability and the number of users connected to a particular base station.
He noted that operators continue to invest in expanding network capacity to meet the growing demand for data services.
Earlier, MTN’s General Manager, Network Performance and Quality Assurance, Mr Michael Ndukwe, explained the evolution of mobile network technology in Nigeria, from first-generation (1G) services to the current fifth-generation (5G) technology.
According to him, each phase of technological advancement has significantly increased network capacity and enabled new digital services.
Ndukwe cited Nigerian Communications Commission (NCC) data showing that Nigerians consumed about 13.2 million terabytes of data in 2025.
He added that data usage reached approximately 4.06 million terabytes in the first quarter of 2026, reflecting the country’s increasing reliance on digital platforms and online services.
According to him, the growth is being driven by wider adoption of 4G and 5G networks, increased smartphone penetration, the proliferation of smart devices and expanding use of social media platforms.
Participants at the event noted that as more Nigerians build businesses and careers around digital content, access to reliable and high-speed internet has become critical to sustaining the country’s digital economy and creator ecosystem.
Dangote Refinery’s Private Placement Reportedly Hits $2.5Bn
FG, UNODC Plan National Strategy against Organized Crime
EFCC Busts NIS Visa Overstay Racket, Uncovers N700m in an Account
CBN to Monitor Every Dollar with FXBT, Forex Tracker
NCC, NDLEA Partner to Fight Piracy and Drug Trafficking
NRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Lebara Nigeria Launches Lebara Play, Africa’s First Telecom-Owned Micro-Drama Platform
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
Tokenization, Blockchain Technology will Transform Financial Institutions – IMF
Telecom2 days agoHelios Towers Secures $29m Facility to Expand Across Africa
News2 days agoValueJet Expands Fleet with Boeing Aircraft, Targets Wider African Network
Telecom2 days agoNCC Begins Stakeholder Consultation on MVNO Business Rules
E-Financial2 days agoFirst Securities Brokers Empowers Nigerians to Trade in the Stock Market with the Launch of FirstInvest App
Telecom2 days agoSurge in Fibre Cuts Hobbles Service Provisioning
Broadcasting2 days agoNBC Scraps Annual Digital Access Fee on DSO
News2 days agoCourt Orders Final Forfeiture of 48 Properties Linked to Former AGF Abubakar Malami
E-Business2 days agoJumia Seeks for Payment Harmonisation, Stronger Policies to Boost Africa’s Digital Trade