Telecom
Sophos Report: Identity Attacks Drive 67% of Cyber Incidents as Threat Groups Surge in 2025
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released the 2026 Sophos Active Adversary Report.
John Shier
It reveals that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks.
The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems, often without needing to deploy new tools or techniques.
Key findings include:
- A shift from exploited vulnerabilities toward compromised credentials, with brute-force activity (15.6%) drawing almost level with exploitation (16%) as an initial access method
- Median dwell time declined to three days. This was driven by attackers’ movements, but also by defenders reacting more swiftly. This was particularly notable in MDR environments.
- Attackers are getting faster at reaching Active Directory (AD). Once an attacker is inside an organization it takes them just 3.4 hours to get to the AD server.
· Ransomware remains a firmly off-hours activity. 88% of ransomware payloads are deployed out of hours, and 79% of data exfiltration actions take place out of hours, emphasising the continued need for 24/7 coverage.
- Lack of telemetry undermines defense efforts. Missing logs due to data retention issues doubled over last year. This rise was largely driven by firewall appliances where the default was only seven days, and in some cases, 24 hours.
Identity Attacks Accelerate While MFA Gaps Persist
The report shows a continued rise in attacks rooted in identity compromise, including stolen credentials, brute-force activity, and phishing.
While exploited vulnerabilities remain a factor, attackers increasingly rely on valid accounts to gain initial access, allowing them to bypass traditional perimeter defenses.
There was also a lack of MFA in 59% of cases, facilitating the abuse of stolen and compromised credentials to penetrate an organization.
“The most concerning finding in the report has actually been years in the making: The dominance of identity-related root causes for successful initial access.
“Compromised credentials, brute-force attacks, phishing, and other tactics leverage weaknesses that can’t be addressed by simple patch hygiene. Organizations must take a proactive approach to identity security,” said John Shier, Field CISO and lead author of the report.
More Threat Groups, Broader Risk
Sophos researchers observed the highest number of active threat groups recorded in the report’s history, expanding the overall threat landscape and increasing the challenge of attribution.
- Akira (GOLD SAHARA) and Qilin (GOLD FEATHER) were the most active ransomware brands observed, with Akira dominating across 22% of incidents
- 51 ransomware brands appeared across cases, including 27 returning brands and 24 new ones
- Only four brands or techniques, LockBit, MedusaLocker, Phobos, and abuse of BitLocker, have persisted continuously since 2020, the first year of Active Adversary Report data
“Law enforcement action continues to cause disruption in the ransomware ecosystem. Although we still see activity from LockBit, the dominance and reputation it once had has clearly been impacted.
“However, it means we are seeing a raft of other groups vying for dominance and many more emerging groups. For defenders, it’s important to understand the groups and their TTPs in order to best protect your organization,” continued Shier.
AI Hype Meets Reality
Despite widespread predictions, Sophos found no evidence of a major AI-driven transformation in attacker behavior. While generative AI has increased the speed and polish of phishing and social engineering, it has not yet produced fundamentally new attack techniques.
“AI is adding scale and noise but not yet replacing attackers. While in the future GenAI could be the next accelerator, right now the fundamentals still matter: strong identity protection, reliable telemetry, and the ability to respond quickly when something goes wrong,” said Shier.
Defensive Takeaways
Based on the findings of the 2026 Active Adversary Report, Sophos recommends organizations:
- Deploy phishing-resistant MFA and validate its configuration
- Reduce exposure of identity infrastructure and internet-facing services
- Patch known vulnerabilities promptly, especially on edge devices
- Ensure 24/7 monitoring through MDR or equivalent capabilities
- Preserve and retain security logs to support rapid detection and investigation
The 2026 Sophos Active Adversary Report analyzed 661 IR and MDR cases handled between November 1, 2024 and October 31, 2025, spanning organizations across 70 countries and 34 industries.
You can read the full report here[SE1] . https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report
MTN Nigeria is accelerating investments in network expansion and modernization to address rising demand for mobile and data services across the country.
The operator is deploying additional base stations, upgrading existing infrastructure, and expanding fiber connectivity to improve network capacity, coverage, and service quality.
The investments are designed to support increasing smartphone adoption, higher data consumption, and the growing use of digital services by consumers and businesses.
MTN said the expansion aligns with its long-term strategy to enhance customer experience while strengthening Nigeria’s digital infrastructure.
The company expects the ongoing upgrades to improve connectivity, support economic growth, and enable broader access to reliable telecommunications services as demand for high-speed broadband continues to increase.
Airtel Africa’s CEO, Sunil Taldar, has announced the telco’s commitment to connecting 5,000 schools across its operating countries in Africa to the internet by 2027 through its philanthropic arm, Airtel Africa Foundation, in partnership with the United Nations Children’s Fund (UNICEF).
So far, the $57m partnership, which was launched in 2021, has cumulatively connected 3,296 schools and provided access to over 2 million learners and about 40,000 teachers. 64 digital learning platforms have been zero-rated thereby enabling more than 11m users to access educational content at no cost.
Speaking during a visit to St. Monica’s Girls School in Lusaka, which is one of the 300 schools already connected to the internet in Zambia, the Airtel Africa CEO stated that the initiative is having a profound impact on the quality of education by expanding access to digital learning resources for African children, in collaboration with governments.
Mr Taldar added: “Students are accessing best-in-class education from the curriculum developed by UNICEF in partnership with various Ministries of Education and provided through Airtel’s connectivity.
“We are also training teachers, so that they deliver digital education effectively. We aim to continue deepening meaningful connectivity in schools by providing free internet access, zero‑rated platforms and training teachers across the continent”.
Expressing her appreciation, the Headmistress of St. Monica’s Girls’ School, Sr Matilda Soloko said: “Being among the first schools connected in the initial stage, our learners have been able to study using the learning portal and their studies have been intensified. We remain grateful to Airtel and UNICEF.”
UNICEF’s Country Representative for Zambia, Dr Saja Farooq Abdullah said: “What this partnership has brought is really bridging the equality gap and the digital divide. It is making sure that every child learns wherever they are. It was exciting and interesting to see and hear from the girls how they can learn at their own pace, how they can review the materials, and how they do their homework with comfort.
The Director of Secondary Education in Zambia’s Ministry of Education, Yvonne Mwemba Chuulu lauded UNICEF and Airtel for the partnership saying: “At the Ministry of Education, we cannot do it alone, and we are grateful for the partnership that we have today.
“Our children are able to learn in a blended fashion, where we have a teacher who is also employing digital devices. We have also heard from the learners that they are able to access the portal when they are at home, which is a good thing because our learners continue to learn in the comfort of their homes”.
The School Connection programme is expanding digital learning to learners in 13 countries: Chad, Congo, Democratic Republic of Congo, Gabon, Kenya, Madagascar, Malawi, Niger, Nigeria, Rwanda, Tanzania, Uganda, and Zambia. By equipping these schools with internet connectivity and training teachers on using the digital tools, it is providing children, particularly in underserved and remote regions, with the digital tools and skills they need to thrive.
Airtel Africa Foundation is advancing inclusive development across four strategic pillars, Financial Inclusion, Education, Environmental Sustainability and Digital Inclusion.
MultiChoice has officially become a wholly owned subsidiary of French media company Canal+, marking the completion of one of the largest acquisitions in Africa’s media and entertainment industry.
The integration brings the South Africa-based pay television operator under the full ownership of Canal+, a global media group with operations in 70 countries.
Announcing the completion of the transaction on Thursday, Chief Executive Officer of Canal+ Africa and MultiChoice, David Mignot, described the development as the beginning of a new phase of growth for the broadcaster.
“MultiChoice is now a full subsidiary of a truly international media group operating in 70 countries.
“The group was founded in France, is listed in London and Johannesburg, and has a strong African presence with operations in more than 45 countries,” Mignot said.
The acquisition combines Canal+’s international operations with MultiChoice’s extensive footprint across sub-Saharan Africa, where it serves millions of households through its DStv and GOtv platforms, as well as the Showmax streaming service.
According to Canal+, the integration will strengthen MultiChoice’s competitive position by giving it access to broader financial resources, technology, content partnerships and operational expertise.
The company said the combined business would increase investment in local content production, sports broadcasting and streaming services as competition intensifies from global platforms such as Netflix, Amazon Prime Video and Disney+.
The transaction is also expected to provide MultiChoice with greater access to international markets at a time when traditional pay television operators are adapting to changing consumer viewing habits and the rapid growth of digital streaming platforms.
Canal+ has expanded steadily across Africa over the past decade and now assumes full control of a business operating in more than 45 African countries, further strengthening its position in the continent’s media and entertainment sector.
The acquisition followed Canal+’s gradual increase in its shareholding in MultiChoice, which began in 2024.
After exceeding the regulatory threshold, the company launched a mandatory offer in April 2024 to acquire the remaining shares of the Johannesburg-listed broadcaster.
Following regulatory approvals and shareholder acceptance, Canal+ secured control of MultiChoice in 2025 before completing the process that has now made the company a wholly owned subsidiary.
Industry observers describe the acquisition as one of the most significant media transactions involving an African company, reflecting a broader trend of consolidation as global entertainment firms seek greater scale to compete in the streaming era.
Police Busts Syndicate Who Allegedly Stole N3Bn from Financial Institution
MTN Accelerates Network Expansion to Meet Surging Telecom Demand
Court Remands Akujobi, Ex Access over alleged Theft of N294.5m
TeKnowledge, Equinix Partner to Advance Nigerian Digital Infrastructure
NSIB Faults Runway Identification, Reveals Cockpit Disagreement in Asaba Jet Incident
Nigeria Launches FreeTV Nationwide
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
NRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
Lebara Nigeria Launches Lebara Play, Africa’s First Telecom-Owned Micro-Drama Platform
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
Telecom3 days agoFixed Wired Internet Market Lags as Mobile Gains Ground
News3 days agoStudy Reveals How Moniepoint is Powering Nigeria’s $11Bn Food Service Sector
Broadcasting3 days agoBON Establishes Six Ad Hoc Committees to Modernize Broadcasting
Telecom2 days agoDStv, GOtv Owner MultiChoice Officially Joins Canal+ Group
News2 days agoPolice Busts Syndicate Who Allegedly Stole N3Bn from Financial Institution
E-Business3 days agoNew NIMC Act Strengthens Data Protection, Privacy – Director
General News3 days agoCourt Adjourns Alleged Binance Tax Evasion Case over Settlement Talks
E-Financial2 days agoSEC Unveils Plans to Enforce Mandatory ESG Reporting for Large Firms Next Year