E-Business
Global Hunt for Nigerian Spreading Computer Virus
A Nigerian allegedly working alone around Abuja has stirred a global hunt as he orchestrated numerous malware infection campaigns targeting more than 4,000 organisations globally over the past four months, a cyber security company claimed.
www.Securityweek.com quoting Check Point security researchers said the attacks targeted various companies in industries such as oil & gas, manufacturing, banking, and construction, in an attempt to steal data and commit fraud.
Many of the companies are leading international names and some have had their defenses breached by the attacks, the security researchers reveal.
According to Check Point, at least a dozen companies confirmed they have been infected during the campaign, including a marine and energy solutions company in Croatia, a transportation company in Abu Dhabi, a mining company in Egypt, a construction company in Dubai, an oil & gas firm in Kuwait, and a construction organization in Germany.
Despite the large scale campaign, behind it is not an expert gang of cybercriminals or a nation state actor, but “a relatively unskilled man in his mid-20s, operating from a location near the capital of Nigeria,” Check Point discovered.
Working on his own, the Nigerian uses fraudulent emails seemingly coming from oil and gas giant Saudi Aramco, the world’s second largest daily oil producer.
The phishing messages target financial departments within companies in an attempt to trick employees into revealing company bank details or into opening a malware-infected attachment.
The malware used in these attacks includes NetWire, a remote access Trojan that provides its operator with full control over infected machines, and Hawkeye, a software for logging key strokes (malware already associated with Nigerian cybercriminals).
The attacks eventually resulted in a total of 14 successful infections. The cybercriminal ended up earning thousands of dollars in the process, the researchers said.
Despite showing a low level of cyber-skills, using crude and unsophisticated fraudulent emails, with almost no research or social engineering involved in creating them, the attacker was successful in his attempts.
The attacker used generic email titles, phrased as “Dear Sir/Ms,” sent the same email to numerous targets, “all in blind carbon copy, urging victims to send back banking details, perhaps for future scams.”
He sent the emails from email addresses [email protected], and [email protected]. The fraudster used old, generic and readily available online malware, as well as freeware to ‘scrape’ email addresses from corporate websites and used them as targets for his campaigns.
“The fact that the campaign was still effective, despite using only basic cyber-criminal techniques, highlights just how much of a problem these business email compromise (BEC) attacks have become,” Check Point said.
Since uncovering the campaign and establishing its origins, Check Point’s research team has notified law enforcement authorities in Nigeria and internationally and shared its findings with them.
Checkpoint said the Nigerian in his 20s operates social media accounts, where you he uses the motto: ‘get rich or die trying’.
His attack campaign uses fraudulent emails which appear to originate from oil and gas giant Saudi Aramco, the world’s second largest daily oil producer, targeting financial staff within companies to trick them into revealing company bank details, or open the email’s malware-infected attachment. Last year, the FBI revealed that losses caused by BEC scams exceeded $3.1 billion.
Victims are estimated to lose between $25,000 and $75,000 on average, per attack. However, it’s not only financial losses that victims should be concerned about, but also the fact that “the malware used by the criminal to infect organizations gives remote control over infected machines, and can perform keylogging functions.
This enables harvesting of a variety of information from infected machines, such as details on the companies’ operations, assets and intellectual property.” Such details could be worth much more than the thousands of dollars obtained by fraud, Check Point says.
Another alarming aspect was that some of the targets are energy and infrastructure companies, which the unsophisticated cybercriminal was able to easily breach.
Not only was the attacker able to compromise the networks of several large organizations, but he also managed to distribute his malware globally and remain under the radar for a long while.
“This highlights the need for all organizations to improve their security to protect against phishing and business email compromise scams, and to educate their employees to be cautious about opening emails, even from companies or individuals that they recognize,” Check Point said.
.
National Identity Management Commission (NIMC) has said thet more than 136 million Nigerians and legal residents have been enrolled in the National Identity Database (NIDB).
In a statement on Tuesday, Kayode Adegoke, head of corporate communications, NIMC, said Abisoye Coker-Odusote, chief executive officer (CEO) of the commission, announced the milestone during a courtesy visit to the ministry of budget and economic planning.
In April 2025, NIMC said over 117.36 million Nigerians had been enrolled as of February 28, 2025.
The visit was part of the commission’s ongoing stakeholder engagements with ministries, departments and agencies (MDAs) on the implementation of the NIMC Act 2026.
Presenting the new Act, Coker-Odusote said the legislation repeals and replaces the 2007 NIMC Act, modernising Nigeria’s digital identity ecosystem by positioning the national identification number (NIN) as the country’s foundational identity under the “one person, one identity” policy.
She said the law also establishes NIMC as the root certificate authority for the national digital infrastructure and introduces stronger data protection and cybersecurity measures, as well as digital credentials.
“The Federal Government remains committed to enrolling and issuing NINs to all Nigerians and legal residents within the shortest possible time,” Coker-Odusote said.
She added that NIMC is ready to collaborate with the ministry of budget and economic planning to leverage the NIN for economic planning and national development initiatives.
Speaking during the visit, Abubakar Atiku Bagudu, the minister of budget and economic planning, reaffirmed the federal government’s commitment to the implementation of the NIMC Act 2026.
Bagudu described the legislation as “a transformative milestone” that would strengthen Nigeria’s digital identity ecosystem and accelerate national planning and development.
He commended the NIMC director-general and the commission’s leadership for their efforts in securing the passage of the legislation, noting that it provides “a solid legal foundation for a trusted, secure, and inclusive national identity management system”.
The minister, however, said the true measure of the Act’s success would lie in its implementation and the benefits it delivers to Nigerians.
“The true measure of the Act’s success will lie in its effective implementation and the tangible benefits delivered to citizens,” he said.
Bagudu also called for stronger collaboration across the federal, state and local governments to build public confidence in the national identity system and eliminate the duplication of identity databases across government institutions.
He said the NIN should serve as Nigeria’s single, universally accepted identity standard, supporting efficient service delivery and good governance.
On June 26, President Bola Tinubu signed the NIMC Act 2026 into law, repealing the commission’s 2007 establishing Act.
At the time, Olubunmi Tunji-Ojo, minister of interior, said the legislation would strengthen Nigeria’s legal framework for digital identity management, cybersecurity and secure digital authentication, while reinforcing the NIN as the country’s foundational identity credential under the “one person, one identity” principle.
Plateau State Public Complaints Commission (PCC), an agency of the state established to investigate complaints of abuse of office, administrative injustice and other forms of official misconduct is allegedly collecting personal information from members of the public through its website with no privacy policy.
According to investigation by Foundation for Investigative Journalism (FIJ), PCC is falling short of a key transparency requirement under Nigeria’s data protection laws.
FIJ found on Tuesday that PCC collects personal information from members of the public through its website despite providing no privacy policy explaining how that information is collected, processed, stored or protected.
The commission serves as the state’s ombudsman, receiving complaints free of charge against public institutions and private organisations on issues including wrongful dismissal, victimisation and administrative negligence.
Yet, while its online complaint portal requests personal information such as names, phone numbers, email addresses, subject lines and complaint details, visitors are given no privacy notice explaining what becomes of that information after it is submitted.
The omission means visitors are not told why their information is being collected, how long it will be retained, the legal basis for processing it or the rights available to them as data subjects.
WHAT IS THE POSITION OF THE LAW?
The guidelines issued by the National Information Technology Development Agency (NITDA) are explicit: every government website is required to have a privacy policy.
Section 10.4 (i, ii) of the NITDA guidelines mandates all government websites to exercise diligence when collecting personal details or information about visitors on their websites.
The requirement is intended to ensure transparency and accountability in the handling of personal information, allowing visitors to understand why their data is collected, how it will be used and the safeguards in place to protect it.
Similarly, the Nigeria Data Protection Act (NDPA) 2023 requires data controllers to provide privacy notices to individuals before, or at the point of, collecting their personal information.
Such notices are expected to disclose, among other things, the purpose for collecting the data, the legal basis for processing it, the period for which it will be retained and the rights available to data subjects.
Section 27 of the NDPA states:
(1) Before a data controller collects personal data directly from a data subject, the data controller shall inform the data subject of the – (a) identity, residence or place of business of, and means of communication with the data controller and its representatives, where necessary;
(b) specific lawful basis of processing under section 25(1) or 30(1) of this Act, and the purposes of the processing for which the personal data are intended;
(c) recipients or categories of recipients of the personal data, if any;
(d) existence of the rights of the data subject under Part VI;
(e) retention period for the personal data;
(f) right to lodge a complaint with the Commission in accordance with section 46 (1) of this Act; and
(g) existence of automated decision-making, including profiling, the significance and envisaged consequences of such processing for the data subject, and the right to object to and challenge such processing.
Without a privacy policy, visitors have no way of knowing the commission’s data-handling practices or the safeguards, if any, in place to protect the personal information they submit through the website.
At press time, the Plateau State Public Complaints Commission’s website had no privacy policy.
Federal government has directed key digital regulators to suspend the implementation of new rules affecting internet platforms and online intermediaries while it develops a unified national regulatory framework.
Dr Bosun Tijani, minister of Communications, Innovation and Digital Economy
The directive was issued on Tuesday by Dr Bosun Tijani, minister of Communications, Innovation and Digital Economy, after chairing a strategic meeting with the leadership of the Nigerian Communications Commission (NCC), the National Information Technology Development Agency (NITDA), and the Nigeria Data Protection Commission (NDPC).
The minister in a statement, said that the rapid growth of the digital economy has created areas where the responsibilities of the three regulators increasingly overlap, particularly in artificial intelligence, online safety, and data protection.
He said that a coordinated approach is needed to provide regulatory clarity, protect investor confidence, and support innovation.
Dr Tijani noted that as part of the directive, the agencies will temporarily halt the implementation of recently introduced guidelines in these overlapping areas.
However, the Minister said that they will continue to carry out their statutory responsibilities within their respective legal mandates.
Dr Tijani said that a Joint Technical Coordination Committee will now be established to work with industry players, academics, and civil society on a single, coherent regulatory framework.
The minister added that the move is designed to improve coordination across government, create a more predictable business environment, and strengthen Nigeria’s position as a leading destination for digital investment in Africa.
Court Declares ARCON’s N60Bn Fine against Facebook Nigeria Illegal
NIN Enrollment Hits over 136m as New ID Law Takes Effect
NRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
Plateau PCC Collects Nigerians’ Data without Privacy Policy – FIJ
FG Suspends New Internet Regulations to Prevent Overlapping Rules
Mobile Internet Gender Gap Widest in Africa – GSMA
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Nigeria Launches FreeTV Nationwide
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
UK, Nigeria Launch £15m Growth Programme to Accelerate Economic Transformation
E-Financial2 days agoTokenization, Blockchain Technology will Transform Financial Institutions – IMF
General News2 days agoNIS Deploys Advanced Surveillance Masts, other Critical Infrastructure to Boost Border Security
Broadcasting2 days agoObi, NDC Presidential Candidate Faces N50Bn Defamation Claim over Alleged Podcast Remark
E-Business2 days agoWeebly Websites to Shut Down for Nigeria, 66 Other Countries from September
General News1 day agoIHS Nigeria, FCT-HSES Concludes Clean Cooking Energy Campaign “Project Breathe Clean Air” in Abuja
E-Financial2 days agoFG Denies N8 Trillion ‘Shadow Budget’, Says IMF Quoted out of Context
Telecom2 days agoNo Plans for Fresh Tariff Hike – MTN
News2 days agoWorld Bank Sounds Alarm: Low Revenue, Not Debt, Is Nigeria’s Biggest Fiscal Threat