E-Business
XLoader Prevalent Malware in Nigeria, Impacting 14% of Organizations – CPR
Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies Ltd., a provider of cybersecurity solutions globally, has published its latest Global Threat Index for September 2022.
CPR reports that In Nigeria, XLoader is the most prevalent malware impacting 14.06% of organizations in the country, followed by Ramnit 10.94% and Phorpiex 9.38%. While Formbook is still the most prevalent malware, impacting 3% of organizations worldwide, Vidar is now in eighth position, up seven places from August.
Vidar is an infostealer designed to give threat actors backdoor access, enabling them to steal sensitive banking information, login credentials, IP addresses, browser history and crypto wallets from infected devices.
The increase in its prevalence follows a malicious campaign whereby fake Zoom websites, such as zoomus website and zoom-download, were used to lure innocent users into downloading the malware. Formbook, an infostealer targeting Windows OS, remains in first place.
Since the onset of the Russia-Ukraine war, CPR has continued to monitor the impact on cyberattacks in both countries.
While the conflict intensifies, CPR’s Global Threat Index for September noted a significant change in the ‘threat rank’ of many Eastern European countries. The threat rank represents how much an organization is being attacked in a specific country compared to the rest of the world.
During September, Ukraine had jumped 26 places, Poland and Russia moved up 18 places each, and both Lithuania and Romania moved up 17 places, among others. All these countries are now among the top 25, with the biggest degradation in their ranking occurring in the past month.
“As the war on the ground continues, so too does the war in cyberspace. It’s likely no coincidence that the threat ranks of many Eastern European countries have increased this last month. All organizations are at risk and must shift to a prevent-first cybersecurity strategy before it’s too late,” commented Maya Horowitz, VP Research at Check Point.
“In terms of the most prevalent malwares in September, it’s interesting to see Vidar leap into the top ten after a long absence. Users of Zoom need to stay alert to fraudulent links as this is how the Vidar malware has been distributed lately. Always keep an eye out for inconsistencies or misspelled words in URLs. If it looks suspicious, it probably is.”
CPR also revealed that “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 43% of organizations worldwide, closely followed by “Apache Log4j Remote Code Execution” which dropped from first place to second, with an impact of 42%. September also saw Education/Research remain in first place as the most attacked industry globally.
Top Malware Families
*The arrows relate to the change in rank compared to the previous month.
This month, Formbook is still the most prevalent malware impacting 3% of organizations worldwide, followed by XMRig and AgentTesla which both impact 2% of organizations globally.
In Nigeria, XLoader is the most prevalent malware impacting 14.06% of organizations in the country, followed by Ramnit 10.94% and Phorpiex 9.38%.
- XLoader – XLoader is an Android Spyware and Banking Trojan developed by the Yanbian Gang, a Chinese hacker group. This malware uses DNS spoofing to distribute infected Android apps to collect personal and financial information.
- Ramnit – Ramnit is a modular banking Trojan first discovered in 2010. Ramnit steals web session information, giving its operators the ability to steal account credentials for all services used by the victim, including bank accounts, and corporate and social networks accounts. The Trojan uses both hardcoded domains as well as domains generated by a DGA (Domain Generation Algorithm) to contact the C&C server and download additional modules.
- Phorpiex – Phorpiex is a botnet (aka Trik) that has been active since 2010 and at its peak controlled more than a million infected hosts. It is known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.
Top Attacked Industries
In Africa, this month the ISP/MSP sector remains in first place as the most attacked industry globally, followed by Government/Military and Communications
- ISP/MSP
- Government/Military
- Communications
Top Exploited Vulnerabilities
This month, “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 43% of organizations globally. It is followed by “Apache Log4j Remote Code Execution” which dropped from first place to second and impacts 42% of organizations. “Command Injection Over HTTP Linux System Files Information Disclosure” jumps into third place, with a global impact of 40%.
- ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow unintentional disclosure of account information.
- ↓ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↑ Command Injection Over HTTP (CVE-2021-43936,CVE-2022-24086) – A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.
Top Mobile Malwares
This month, Anubis jumped into first place as the most widespread Mobile malware, followed by Hydra and Joker.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger and audio recording capabilities as well as various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- Hydra – Hydra is a banking Trojan designed to steal finance credentials by requesting victims to enable dangerous permissions.
- Joker – An Android Spyware in Google Play, designed to steal SMS messages, contact lists and device information. Furthermore, the malware can also sign the victim up for paid premium services without their consent or knowledge.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.
The .ng domain name, Nigeria’s Internet country code top-level domain (ccTLD), has continued to garner popularity in usage for websites and email addresses.
Mr. Adesola Akinsanya, the president of the Nigeria Internet Registration Association (NiRA), dropped the hint in his message to stakeholders who gathered [physically and virtually] at the association’s 16th Annual General Meeting (AGM), in Lagos, recently.
Giving account of the Executive Board of Directors (EBoD’s) stewardship in the past one year, Mr. Akinsanya said that as of February 2024, NiRA registrars have registered 215,441 .ng domain names.
He said that .ng as Nigeria’s Internet country code top-level domain (ccTLD) has become increasingly popular for use in websites and email addresses.
The number of .ng domain names reached 212,890 as disclosed in the NiRA Audited Account for the year ending December 31st 2023, which also shows an increase by 29,098 when compared to 183,792 recorded as at December 2022.
Mr. Akinsanya also applauded President Bola Tinubu’s administration on the Renewed Hope agenda aimed at leveraging the digital economy to better the worth of the citizens.
He also commended Dr. Bosun Tijani, the Minister of Communications and Digital Economy who has shown understanding of the need to intensify the adoption of Nigeria country code top-level domain (ccTLD), .ng within and outside the government circle, adding that NiRA as a multi-stakeholder-led organization has enjoyed support from the Kashifu Inuwa led National Information Technology Development Agency (NITDA), especially in the crusade for both public and private organisations to switch over to .ng.
“The need for both the government and private institutions to switch-over to .ng brand is no longer negotiable in view of the significant role it plays in the country’s digital economy agenda”.
He said that NiRA supports the Minister in his efforts to ‘promote transparency in governance, protecting the Nigerian cyberspace, and promotion of the Digital Nigeria agenda’.
NiRA has been pushing for the government to accelerate the adoption of the second-level domain (. gov. ng, .edu.ng, .mil.ng) under the country code Top Level Domain (ccTLD.ng).
Speaking further, the NiRA chief said that a total of twenty-two new registrars were accredited last year, “showing the collective efforts of NiRA Accredited Registrars and their Resellers, which we duly acknowledge and appreciate.
“Our commitment to nurturing a robust partnership with our accredited registrars remains unwavering. The establishment of the Registrar’s Relationship Manager position exemplified this dedication, as it provides a specialized resource to address registrars’ needs and to cultivate stronger bonds among stakeholders.
“Together, we are poised to further elevate the .ng domain and advance our collective objective”, the NiRA President said.
Earlier in her goodwill message, Mrs. Ibukun Odusote, chairperson, Board of Trustees of NiRA, said: “Having gone through the documents associated with this meeting, I am filled with a profound sense of gratitude and appreciation for each one of you.
“Your dedication, commitment, and contributions to our organization have been instrumental in our continued success and growth.
“It is a time for us to come together as a community, to share ideas, insights, and experiences, and to reaffirm our shared vision and mission.
“As Chairperson of the Board of Trustees, I am inspired by the passion and enthusiasm that each of you brings to this body. Your unwavering support and commitment to our cause have been the driving force behind our accomplishments, and I am confident that together, we will overcome any obstacles that may lie ahead”.
Nigeria Data Protection Commission (NDPC) has said the certification of data protection professionals in the country will significantly reduce capital flight and create more than 500,000 jobs in the sector.
L-r: Dr. Vincent Olatunji, executive commissioner, NDPC and Dr. Oyedokun Oyewole, president of the Institute of Information Management,
Dr. Vincent Olatunji, executive commissioner, NDPC, stated this at the presentation of the certificate of licence to the Institute of Information Management (IMF) in Abuja.
He said the certification of data protection professionals would not only enhance the protection of personal data, but also boost the country’s economic growth and development.
The projection comes as the commission intensifies efforts to promote data protection and privacy in Nigeria’s rapidly growing digital economy.
According to Dr. Olatunji, the move aims to enhance the capacity of organisations to protect personal data and promote compliance with Nigeria’s data protection regulations.
Establishing a local institution to train and certify Nigerians would significantly enhance local content in the sector, the NDPC boss hinted.
The commission, he assured his audience, was already exploring the possibility of implementing the licencing framework across Africa—a move that could potentially harmonise data protection standards and expertise across the continent.
Dr. Oyedokun Oyewole, president of the Institute of Information Management, said the licence would effectively address the existing gap in the data protection ecosystem, providing a much-needed solution.
Recalling that the certification process began in 2021, Dr. Oyewole reaffirmed the institute’s dedication to excellence, pledging to provide top-notch education in data protection and set a benchmark for the country’s education system in this field.
The IIM’s certification programmes will cover essential topics such as data protection principles, risk management, and compliance with the Nigeria Data Protection Regulation (NDPR).
The initiative is expected to boost the confidence of organisations and individuals in the country’s data protection landscape.
Nigerian Consumer Credit Corporation (CrediCorp), has partnered Fintech Association of Nigeria (FinTechNGR) to drive consumer credit scheme initiative through a robust payment platform that would be provided by members of FinTechNGR.
Speaking at a Social Meet in Lagos, organised by FinTechNGR, with the theme: “Augmenting the Future, AI, Credit and Transformation of Nigerian Finance,” the Chairman, CrediCorp Board of Directors, Aderemi Abdul-Bojela, said members of FinTechNGR would have specific roles to play in the partnership, in the areas of providing robust platform for money transfer, technology evaluation, among others.
“Today, CrediCorp is engaging with members of FinTechNGR in a social interactive gathering to discuss collaboration and support for the growth of Consumer Credit Corporation in Nigeria. We want to interact to understand how technology will drive the crediCorp initiative in Nigeria and also to understand the role that members of FinTechNGR will play in all of these initiatives around CrediCorp,” Abdul-Bojela said.
Describing the partnership as a welcome development that will enhance savings culture among Nigerians, the Chief Operating Officer (COO) of FinTechNGR, Dr. Babatunde Obrimah, said: “FinTechNGR is an enabler of technology advancement in Nigeria. We bring the players together to drive technology innovation.
“Our role in the FinTechNGR-CrediCorp partnership is to ensure that our members support the growth of consumer credit in Nigeria, by providing the relevant payment platforms for all financial transactions among the banks who are the lenders, the customers who are the burrowers and the CrediCorp who is the guarantor.”
Speaking about the benefits for Nigerians, Obrimah said the Consumer Credit Corporation in Nigeria would enhance the country’s credit culture and enable Nigerians to save and plan well with their savings. “The initiative will address inflation, help in liquidity flow, build trust in customers’ borrowing, boost credit culture and enhance the culture of savings among Nigerians,” Obrimah said.
Addressing the issue of risk and consumer trust, Abdul-Bojela said the CrediCorp has put measures in place to ensure that the banks that would be involved in lending, would be protected and guaranteed of the repayment of the loans within the CrediCorp ecosystem.
He said there would be an independent management that would ensure that the right technology is put in place to recover all monies.
Google announces Umoja, first ever fiber optic cable connecting Africa to Australia
Mastercard and Payment24 collaborate to boost EMV adoption in EEMEA’s fleet sector
Konga Tech Month Empowers Nigerians with Unprecedented Deals
Gipy Malware Steals Passwords under the Guise of AI Application
.NG Domain Registrations Cross 215,000 as NiRA Pushes for Increased Adoption
60 Hearty Cheers to Chioma Ekeh, Africa’s Leading Unusual Female Tech
As Nigeria Struggle, Tanzania Turns off Power Plants Due to Excess Supply
World Earth Day: Kuda Partners with Wecyclers to Clean up Communities in Lagos
INTERPOL Appoints Uche, Nigerian CP as Chairman, African Heads of Cybercrime Units
Odu’a Investment Declares N1.961Bn as Profit Before Tax
E-Financial2 days agoCBN Says OPay, Moniepoint, Others can Start Onboarding New Customers Soon
News2 days agoAfreximbank Launches CANEX Prize for Publishing in Africa
E-Business3 days agoNDPC Empowers Institute to Certify Data Protection Professionals
Broadcasting2 days agoSLTV to Create Jobs, Shore Nigeria’s Forex- Nwafor
News2 days agoTranscorp Power Posts N142Bn Revenue, N52.8Bn PBT
E-Financial2 days agoFlutterwave Refutes N11Bn Loss Due to Security Breach
Telecom3 days agoATCON Offers Solutions to Fibre Cable Cuts in Telecom Industry
Telecom3 days agoStarlink now 3rd Largest ISP in Nigeria – NCC