Telecom
Cybercriminals Are Doubling Down on Credential Theft, Launching More Innovative Ransomware Attacks – Sophos 2023 Threat Report Reveals
Sophos, a global leader in innovating and delivering cybersecurity as a service, has on Monday published its 2023 Threat Report.
The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service.
The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.
Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up.
Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.
“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors.
“For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities.
“The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”
With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.
“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.
Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.
“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.
The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”
Sophos also analyzed the following trends:
·The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.
· Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in“bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.
· Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.
· The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.
To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.
National Agency for Science and Engineering Infrastructure (NASENI) has announced the launch of an Inter-Agency Innovation Competition and Awards to stimulate creativity and technological advancement among Ministries, Departments and Agencies (MDAs) of the Federal Government.
NASENI
In a statement issued on Wednesday in Abuja, NASENI said the initiative was designed to harness innovative ideas from public servants that can drive indigenous industrialization, job creation and national progress.
According to the agency, the competition will provide a platform for MDAs to propose solutions in critical sectors such as health, agriculture, education and infrastructure, leveraging science and technology to improve public service delivery and enhance the quality of life for Nigerians.
“The competition seeks to promote collaboration and creativity among MDAs while addressing pressing national challenges through innovation,” the statement said.
NASENI urged interested MDAs to submit their entries through its innovation portal at naseni.gov.ng/innovation.
The agency reiterated its statutory mission “to develop and maintain a dynamic infrastructure to drive Nigeria’s indigenous industrialization, job creation and national progress,” adding that the competition would further strengthen efforts to unlock the nation’s potential through science and technology.
Users of satellite internet service provider Starlink in Nigeria are being required to complete a biometric Know Your Customer (KYC) process as a precondition to continue enjoying their services, according to .biometricupdate.
According to local reports, more than 66,000 Starlink subscribers in the country had a December 31 ultimatum from the Nigerian Communications Commission (NCC) to complete the biometric verification or have their connection discontinued.
The process essentially entails linking a Starlkink account with the subscriber’s national digital ID.
The NCC, which is Nigeria’s telecoms industry regulator, is said to have first issued the directive in August last year, setting a three-month deadline which was to elapse on November 19, TechCabal reports.
The body however later extended it to December 31 after consultations with industry stakeholders. The internet account-NIN linkage, the NCC said, is to enhance identity verification and strengthen security within the country’s telecoms space.
Just a few days to the December 31 deadline, Starlink’s Nigeria office sent an email to its subscribers reminding them of the KYC requirement, and warned that all those who fail to comply would be disconnected.
And that once disconnected, reconnection would depend on network capacity in the concerned area.
The service provider said in its email that the process takes less than two minutes and users can complete it by logging in to their account via an app.
One user, quoted by TechCabal, said one needs to upload their selfie biometrics, provide their national identification number (NIN) and then give their consent for the account to be linked to their ID information.
Starlink’s internet service is present in about 155 countries with nine million users, as of 2025. Its growth in Nigeria is said to be rapid, making it the second largest internet service provider in the country, according to The Traffic.
Biometric identification for Starlink subscribers could become a continent-wide trend given that some countries have expressed reservations in opening up their internet space to the company over security concerns.
There’ve been fears that jihadists in countries like Mali and Nigeria may have exploited Starlink terminals to coordinate terror operations, and cybersecurity experts have also warned of risks related to weak regulation, digital sovereignty and data breaches.
The requirement for Starlink internet users to have their accounts linked with the NIN is similar to the SIM-NIN linkage policy which the Nigerian government battled to implement for many years, with many deadline extensions.
In October last year, the NCC, which is was at the forefront of the policy implementation, announced that all active SIM cards across all network providers had complied with the directive which was issued in 2020.
The idea, the federal government argued, was to strengthen security and curb criminality such as kidnappings which are aided and abetted by improperly identified mobile phone numbers.
Mr. Kashifu Inuwa, Director General of the National Information Technology Development Agency (NITDA), has urged Northern Nigeria to pivot urgently from traditional commerce to an innovation-driven digital economy for sustainable growth.
NITDA
Inuwa issued the call at the Future Map Foundation Roundtable 1.0 (North-West Edition) in Kano, attributing the region’s sluggish digital adoption not to talent deficits but to the lack of deliberate, coordinated strategies.
He stressed deeper collaboration across academia, private sector players, entrepreneurs, and government, positioning the private sector as the primary innovation engine while government supplies robust policies and an enabling ecosystem.
Inuwa advocated for people-focused, locally tailored innovations that tackle regional challenges head-on, enabling global competitiveness by transitioning from mere technology users to creators of homegrown solutions.
The roundtable convened policymakers, tech founders, and ecosystem stakeholders to forge a comprehensive roadmap for North-West digital transformation, yielding firm commitments to bolster regional innovation policies and public-private synergies.
Inuwa’s push dovetails seamlessly with the Federal Government’s Renewed Hope Agenda, which sets an ambitious target of 95 per cent nationwide digital literacy by 2030, fostering inclusive economic empowerment.
Participants hailed the forum as a pivotal step toward unlocking Northern Nigeria’s tech potential, with NITDA poised to lead implementation through strategic interventions and partnerships.
Fidelity Bank Completes N500Bn Capital Raise ahead of Deadline
PalmPay Deepens Its Long-Term Commitment in Nigeria with New Office @ Yaba
Kaspersky Shares AI Cybersecurity Predictions for 2026
Youth Talent Takes Center Stage as T2 Ignites High-Octane Rap Battles @ Carnival Calabar
Nigerians with Albinism Reject Pity, Demand Dignity at Empowerment Forum
Banks quietly move to enforce new ₦50 transfer levy from Jan. 1
FIRS says NIN, CAC Numbers to Serve as Tax IDs from 2026
Financial Sector Faced AI, Blockchain and Organised Crime Threats in 2025 – Report
PalmPay Launches N400 Million World Travel Carnival, Rewarding Users with Free Global Trips
Check Point Reveals Nigeria as Second Most Targeted African Country for Cyberattacks in November
News3 days agoCourt Sends Faleti, Ex-Lagos Director to Jail for Stealing ₦48.9m from Access Bank
E-Financial3 days agoRemita Powers over ₦100 Trillion in Payments as Nigeria’s Digital Economy Expands
E-Financial3 days agoWhy 2026 Must Be the Year Nigeria’s Economy Works for All
E-Financial3 days agoFlutterwave Acquires Nigeria’s Mono in $25m-$40m All-Stock Deal
E-Financial3 days ago2026: SEC to Review Rules to Incentivise SME Listings
General News3 days agoNigeria Targets Satellite-to-Mobile Services in Draft Spectrum Roadmap
Telecom3 days agoSamsung Plans to Double AI Mobile Devices to 800 million Units this Year
Telecom3 days agoMENXTT NG to pre-install Bitdefender Antivirus on all laptops from 2026