Telecom
Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.
The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.
The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.
Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.
Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.
“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.
“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.
“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.
“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.
“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”
Highlights of the Report
● On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”
● In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.
● After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.
● Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.
● A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.
● In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.
“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.
“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.
“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.
“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.
“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”
Industry Quotes About Sophos’ Pacific Rim Report
“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.
“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.
“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.
“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”
“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.
“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”
“At NCSC-NL, one of our tasks is to share information and connect organisations.
“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.
“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.
Advice for Defenders
Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.
● Minimize internet-facing services and devices when possible
● Prioritize patching with urgency for internet-facing devices and monitor these devices
● Enable hotfixes for edge devices to be allowed and applied automatically
● Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs
● Create a plan for how your organization deals with EOL devices
“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.
In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.
Telecom
Sunil Bharti Mittal Conferred GSMA Lifetime Achievement Award for Transforming Global Telecommunications
The GSMA has conferred a rare Lifetime Achievement Award on Sunil Bharti Mittal, Founder and Chairman of Bharti Enterprises, recognising his role in reshaping the global telecommunications landscape and expanding connectivity across operators, governments, businesses and billions of consumers worldwide.
Bestowed on only a handful of industry leaders in the GSMA’s history, the honour recognises contributions that have left an enduring and defining mark on the global communications ecosystem.
The award was presented at Mobile World Congress in Barcelona in the distinguished presence of His Majesty Felipe VI, the Prime Minister of Spain, Pedro Sanchez, the President of Catalonia, Salvador Illa, and global industry leaders.
A visionary in the telecom sector, Sunil Bharti Mittal has built Bharti Airtel into one of the world’s leading mobile operators, with operations across India and Africa, ranking among the top three globally and serving over half a billion customers.
He pioneered the expansion of mobile services across emerging markets and served as Chairman of the GSMA from 2017 to 2018, where he championed policies that encouraged investment and innovation while strengthening the industry’s commitment to connecting the unconnected and advancing digital inclusion.
He was previously honoured with the GSMA Chairman’s Award in 2008 and again in 2016 for his outstanding contribution to the growth and development of the global mobile industry and was felicitated at Mobile World Congress in February 2019 in recognition of his Chairmanship.
On receiving the award, Sunil Bharti Mittal said, “I am deeply honoured to receive this recognition and sincerely thank the GSMA for this award. I accept it not only as a personal milestone, but as a tribute to India’s telecom journey, the collective spirit of Bharti, and the rise of Indian telecom companies on the global stage.
Equally the award reflects the progress of an industry that has connected billions and belongs to the customers we serve, the teams who built our institutions, and the partners who believe in the transformative power of connectivity.
Telecommunication is a force that expands opportunity, places essential services in the palm of every individual and unlocks human potential. Helping shape its evolution into a powerful accelerator of modern progress has been a privileged responsibility. As innovation accelerates, we will continue to work with our partners & stakeholders to ensure that growth advances equity and creates lasting opportunity for generations to come.”
The Lifetime Achievement Award is a rare honour, bestowed only on select individuals whose leadership and innovation have left an enduring mark on the industry.
House of Representatives is pushing to regulate Nigeria’s fintech sector through a public hearing on “A Bill for an Act to Establish the Nigerian Fintech Regulatory Commission and for Related Matters (HB.2389).”
Speaker Tajudeen Abbas opened the hearing, stressing the need for stakeholder inputs to craft enforceable, constitutional laws addressing regulatory overlaps in digital banking, science, technology, and communications.
Abbas highlighted fintech’s role in Nigeria’s growth via digital payments, blockchain, crowdfunding, and financial inclusion for the unbanked, creating jobs and supporting SMEs under President Tinubu’s Renewed Hope Agenda.
He warned that lagging regulations cause fragmentation, compliance issues, and investor uncertainty, necessitating a coordinating commission for licensing, supervision, standards, and a level playing field without duplicating bodies like the Central Bank of Nigeria (CBN), SEC, NITDA, or NDIC.
The commission would protect consumers, monitor cybersecurity, ensure data privacy, and promote education while complementing existing regulators.
Committee Chairman Emmanuel Ukpong-Udo, overseeing digital banking, banking regulations, science, technology, communications, capital markets, and institutions, called the bill vital for harmonizing oversight amid Nigeria’s rise as Africa’s fintech hub with 430+ firms valued at billions.
Ukpong-Udo emphasized balancing innovation, stability, and coordination to avoid burdens on startups.
Bill sponsor Fuad Kayode Laguda argued the commission would streamline operations currently split among CBN, SEC, NITDA, NOTAP, and FIRS, boosting profitability, user security, and ease of business. He cited 2024-2026 stats: 250-430 firms, $230 billion market projection, $10.6 billion valuation for top nine, and $1.6 billion in mobile transactions.
Fintech stakeholders offered mixed views, with some backing unified regulation and others fearing overlaps with current mandates.
By Kehinde Ogundare, Country Head, Zoho Nigeria
For years, security for SMEs across sub-Saharan Africa meant metal grilles and alarm systems. Today, the most significant risks are invisible and growing faster than most businesses realise.
Kehinde Ogundare
Artificial Intelligence has quietly embedded itself into everyday operations. The chatbot responding to customers at midnight, the system forecasting inventory requirements, and the software identifying unusual transactions are no longer experimental technologies. They are becoming standard features of modern business tools.
Last month’s observance of Safer Internet Day on February 10, themed ‘Smart tech, safe choices’, marked a pivotal moment. As AI adoption accelerates, the conversation must shift from whether businesses should use AI to how they deploy it responsibly. For SMEs across Africa, digital trust is no longer a technical consideration. It is a strategic business imperative.
The evolving threat landscape
Cybersecurity threats facing sub-Saharan African SMEs have moved well beyond basic phishing emails. Globally, cybercrime costs are projected to reach $10.5 trillion this year, fuelled by generative AI and increasingly sophisticated social engineering techniques. Ransomware attacks now paralyse entire operations, while others threats quietly extract sensitive customer data over extended periods.
The regional impact is equally significant. More than 70% of South African SMEs report experiencing at least one attempted cyberattack, Nigeria faces an average of 3,759 cyberattacks per week on its businesses, Kenya recorded 2.54 billion cyber threat incidents in the first quarter of 2025 alone, whilst Africa loses approximately 10% of its GDP to cyberattacks annually.
The hidden risk of fragmentation
A common but often overlooked vulnerability lies in digital fragmentation.
In the early stages of growth, SMEs understandably prioritise affordability and agility. Over time, this can result in a patchwork of disconnected applications, each with separate logins, security standards, and privacy policies. What begins as flexibility can involve into operational complexity.
According to IBM Security’s Cost of a Data Breach Report, companies with highly fragmented security environments experienced average breach costs of $4.88 million in 2024.
Fragmented systems create blind spots, each additional data transfer between applications increases exposure. Inconsistent security protocols make governance harder to enforce. Limited visibility reduces the ability to detect anomalies early. In practical terms, complexity increases risk.
Privacy-first AI as a competitive differentiator
As AI capabilities become embedded in business software, SMEs face a choice about how they approach these powerful tools. The risks are not merely theoretical.
Consumers across Africa are becoming more aware of data rights and willing to walk away from businesses that cannot demonstrate trustworthiness. According to KPMG’s Trust in AI report, approximately 70% of adults do not trust companies to use AI responsibly, and 81% expect misuse. Meanwhile, studies also show that 71% of consumers would stop doing business with a company that mishandles information.
Trust, once lost, is difficult to rebuild. In the digital age, a single data leak can destroy a reputation that took ten years to build. When customers share their payment details or purchase history, they extend trust. How you handle that trust, particularly when AI processes their data, determines whether they return or take their business elsewhere.
Privacy-first, responsible AI design means building intelligence into business systems with data protection, transparency and ethical use embedded from the outset. It involves collecting only necessary information, storing it securely, being transparent about how AI makes decisions, and ensuring algorithms work without compromising customer privacy. For SMEs, this might mean choosing inventory software where predictive AI runs on your own data without sending it externally, or customer service platforms that analyse patterns without exposing individual records. When AI is built responsibly into unified platforms, it becomes a competitive advantage: you gain operational efficiency whilst demonstrating that customer data is protected, not exploited.
Unified platforms and operational resilience
The solution lies in rethinking digital infrastructure. Rather than accumulating disparate tools, businesses need unified platforms that integrate core functions whilst maintaining consistent security protocols.
A unified approach means choosing cloud-based platforms where functions share common security standards and data flows seamlessly. For a manufacturing SME, this means inventory management, order processing and financial reporting operate within a single security framework.
When everything operates cohesively, security gaps diminish and the attack surface shrinks. And the benefits extend beyond risk reduction: employees spend less time on administrative friction, customer data stays consistent, and platforms enable secure collaboration without traditional infrastructure costs.
Safer Internet Day reminds us that the digital world requires active stewardship. For SMEs across the African continent who are navigating complex threats whilst harnessing AI’s potential, digital trust is foundational to sustainable growth. Security, privacy and responsible AI are essential characteristics of any technology infrastructure worth building upon. Businesses that embrace unified, privacy-first platforms will be more resilient against cyber threats and better positioned to earn and maintain trust. In a market where trust is currency, that advantage is everything.
Sunil Bharti Mittal Conferred GSMA Lifetime Achievement Award for Transforming Global Telecommunications
Jumia Tech Week 2026 Begins with Tech Deals on Smartphones, Electronics, and Everyday Technology
AfDB Supports Francophone Africa Start-ups with €6.5M
Krishnan Exits Africa Data Centre to Embark on Professional Chapter
House Probes Fintech Regulation via Public Hearing on New Commission Bill
Accidental Billionaire Opts for Jail Instead of Returning Money Credited Him by Mistake
New Horizons Nigeria Breaks Ground: First to Fuse Mandarin into ICT Curriculum
Kaspersky Brings more Transparency to Threat Detection with New Hunt Hub
Dr. Cairo Ojougboh Foundation Bolsters Nigeria’s Education Drive with ₦2.7m Student Support
NDPC Commits to Balancing Data Privacy, Protection Information
E-Financial2 days agoIran-Israel-US Conflict and CBN’s FX Gains: A Stress Test for Nigeria’s Monetary Stability
E-Financial2 days agoMutual Benefits Assurance Reaffirms Full Regulatory Compliance, Enhanced Governance
General News2 days agoJAMB Uncovers AI-Driven Fraud Targeting UTME Candidates, Warns Parents
General News2 days agoSERAP Asks FCCPC to Investigate Google, Meta, Others over Alleged Rights Abuses
News2 days agoTeamApt, Awabah Partner to Boost Pension Drive for Nigerians
News2 days agoFlashChange CEO, Bidemi Oke, Urges Startups to Build Strong Governance Structures Early
General News2 days agoCapelli Institute Commits to Advancing Trichology in Nigeria
E-Financial2 days agoReps Mull Commission to Regulate Fintech Operations