E-Business
Sophos Releases Scaring 2016 Cyber Security Predictions

In the ever changing and increasingly complex landscape of cyber security, Sophos experts offer their top predictions for 2016: Android Threats Will Become More Than Just Headline-Grabbers
Next year will see an increase in the number of Android exploits becoming weaponized (as opposed to bugs like Stagefright which was heavily reported earlier in 2015 but was never fully exploited).
There are significant vulnerabilities on the Android platform which can take months to patch. Although Google claims that nobody has actually exploited these vulnerabilities to date, it will ultimately be an invitation too tempting for hackers to ignore.
SophosLabs has already seen samples that go to extreme lengths to avoid App Store detection and filtering—giving Apps a better chance of surviving on App stores.
For example, some hackers will design an App that loads harmless games if it thinks it is being tested, but then loads the malicious payload when it detects it is ‘safe’ to do so.
And more recently, we saw mobile users using third- party app markets, being tricked into granting malicious apps from the adware family Shedun with control over the Android Accessibility Service.
Once they’ve handed over control the app has the ability to display popups that install highly intrusive adware, even if a user has rejected the invitation to install it. Because the apps root the device and embed themselves into the system partition they can’t easily be uninstalled.
Android malware can be complicated and consumers cannot necessarily trust the App Store to detect these vulnerabilities in every instance.
Will 2016 Be The Year iOS Malware Goes Mainstream?
We’ve already seen the Apple App Store get hit a few times this year, once with the InstaAgent app, which snuck through the vetting processes and which both Google and Apple pulled from their respective app stores, and before that, with XcodeGhost, which tricked Apple app developers into incorporating the code into their apps, thereby infecting them but cleverly hidden behind what looked like Apple code.
With more and more apps coming onto the market (both Apple and Google have more than a million apps each in their official marketplaces to date), it is not hard to imagine more criminals trying their hand at getting past the existing vetting processes.
Nevertheless, the nature of Android, in particular support for the flexibility of third party markets will continue to contribute towards Android being an easier target than iOS.
IoT Platforms – not yet the weapon of choice for commercial malware authors – but business beware
Every day, more and more technology is being incorporated into our lives. Internet of Things devices are connecting everything around us and interesting new use cases are appearing constantly.
IoT will continue to produce endless scary stories based on the fact that these devices are insecure (early 2015 saw many stories focusing on webcams, baby monitors and children’s toys and latterly cars have become a hot topic – researchers hacked a jeep in July).
However, we won’t see widespread examples of attackers getting IoT devices to run arbitrary code any time soon. Because they are not general purpose computing devices with the same broad suite of interfaces that we have on desktops/mobiles, IoT devices are relatively protected.
What we will see is more research and PoCs demonstrating that non-vendor code can be installed on these devices because of insufficient validations (lack of code-signing, susceptibility to MitM-class exploitations) by the IoT vendors.
Sophos said that we can expect an increase in data-harvesting/leakage attacks against IoT devices, wherein they are coaxed to disclose information that they have access to, e.g. video/audio feeds, stored files, credential information for logging into cloud services, etc.
And as IoT devices evolve in their utility and ability to interact with their surrounding, i.e. as they become “roboticized” – an app-controlled Roomba for example – the set of security concerns around IoT will start becoming very similar to the set of security concerns around SCADA/ICS, and the industry should look toward the best guidance that NIST, ICS-CERT and others have formulated.
SMBs Will Become A Bigger Target For Cybercriminals
Throughout 2015, the focus has been on the big glamorous hacking stories like Talk Talk and Ashley Maddison, but it’s not just big businesses that are being targeted.
A recent PwC report revealed that 74% of SMBs experienced a security issue in the last 12 months, and this number will only increase due to SMBs being perceived as ‘easy targets’.
Ransomware is one area where criminals have been monetizing small businesses in a more visible way this year.
Previously, payloads – such as sending spam, stealing data, infecting websites to host malware – were far less visible so that small businesses often didn’t even realize they had been infected. Ransomware is highly visible and has the potential to make or break an SMB if they do not pay the ransom.
This is why, of course, criminals are targeting SMBs. Expect to see this ramp in 2016.
Lacking the security budgets of large enterprises, SMBs often apply a best-effort approach to security investments, including equipment, services, and staffing.
This makes them vulnerable as hackers can easily find security gaps and infiltrate the network. On average, a security breach can cost a small business anywhere up to £75,000 – a significant loss for any business. It’s important therefore that SMBs take a consolidated approach to security.
This requires a thoughtfully planned out IT strategy to prevent attacks before they happen. Installing software that connects the endpoint and the network will mean a comprehensive security system is in place where all components communicate, and ensure there are no gaps for hackers.
Data Protection Legislation Changes Will Lead To Increased Fines For The Unprepared
In 2016, the pressure on business to secure customers’ data will increase as the EU data protection legislation looms closer. In future, business will face severe penalties if data isn’t robustly secured. This will have a far reaching impact for how businesses deal with security, including the high risk area of employee personal devices.
Two major changes will be the EU General Data Protection Regulation (GDPR), and the Investigatory Powers Bill in the UK. The EU Data Protection regulation will come fully into force across Europe by the end of 2017, so companies need to start preparing in 2016.
It has numerous components, but one key takeaway is that European businesses will now be held responsible for the protection of the data they process, including cloud providers and other third-parties.
In the UK, the Investigatory Powers Bill will modernise laws surrounding communications data. This will give the police and other intelligence bodies the ability to access all aspects of your communications on ICTs, whether you are suspected of a criminal offence or not.
As this is due to go ahead in 2016, it will be interesting to see how this bill is shaped and shifted, and if people will start prioritising data security.
In the US, data protection is complicated by the fact there is no single overarching law. This has the effect that data protection tends to be less strict than in Europe, which has led to issues around the Safe Harbor agreement.
Over time the US and Europe will hammer out their differences, but it seems unlikely that we will see a new agreement any time soon.
VIP Spoofware Is Here To Stay
We’ll see a growth in the use of VIP spoof wire transfers as we move into 2016. Hackers are becoming increasingly talented at infiltrating business networks to gain visibility of personnel and their responsibilities, and then using this information to trick staff for financial gain.
For example, sending an email to the finance team that appears to be from the CFO requesting the transfer of significant funds. This is just one of the ways we’ll see criminals continue to target businesses.
Ransomware Momentum
Ransomware will continue to dominate in 2016 and it is only a question of time before we see things beyond data being ransomed.
It is perhaps some time off before we have a sufficient mass of internet-enabled cars or homes, but we should be asking the question: how long before the first car or house is held for ransom? Attackers will increasingly threaten to go public with data, rather than just taking it hostage and we have already seen websites being held ransom to DDoS.
Many Ransomware families are using Darknets for either command or control, or for payment page gateways, as we saw with the likes of CryptoWall, TorrentLocker, TeslaCrypt, Chimera, and many more in 2015.
Social Engineering Is On The Up
As cybersecurity comes to the fore and social engineering continues to evolve, businesses will invest more in protecting themselves from such psychological attacks.
They will achieve this through investing in staff training, and ensuring there are strict consequences for repeat offenders.
Employees need to be trained on how to be security savvy when on the company network.
Basic tips we would recommend incorporating into training include: Teaching staff about the implications of a phishing email and how to identify one; Ensuring staff don’t click on malicious links that might be found in unsolicited emails; Encouraging staff to be wary that mis-spelt emails could be a sign of a scam; and to watch out for sites that ask for sensitive information, such as card PIN and national insurance number.
Another golden rule is never to share a password. Each of us can help here by sending a signal to the market: let the providers who store your most valuable data (your bank, your health insurance company, your payroll management service, etc.) know that you demand strong security.
If they don’t give you the option to use multi-factor authentication, ask them why not? Or better still, just switch to a provider who does.
Both Bad And Good Guys Will Be More Coordinated
The bad guys will continue to use coordinated attacks but the cyber security industry will make significant strides forward with information sharing.
For some time the bad guys have been coordinating and collaborating, re-using tactics and tools, and generally keeping one step ahead of the cyber security industry.
But the industry is now evolving and we expect to see the promising activity that has begun around information sharing and workflow automation continue and begin to deliver big differences in 2016 and onward.
Commercial Malware Authors Will Continue To Invest Heavily
Commercial malware authors will continue to reinvest at ever greater rates, bringing them towards the ‘spending power’ of nation-state activity. This includes purchasing zero days. These bad guys have lots of cash and they are spending it wisely.
Exploit Kits Will Continue To Dominate On The Web
Exploit kits, like Angler (by far the most prevalent today) and Nuclear, are arguably the biggest problem we have on the web today as far as malware goes and this looks set to continue thanks to the thousands and thousands of poorly secured websites out there on the internet.
Cyber criminals will exploit where they can most easily make money and therefore exploit kits have simply become stock tools of the trade, used by criminals to attempt to infect users with their chosen malware.
E-Business
FG Seeks Inclusive, Human-centred Artificial Intelligence Policies

The Federal Government has called for the development of inclusive and human-centred artificial intelligence policies that protect workers’ rights and prevent job losses while harnessing the technology’s potential to drive economic growth and productivity.

The Minister of Labour and Employment, Dr. Muhammad Dingyadi, made the call during the 114th Session of the International Labour Conference in Geneva, Switzerland, while responding to the report of the Chairperson of the Governing Body and the Director-General of the International Labour Organisation, titled “A Moment of Choice: Harnessing Artificial Intelligence for Decent Work,” on Thursday.
Dingyadi said the rapid advancement of AI is transforming labour markets, workplace practices and employment relationships globally, creating both opportunities and challenges for governments, employers and workers.
He noted that while AI can stimulate innovation, improve productivity and expand economic opportunities, it also poses significant risks, including job displacement, widening inequalities and the erosion of the human role in some sectors of the economy.
“The world is moving forward at a rapid pace, underpinned by advances in AI, and we as an organisation must match that pace. While welcoming the positive transformations AI offers, we are also pondering the uncertainties it connotes.
“These shifts, despite their benefits, also cast a dark cloud of uncertainty. Where AI creates new jobs, there may be job losses. Where digital and AI infrastructures are created, there may be a loss of the traditional role and value of the human factor in the work process. We therefore need a balanced approach that ensures that, while harnessing the benefits of AI, the attendant risks do not rob our societies of the gains of decent work,” he said.
The minister commended the ILO leadership for its commitment to advancing the organisation’s mandate despite mounting global economic and social challenges.
Highlighting Nigeria’s efforts to position itself within the rapidly evolving digital economy, Dingyadi said the Federal Government had established the Ministry of Communications, Innovation and Digital Economy to spearhead policies aimed at accelerating technological development and strengthening the country’s competitiveness.
According to him, Nigeria has already begun integrating digital technologies and AI into governance systems through the automation of civil service processes and public service delivery.
“I’m also pleased to inform you that Nigeria is steadily harnessing the gains of this initiative in our Public Service. There is the service-wide automation of civil service processes and communication with AI playing a significant role. Additionally, platform work is gaining ground,” he said.
The minister also welcomed ongoing discussions within the ILO on regulating work in the platform economy, stressing the need for labour standards that protect workers engaged in emerging forms of employment created by digital technologies.
Beyond AI, Dingyadi reiterated Nigeria’s longstanding call for reforms within the ILO, urging member states to accelerate the ratification of the 1986 Amendment to the organisation’s Constitution and review the criteria used to determine countries of Chief Industrial Importance.
He argued that such reforms would promote greater inclusivity, fairness and regional representation within the ILO’s governance structures.
The minister further urged countries to align the ILO Centenary Declaration and the Global Coalition for Social Justice with national development priorities to ensure that technological innovation contributes to social progress and decent work.
Nigeria’s intervention comes amid growing global debate over the impact of artificial intelligence on jobs and the future of work.
According to international labour and development agencies, AI is expected to automate some routine tasks while simultaneously creating new employment opportunities in technology, data science, digital services and other emerging sectors.
However, concerns persist that workers in administrative, clerical and repetitive occupations could face significant disruptions if governments fail to implement policies that support skills development, social protection and workforce transition.
The issue has become a central focus of discussions at the ongoing International Labour Conference, where governments, employers and workers’ representatives are examining how AI can be deployed in ways that promote productivity and economic growth without undermining labour rights, job security and social justice.
For Nigeria, the conversation is particularly significant as the country pursues an ambitious digital transformation agenda aimed at expanding broadband access, growing the digital economy and creating millions of technology-driven jobs for its youthful population.
Experts have repeatedly stressed that achieving these goals will require investments in digital skills, education and worker protections to ensure that the benefits of AI are broadly shared across society.
E-Business
Kaspersky Reveals Credential Abuse Techniques Rank as Attackers’ Most Effective Tactic

According to a recent global report by Kaspersky Security Services, password guessing and valid account misuse rank among the most effective tactics used by cyber criminals in 2025.

This trend reflects a strategic shift, as attackers move away from triggering endpoint protection with noisy malware, in preference of leveraging legitimate access to evade detection.
The ‘Anatomy of a Cyber World’ is an in-depth global report based on data gathered from Kaspersky Managed Detection and Response (MDR), Incident Response (IR), Compromise Assessment and SOC Consulting in 2025. It covers the most common adversary techniques, tools and detection scenarios and highlights the peculiarities of detected incidents.
According to the report, a significant portion of the most frequently monitored attack techniques revolves around credentials and identity management. This analysis, which examines the conversion rates* of various Indicators of Attack (IoA), highlights the following prevalent malicious tactics:
Password guessing – 34.8%. This technique entails attackers systematically trying different passwords until successfully gaining access to an account. It tops the conversion list due to its occurrence in both actual attacks and authorised security assessments, making it a persistent threat in today’s cybersecurity landscape. Organisations who rely on weak or reused passwords continues to enable this age-old strategy.
Local account creation – 34.7%. Once inside a system, attackers frequently create new local accounts to maintain access even if their original foothold is discovered and removed. This technique is frequently observed during security exercises and can be detected — but only with the right telemetry in place, which is often lacking.
Valid account abuse – 34.5%. Instead of deploying malware, attackers log in using stolen or compromised credentials and simply blend in with normal user activity. This makes detection significantly harder, as the access itself appears legitimate. The high conversion rate underscores why compromised credentials remain one of the most dangerous attack vectors.
Account manipulation – 32%. Attackers modify existing accounts to consolidate access such as by activating disabled accounts, altering group memberships, or escalating privileges. This reinforces the broader pattern — rather than introducing new tools, adversaries deepen their control using what is already there.
Network service discovery – 31.2%. Before moving deeper into a network, attackers typically scan for open services and systems they can reach. This reconnaissance step is a strong predictor of what follows: lateral movement and further exploitation. Detecting it early provides security teams a critical window to intervene.
The report ranks attacker techniques by how frequently observed activity ultimately resulted in confirmed malicious incidents. According to Kaspersky experts, while MITRE ATT&CK® catalogs a vast number of adversary techniques, effective detection requires prioritising behaviours with the highest probability of malicious intent while avoiding excessive false positives.
“Threat actors do not always need sophisticated malware to achieve their objectives. In many cases, legitimate administrative tools and compromised accounts remain the fastest and most effective way to move inside an organisation while avoiding detection.
The continued popularity of these techniques shows that organisations need deep visibility into attacker behaviour and the ability to correlate suspicious activity across different stages of an attack.
To address these challenges, companies can enhance their security with our solutions: Kaspersky Managed Detection and Response and Incident Response which cover the entire incident management cycle – from threat detection to continuous protection and remediation,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.
E-Business
INEC Probes Claims of Leaked Voter Data from CVR System

Independent National Electoral Commission (INEC) has started looking into reports of unauthorized access to its Continuous Voter Registration (CVR) database, according to Mohammed Kudu Haruna, national commissioner and chairman of the Information and Voter Education Committee (IVEC),

Haruna, in a statement on Tuesday said that was aware of the allegations spreading on social media and in some news outlets.
“The Independent National Electoral Commission is aware of rumors currently circulating on social media and in certain media about unauthorized access to the Commission’s Continuous Voter Registration (CVR) database.
These claims include the publication of information about a candidate from recent political party primaries in the Federal Capital Territory.
“The Commission takes this allegation very seriously and has quickly begun a thorough investigation to find out what really happened,” the statement noted.
INEC clarified that during the ongoing nationwide CVR process, registered officers were given limited access to specific parts of the registration system.
This access helps them manage voter registrations, transfer requests, and updates to voter records.
The commission stated that access to the information is only allowed for official duties and is taken away once the task ends.
Haruna revealed that initial findings from the commission’s audit trail helped pinpoint the user account used to access the information.
“The audit trail from our early investigation has allowed us to find out which user account was involved. As a result, we’ve questioned relevant staff, and all departments related to this matter are fully cooperating with the investigation,” it mentioned.
The commission also said it is looking into all technical, administrative, and operational details of the situation to figure out who is responsible and whether any internal access-control rules were broken.
However, INEC reported that its early findings indicated there was no outside breach of its systems.
Advertisement
“Our initial findings from the audit trail suggest that there was no external breach of the CVR database, no hacking incident, and no unauthorized outside access to our ICT systems.”
“Instead, the information in question was accessed using valid user credentials assigned to personnel involved in the ongoing CVR exercise but was released without proper authorization,” added the statement.
The commission emphasized that this incident involved retrieving a specific voter record and did not indicate any risk to the overall voter registration system or the personal data of over 90 million registered voters.
“The investigation is focused on the retrieval of a specific voter record and does not suggest any risk to the overall voter registration system or the personal data of over 90 million registered voters, according to the statement.
INEC emphasized that it is dedicated to safeguarding voter information and ensuring the integrity of its electoral systems.
“The Commission clearly states that it takes the security, privacy, and integrity of voter data very seriously. It remains committed to transparency, institutional integrity, and protecting voters’ personal details,” the statement noted.
The commission also announced that the Department of State Services has started its own investigation into this issue.
“Additionally, the Department of State Services has independently begun an investigation. The Commission will fully cooperate with all relevant security agencies and will not hesitate to take legal action against anyone found responsible,” the statement continued.
INEC encouraged the public and media to refrain from making assumptions while investigations are ongoing, promising that it will share its findings and any actions taken in due time.
Telecom3 days agoAba to Host MTN’s “The Gathering” with Pitchathon Offering ₦5 Million Prize Pool for Emerging Startup Founders
General News3 days agoPalmPay Young Star Awardee Hopes to Become a Governor
Telecom3 days agoMeta Unveils AI-Powered Business Agent to Support Customer Engagement
Telecom3 days agoData on Trial: MTN Opens Its Books to Public Scrutiny Over Data Consumption
News3 days agoJapan, UNESCO Boost Digital Learning in 15 CoEs with Donation of ICT Equipment
E-Business3 days agoKaspersky Reveals Credential Abuse Techniques Rank as Attackers’ Most Effective Tactic
Telecom3 days agoDigital Encode Calls for Immediate Action as Cyber Threats Escalate Nationwide
Telecom3 days agoNITDA DG Highlights Nigeria’s Digital Infrastructure Strategy at Datacloud Global Congress 2026













