Connect with us

Telecom

Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers

Published

on

Kindly share this post

Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.

John Shier, senior security advisor at Sophos

The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.

The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.

“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”

Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.

“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”

Additional key findings in the playbook include:

  • The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
  • Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
  • Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
  • Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
  • Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
  • Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021

“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”

The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).

The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Continue Reading
Advertisement
Comments

Telecom

Vitel Wireless Partners Fintechs to Expand Access to Services

Published

on

Kindly share this post

Vitel Wireless has entered into partnership with OPay Limited and Moniepoint Limited, to expand access to airtime and data services, particularly in Nigeria’s underserved and rural communities.

Vitel Wireless Partners Fintechs to Expand Access to Services

The collaboration enables millions of customers on both fintech platforms to seamlessly purchase Vitel Wireless airtime and data directly from their bank accounts and digital wallets, a move designed to simplify access and improve connectivity nationwide.

Chudi Nwabueze, chief operating officer, Vitel Wireless, said the initiative highlighted the growing convergence between financial services and telecommunications in Nigeria.

He noted that by leveraging the expansive reach and infrastructure of fintech platforms, the company is removing long-standing barriers to mobile access.

Nwabueze added that the move builds on Vitel’s existing partnerships with traditional financial institutions such as Fidelity Bank and Zenith Bank, extending its footprint into the rapidly growing fintech ecosystem.

“This integration allows users to conveniently top up airtime and purchase data bundles through familiar banking and wallet platforms, improving accessibility and overall user experience,” he said.

Also speaking,  Odera Ben-Chiobi, product marketing manager, Vitel Wireless, said the partnership aligns with the company’s mission to democratize access to mobile connectivity across Nigeria.

According to her, the collaboration will bring telecom services closer to millions of Nigerians, especially in areas where access has historically been limited.

She added that combining telecom services with digital financial platforms will also support broader financial inclusion efforts.

Vitel Wireless currently operates nationwide through a network-sharing agreement with MTN Nigeria, leveraging MTN’s infrastructure to deliver its services across the country.

The company noted that the partnership reflects a shared commitment to inclusive growth, with the potential to accelerate both financial inclusion and digital connectivity across Nigeria.

 

 


Kindly share this post
Continue Reading

Telecom

Reps Claim NCC’s Weak Regulatory Oversight Responsible for Poor Telecom Services

Published

on

Kindly share this post

House of Representatives on Wednesday claimed that Nigerian Communications Commission’s (NCC)  weak regulatory oversight, was responsible for the country’s ongoing poor telecom service quality.

Reps Claim NCC’s Weak Regulatory Oversight  Resposible for  Poor Telecom Services

The lawmakers accused the NCC of failing to enforce standards that would compel operators to provide reliable connectivity.

They warned that persistent issues like dropped calls, slow data speeds, and network failures pose serious risks to lives and property, particularly during emergencies.

The resolution followed the adoption of a motion of urgent public importance moved by Ahmadu Jaha, representing Chibok/Damboa/Gwoza Federal Constituency in Borno State.

Speaking on the motion, Jaha emphasised the critical role of telecommunications in Nigeria’s economy and daily life, while lamenting the widening gap between subscriber expectations and actual service delivery.

“Telecommunication has become a vital part of everyday life in Nigeria. It connects families, supports businesses, enhances education, and drives economic growth. However, despite its importance, the quality of service provided by many telecom companies remains unsatisfactory,” he said.

Jaha highlighted recurring problems such as dropped calls, poor internet speeds, and failed message deliveries as signs of deeper systemic failures in the sector.“The House is concerned that poor network connectivity is a major issue.

Subscribers frequently experience dropped calls, slow internet speeds, and difficulty sending messages. This affects both personal communication and business operations, leading to frustration and financial losses,” he added.

Lawmakers also expressed dissatisfaction with the high cost of services relative to the quality received.

Jaha noted that Nigerians pay substantial amounts for data bundles that are quickly depleted due to unstable connections and frequent interruptions.

He further pointed to inadequate customer service, where complaints often go unresolved for long periods, hindering emergency communications during fire outbreaks, medical emergencies, or accidents.

The lawmaker attributed part of the problem to insufficient infrastructure expansion, especially in growing urban centres and underserved rural areas.

“Network congestion during peak hours and in densely populated areas shows that infrastructure development has not kept pace with the growing number of users,” he said.

Supporting the motion, George Ozodinobi, deputy minority whip, accused telecom operators of prioritising profits over service quality while faulting the NCC for regulatory complacency.

“It is like these companies have made enough profits in billions, and so, they don’t care about improving the network anymore. The NCC, the regulator, has become complacent,” Ozodinobi stated.

Despite the sector’s rapid growth from under one million lines in the early 2000s to over 200 million active subscriptions today challenges such as insufficient base stations, unreliable power supply, multiple taxation, and infrastructure vandalism continue to hamper service quality.

In its resolution, the House urged telecom companies to invest in modern infrastructure, expand coverage especially in rural communities, improve customer service, and adopt fairer pricing that reflects actual service quality.

The lawmakers also directed the NCC to enforce stricter quality-of-service standards and hold operators accountable.

They further resolved to set up an ad-hoc committee to investigate the root causes of poor service delivery and recommend appropriate legislative measures.

 

 


Kindly share this post
Continue Reading

Telecom

GSMA Africa Policy Group Chair Calls for Urgent Tax Reforms to Accelerate Digital Inclusion

Published

on

Kindly share this post

Mr. Daddy Mukadi, the Chief Regulatory Officer of Airtel Africa and Chair of GSMA Africa’s Policy Group, has called on African governments to recognise telecommunications as a core economic pillar and to implement two specific tax reforms that could dramatically accelerate digital inclusion across the continent.

Speaking at the first edition of the États Généraux du Secteur des Postes et Télécommunications in Kinshasa, DRC – an event convened to support the development of a strategic roadmap for the country’s digital and telecommunications sector and attended by H.E. President Félix Tshisekedi – Mukadi, who’s also a member of the GSMA Global Policy Group, urged government and industry stakeholders to rethink the role of telecommunications in national development.

He argued that it should be framed not as a sector specific concern, but as a continent-wide imperative.

“The telecoms sector can no longer be considered merely as a support sector,” Mukadi said. “It is now a core sector. Both are vital, and every other sector, from security and finance to transport and health, depends on digital technology for growth.”

His remarks come at a critical moment for Africa’s digital economy. According to the GSMA’s Mobile Economy Africa 2025 report, the mobile sector contributed US$220 billion to the continent’s economy in 2024. This is equivalent to 7.7% of GDP and is projected to reach US$270 billion by 2030.

Yet despite mobile networks now covering 95% of Africa’s population, nearly 75% of people across the continent remain offline.

The GSMA identifies this gap as Africa’s greatest connectivity challenge, driven above all by the unaffordability of devices.

Mr. Mukadi, therefore, called for strategic adjustments to public policy, as well as legal and regulatory frameworks, to support wider access to digital services.

He asserted that the telecommunications sector should be treated as a foundational pillar of economic development, with stakeholders working together to accelerate investment, expand coverage and close the usage gap across the continent.

The Chief Regulatory Officer of Airtel Africa also highlighted key barriers to digital inclusion, including the affordability of smartphones and the impact of import duties on telecommunications infrastructure.

He proposed a two-to-three-year exemption on import duties and taxes for entry-level smartphones priced between US$40 and US$150 to help bridge the usage gap. He also called for the removal of entry duties on telecommunications equipment for at least three years to support the expansion of network coverage.

According to him, “these measures would help deliver inclusive and sustainable digital technology for economic and social progress,” Mukadi said. “They would also support faster connectivity, improved access and the ability to connect more people, businesses and communities to the digital economy.”

He added that government and the private sector must work closely to create a regulatory environment that encourages innovation, protects consumer interests and supports long-term investment.


Kindly share this post
Continue Reading

Trending