Telecom
Cybercriminals Are Doubling Down on Credential Theft, Launching More Innovative Ransomware Attacks – Sophos 2023 Threat Report Reveals
Sophos, a global leader in innovating and delivering cybersecurity as a service, has on Monday published its 2023 Threat Report.
The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service.
The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.
Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up.
Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.
“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors.
“For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities.
“The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”
With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.
“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.
Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.
“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.
The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”
Sophos also analyzed the following trends:
·The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.
· Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in“bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.
· Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.
· The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.
To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.
Modern messengers, such as WhatsApp, Telegram, Signal and others, are often used for illicit purposes. Kaspersky Digital Footprint Intelligence has conducted an in-depth monitoring of over 800 blocked cybercriminal Telegram channels between 2021 and 2024.
While a range of illegal activities continues to be hosted on the platform, its environment has become noticeably more challenging for sustained underground operations.
Telegram’s bot framework and other built-in features make for a low-effort ecosystem for the underworld.
A single bot can simultaneously manage queries, process cryptocurrency payments, and instantly deliver stolen bank cards, info-stealer logs, phishing kits, or DDoS attacks to hundreds of buyers per day, often without operator involvement.
Unlimited, non-expiring file storage eliminates the need for external hosting when distributing multi-gigabyte database dumps or stolen corporate documents. This frictionless automation naturally favours high-volume, low-price, low-skill offerings, such as leaked bank cards or other data, hosting malware, etc.
High-value, trust-dependent deals (for instance, zero-day vulnerability information) still remain on reputation-gated dark-web forums.
Kaspersky researchers found two clear trends related to illegal activities on Telegram. The average lifespan of shadow channels has increased, with the proportion of channels surviving over nine months more than tripling in 2023-2024 compared to 2021–2022. At the same time, Telegram’s blocking activity has risen significantly.
Monthly takedown figures recorded since October 2024 – even at their lowest – are comparable to the peak levels seen throughout 2023, and the overall pace continued to accelerate in 2025. This impedes malicious activities.
Other disadvantages of Telegram for cybercriminals include the lack of default end-to-end (E2E) encryption for chats, the inability to use their own servers for communication (due to the messenger’s centralised infrastructure), and closed server-side code, which makes it impossible to verify its functionality.
As a result, several established underground communities, including the nearly 9,000-member BFRepo group and the Angel Drainer malware-as-a-service operation, have already begun shifting primary activity to other platforms or proprietary messengers, citing repeated disruptions of their activities on Telegram.
“Fraudsters find Telegram a convenient tool for many malicious activities, but the risk-reward balance is clearly shifting. Channels are managing to stay online longer than a couple of years ago, yet the dramatically higher volume of blocks means operators can no longer count on long-term stability.
“When a storefront or service disappears overnight – and sometimes reappears only to be removed again weeks later – building a reliable business becomes much harder. We’re starting to see the early stages of migration as a direct consequence,” comments Vladislav Belousov, Digital Footprint Analyst at Kaspersky.
Galaxy Backbone Limited (GBB), the Federal Government’s leading ICT infrastructure and shared services provider, will mark its 20th anniversary in June 2026 with a grand celebration that reflects two decades of innovation, resilience, and national impact.
Since its inception in 2006, Galaxy Backbone has been at the heart of Nigeria’s digital transformation journey; building the technological foundation that supports modern government operations and public service delivery. What began as a bold vision to connect government has grown into a critical national platform that drives efficiency, transparency, collaboration and innovation across the public sector.
Over the last 20 years, GBB has helped redefine how government works. By providing secure connectivity, enterprise-grade data centre services, cloud platforms, and digital collaboration tools, Galaxy Backbone has enabled Ministries, Departments and Agencies (MDAs) to move from fragmented, paper-based processes to more integrated, technology-driven systems.
This transformation has improved government-to-government coordination, strengthened engagement with businesses, and enhanced the delivery of services to citizens. Today, the digital infrastructure powered by Galaxy Backbone supports thousands of government users, hundreds of institutions, and critical national platforms that Nigerians rely on daily.
A key part of this journey has been the Federal Government of Nigeria’s investment, managed by GBB in robust national infrastructure, high-capacity and world class data centres, fibre-optic connectivity across multiple states, secure hosting services, and shared platforms that have helped government operate more efficiently and responsively. These contributions have played a pivotal role in Nigeria’s progress toward a more digital, agile and citizen-centered public service.
Galaxy Backbone’s impact has earned both national and global recognition. In 2025, the organisation was ranked first overall in the Federal Government Website Performance Scorecard, reflecting its commitment to excellence in digital service delivery. Internationally, GBB, a couple of years ago, received the prestigious United Nations Public Service Award, a testament to its leadership in promoting a whole-of-government approach to digital transformation.
As GBB celebrates two decades of service, this milestone is more than an organisational anniversary; it is a celebration of Nigeria’s digital evolution. It is an opportunity to appreciate how collaboration between government, industry partners, technology providers, and dedicated public servants has helped build a stronger, more connected nation.
The June 2026 anniversary celebration will bring together stakeholders from across the public and private sectors to reflect on the journey so far, acknowledge the partnerships that have shaped this success, and chart an ambitious course for the future. It will highlight how collective effort, shared vision, and innovation have positioned Galaxy Backbone as a strategic national asset.
Looking ahead, Galaxy Backbone remains committed to deepening digital transformation across the country; expanding infrastructure, strengthening cybersecurity, enhancing service delivery, and supporting the Federal Government’s drive for a smarter, more efficient and digitally empowered Nigeria.
At 20 years, Galaxy Backbone stands proud of its past, confident in its present, and inspired by the limitless possibilities ahead.
Galaxy Backbone Limited (GBB), Nigeria’s leading federal ICT infrastructure provider, has announced its 20th-anniversary celebration for June 2026, marking two decades since unifying government’s fragmented digital landscape into a secure national platform.
Galaxy Backbone
The announcement by Head of Media and Corporate Communications Chidi Okpala follows GBB’s top ranking in the 2025 Federal Government Website Performance Scorecard by the Bureau of Public Service Reforms, cementing its leadership in digital service delivery and transparency.
Managing Director Professor Ibrahim Adepoju Adeyanju described the milestone as celebrating Nigeria’s shift from paper-based silos to a cloud-first, integrated government. Achievements include the UN Public Service Award for 1-GOV.net, high-speed fiber deployment for G2G and G2B interactions, IPPIS payroll rollout, and pandemic-era digital support.
The June event will gather public-private stakeholders, global tech partners, and policymakers to unveil GBB’s next-decade roadmap emphasising cybersecurity, AI in public service, and rural connectivity.
GBB positions itself at the forefront of Nigeria’s 2030 digital nation drive, with 20 years of innovation signaling a smarter, connected future.
SEC Hikes Minimum Capital Requirements for Market Operators After a Decade
Study Shows Blocks in Telegram are Pushing the Underground Out
Galaxy Backbone Marks Two Decades of Powering Nigeria’s Digital Evolution
NGX Unveils Net-Zero Plan for Greener Capital Market
Galaxy Backbone Marks 20 Years, Tops FG Website Scorecard
Banks quietly move to enforce new ₦50 transfer levy from Jan. 1
FIRS says NIN, CAC Numbers to Serve as Tax IDs from 2026
Nigeria Police Arrest Okitipi, Nigerian Allegedly Linked to Microsoft 365 Hack
FIRS Declares NIN, CAC Numbers as Tax IDs from 2026
US Begins Partial Visa Ban on Nigerians January 1
E-Financial3 days agoAngst as FG Demands 7.5 Percent VAT on Mobile Bank Transfers, USSD
News3 days agoMoniepoint Launches Second Cohort of DreamDevs Initiative to Double Down on Africa’s Tech Talent Pipeline
E-Financial3 days agoNGX lists 3.156bn UBA shares, boosting capital to N513Bn
E-Financial3 days agoThe Missing Pieces in Nigeria’s Banking Recapitalisation
Telecom3 days agoGlo Unveils Immersive Gaming Experience, Travel Saga
E-Business3 days agoHalf of Global Companies Build SOCs to Enhance Cybersecurity, with a Focus on Human Expertise
General News3 days agoNITDA DG Reaffirms Nigeria–U.S. Partnership on Data Privacy, AI and Cybersecurity
E-Financial2 days agoPaystack Expands Beyond Payments into Banking