Connect with us

News

New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Published

on

Kindly share this post

Check Point Research reports that Emotet Trojan launched a new campaign last month to evade Microsoft’s macro block, sending spam emails containing malicious OneNote files. Meanwhile Ahmyth was the most prevalent mobile malware and Log4j took top spot once again as the most exploited vulnerability

Check Point® Software Technologies, a leading provider of cybersecurity solutions globally, has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware.

As reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files. In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file.

Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.

“While big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop every attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsoft’s latest defenses.

The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy skepticism about the origins of an email and its contents” said Maya Horowitz, VP Research at Check Point Software.

CPR also revealed that “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.

Top malware families

Globally, Qbot was the most prevalent malware last month with an impact of more than 10% on worldwide organizations respectively, followed by Emotet and Formbook with a 4% global impact.

In Nigeria, Qbot was the most prevalent malware last month with an impact of more than 32.36%, followed by Expiro with 19.35% and BlackCat with a 9.68% impact.

  1. Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
  1. Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials. 
  1. BlackCat – BlackCat (aka ALPHV) operates in a ransomware-as-a-service (RaaS) business model. BlackCat ransomware is highly customizable ransomware that allows for attacks on a wide range of corporate environments. It targets both Linux and Windows systems, and is coded in Rust.

Top Attacked Industries in Africa

Last month, Manufacturing remained the most attacked industry globally, followed by Consultant and then Leisure/Hospitality.

  1. Manufactoring
  2. Consultant
  3. Leisure/Hospitality

Top exploited vulnerabilities

Last month, “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.

  1. ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
  1. ↑ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
  1. ↑MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.

Top Mobile Malwares

Last month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and Hiddad.

  1. AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera.
  1. Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
  1. Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software Technologies.

 


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

News

Trump Threatens More Strikes in Nigeria

Published

on

Kindly share this post

President Donald Trump has warned that the United States could carry out further military strikes in Nigeria if Christians continue to be killed, reigniting a sensitive debate over religious violence and foreign intervention in Africa’s most populous nation.

Trump Threatens More Strikes in Nigeria

President Donald Trump

Trump made the remarks in an interview with The New York Times, published on Thursday, while responding to questions about a US military strike carried out in Nigeria on Christmas Day.

At the time, the US military said the operation targeted Islamic State militants in north-west Nigeria and was conducted at the request of the Nigerian government.

Nigeria, however, described the operation as a joint counterterrorism effort, stressing that it was aimed at armed groups designated as terrorists and “had nothing to do with a particular religion”.

“I’d love to make it a one-time strike,” Trump was quoted as saying. “But if they continue to kill Christians, it will be a many-time strike.”

Pressed on comments by his own Africa adviser that extremist groups such as Islamic State and Boko Haram have killed more Muslims than Christians in Nigeria, Trump acknowledged that Muslims were also victims but insisted that Christians were being targeted disproportionately.

“I think that Muslims are being killed also in Nigeria. But it’s mostly Christians,” he said.

Trump has repeatedly raised alarms about the safety of Christians in Nigeria, beginning in late October when he warned that Christianity faced what he described as an “existential threat” in the country. He has accused Nigerian authorities of failing to adequately protect Christian communities and has openly threatened US military intervention if the violence continues.

Nigeria has firmly rejected claims of systematic persecution of Christians. The government maintains that the country’s security challenges are complex and largely driven by insurgency, banditry and criminal violence rather than religious targeting.

With a population of more than 230 million people, Nigeria is almost evenly divided between Christians, who are concentrated mainly in the south, and Muslims, who predominate in the north. Islamist insurgencies, particularly Boko Haram and its offshoots, have plagued parts of northern Nigeria for more than a decade, killing thousands and displacing millions.

Nigerian authorities have repeatedly pointed out that militant attacks have claimed the lives of both Muslims and Christians, arguing that framing the violence along religious lines oversimplifies the crisis and risks inflaming tensions.

Following Trump’s earlier threats, the Nigerian government said it was willing to continue cooperating with Washington in combating terrorism but rejected language suggesting that Christians alone were under threat.

The latest comments are likely to strain diplomatic relations further, as Nigeria balances its partnership with the United States against concerns over sovereignty, security cooperation and the portrayal of its internal conflicts on the global stage.


Kindly share this post
Continue Reading

News

OpenAI Launches ChatGPT Health

Published

on

Kindly share this post

OpenAI maker of ChatGPT is rolling out a health-focused feature to the generative artificial intelligence (AI) tool that’s used by nearly a billion users.

Named ChatGPT Health, the new feature aims to provide users with health and wellness information. This, as health is one of the most common ways people use ChatGPT, according to OpenAI.

In a blog post, Microsoft-backed OpenAI says de-identified analysis of conversations show that over 230 million people globally ask health and wellness-related questions on ChatGPT every week.

ChatGPT Health will also “securely” connect medical records and wellness apps to ground conversations with a user’s own health information, making responses more relevant and useful.

“Designed in close collaboration with physicians, ChatGPT Health helps people take a more active role in understanding and managing their health and wellness – while supporting, not replacing, care from clinicians.”

According to OpenAI, health information is often scattered across portals, apps, wearables, PDFs, and medical notes making it hard to see the full picture, and people are left to navigate a complex healthcare system on their own.

“ChatGPT Health builds on these so responses are informed by your health information and context. You can now securely connect medical records and wellness apps – like Apple Health, Function, and MyFitnessPal – so ChatGPT can help you understand recent test results, prepare for appointments with your doctor, get advice on how to approach your diet and workout routine, or understand the trade-offs of different insurance options based on your healthcare patterns.”

According to the company, ChatGPT Health is designed to support, not replace, medical care, adding that it is not intended for diagnosis or treatment. “Instead, it helps you navigate everyday questions and understand patterns over time – not just moments of illness – so you can feel more informed and prepared for important medical conversations.

“To keep your health information protected and secure, Health operates as a separate space with enhanced privacy to protect sensitive data. Conversations in Health are not used to train our foundation models. If you start a health-related conversation in ChatGPT, we’ll suggest moving into Health for these additional protections.”

OpenAI adds that access to ChatGPT Health has started with a small group of early users to learn and continue refining the experience, adding that users with ChatGPT Free, Go, Plus, and Pro plans outside of the European Economic Area, Switzerland, and the UK are eligible.

“As we make improvements, we plan to expand access and make Health available to all users on web and iOS in the coming weeks.

“Medical record integrations and some apps are available in the US only, and connecting Apple Health requires iOS.”


Kindly share this post
Continue Reading

News

Kaspersky Shares AI Cybersecurity Predictions for 2026

Published

on

Kindly share this post

Kaspersky experts outline how the rapid development of AI is reshaping the cybersecurity landscape in 2026, both for individual users and for businesses. Large language models (LLMs) are influencing defensive capabilities while simultaneously expanding opportunities for threat actors.

Deepfakes are becoming a mainstream technology, and awareness will continue to grow. Companies are increasingly discussing the risks of synthetic content and training employees to reduce the likelihood of falling victim to it. As the volume of deepfakes grows, so does the range of formats in which they appear.

At the same time, awareness is rising not only within organisations but also among regular users: end consumers encounter fake content more often and better understand the nature of such threats. As a result, deepfakes are becoming a stable element of the security agenda, requiring a systematic approach to training and internal policies.

Deepfake quality will improve through better audio and a lowering barrier to entry. The visual quality of deepfakes is already high, while realistic audio remains the main area for future growth.

At the same time, content generation tools are becoming easier to use: even non-experts can now create a mid-quality deepfake in just a few clicks. As a result, the average quality continues to rise, creation becomes accessible to a far broader audience, and these capabilities will inevitably continue to be leveraged by cybercriminals.

Online deepfakes will continue to evolve but remain tools for advanced users. Real-time face and voice swapping technologies are improving, but their setup still requires more advanced technical skills. Wide adoption is unlikely, yet the risks in targeted scenarios will grow: increasing realism and the ability to manipulate video through virtual cameras make such attacks more convincing.

Efforts to develop a reliable system for labelling AI-generated content will continue. There are still no unified criteria for reliably identifying synthetic content, and current labels are easy to bypass or remove, especially when working with open-source models. For this reason, new technical and regulatory initiatives aimed at addressing the problem are likely to emerge.

Open-weight models will approach top closed models in many cybersecurity-related tasks, which create more opportunities for misuse. Closed models still offer stricter control mechanisms and safeguards, limiting abuse.

However, open-source systems are rapidly catching up in functionality and circulate without comparable restrictions. This blurs the difference between proprietary models and open-source models both of which can be used efficiently for undesired or malicious purposes.

The line between legitimate and fraudulent AI-generated content will become increasingly blurred. AI can already produce well-crafted scam emails, convincing visual identities, and high-quality phishing pages.

At the same time, major brands are adopting synthetic materials in advertising, making AI-generated content look familiar and visually “normal.” As a result, distinguishing real from fake will become even more challenging, both for users and for automated detection systems.

AI will become a cross-chain tool in cyberattacks and be used across most stages of the kill chain. Threat actors already employ LLMs to write code, build infrastructure, and automate operational tasks.

Further advances will reinforce this trend: AI will increasingly support multiple stages of an attack, from preparation and communication to assembling malicious components, probing for vulnerabilities and deploying tools. Attackers will also work to hide signs of AI involvement, making such operations harder to analyse.

“While AI tools are being used in cyberattacks, they are also becoming a more common tool in security analysis and influence how SOC teams work. Agent-based systems will be able to continuously scan infrastructure, identify vulnerabilities, and gather contextual information for investigations, reducing the amount of manual routine work.

“As a result, specialists will shift from manually searching for data to making decisions based on already-prepared context. In parallel, security tools will transition to natural-language interfaces, enabling prompts instead of complex technical queries,” adds Vladislav Tushkanov, Research Development Group Manager at Kaspersky.

 


Kindly share this post
Continue Reading

Trending