E-Business
Cyber Attackers Getting More Undetected in Target Networks – Sophos Report
New report released by Sophos has revealed that Cyber attackers are not only becoming sophisticated now, they are even getting more time undetected in target networks.
John-Shier, Senior-Security-Advisor-at-Sophos
Sophos, a global leader in next-generation cybersecurity, which released the “Active Adversary Playbook 2021,” detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020.
The TTP detection data also covers early 2021. The findings show that the median attacker dwell time before detection was 11 days – or 264 hours – with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
The playbook is based on Sophos telemetry as well as 81 incident investigations and insight from the Sophos Managed Threat Response (MTR) team of threat hunters and analysts and the Sophos Rapid Response team of incident responders.
The aim is to help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on their network.
Key findings in the playbook include:
- The median attacker dwell time before detection was 11 days – To put this in context, 11 days potentially provide attackers with 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
Considering that some of these activities can take just minutes or a few hours to implement – often taking place at night or outside standard working hours – 11 days offers attackers plenty of time to cause damage in an organization’s network.
It is also worth noting that ransomware attacks tend to have a shorter dwell time than “stealth” attacks, because they are all about destruction
- 90% of attacks seen involved the use of the Remote Desktop Protocol (RDP) – and in 69% of all cases, attackers used RDP for internal lateral movement – Security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access.
However, these don’t work if the attacker is already inside the network. The use of RDP for internal lateral movement is increasingly common in active, hands-on-keyboard attacks such as those involving ransomware
- Interesting correlations emerge among the top five tools found in victim networks. For instance, when PowerShell is used in an attack, Cobalt Strike is seen in 58% of cases, PsExec in 49%, Mimikatz in 33%, and GMER in 19%.
Cobalt Strike and PsExec are used together in 27% of attacks, while Mimikatz and PsExec occur together in 31% of attacks. Lastly, the combination of Cobalt Strike, PowerShell and PsExec occurs in 12% of all attacks.
Such correlations are important because their detection can serve as an early warning of an impending attack or confirm the presence of an active attack
- Ransomware was involved in 81% of the attacks Sophos investigated. The release of ransomware is often the point at which an attack becomes visible to an IT security team. It is, therefore, not surprising that the vast majoirty of the incidents Sophos responded to involved ransomware.
Other attack types Sophos investigated included exfiltration only, cryptominers, banking trojans, wipers, droppers, pen test/attack tools, and more
“The threat landscape is becoming more crowded and complex, with attacks launched by adversaries with a wide range of skills and resources, from script kiddies to nation-state backed threat groups. This can make life challenging for defenders,” said the Senior Security Advisor at Sophos, John Shier. “Over the last year, our incident responders helped to neutralize attacks launched by more than 37 attack groups, using more than 400 different tools between them. Many of these tools are also used by IT administrators and security professionals for their everyday tasks and spotting the difference between benign and malicious activity isn’t always easy.
“With adversaries spending a median of 11 days in the network, implementing their attack while blending in with routine IT activity, it is critical that defenders understand the warning signs to look out for and investigate. One of the biggest red flags, for instance, is when a legitimate tool or activity is detected in an unexpected place. Most of all, defenders should remember that technology can do a great deal but, in today’s threat landscape, may not be enough by itself. Human experience and the ability to respond are a vital part of any security solution.”
Other topics covered in the playbook include the tactics and techniques most likely to signpost an active threat and warrant closer investigation, the earliest signs of attack, the most widely seen stagers, threat types and malicious artefacts, the most prevalent adversary groups seen, and more.
To learn more about attacker behaviors, tactics, techniques and procedures (TTPs) read the Sophos Active Adversary Playbook 2021 on Sophos News.
The Federal Government of Nigeria has reaffirmed its commitment to building a responsible, inclusive, and sovereign artificial intelligence ecosystem to enable Nigeria to transition from being a passive consumer of AI technologies to an architect and builder of indigenous AI systems.
This was said by the Director General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi CCIE, while delivering a virtual address at the InnovateAI Conference held in Lagos.
The conference brought together policymakers, technology leaders, innovators, and stakeholders to discuss the future of artificial intelligence and its role in driving Nigeria’s digital economy and national development agenda.
Inuwa outlined Nigeria’s ambition to transition from being a consumer of artificial intelligence technologies to becoming a builder and owner of AI systems that reflect national values and priorities, in line with the National AI Strategy.
“Our goal is not just to use AI, but to architect and build our own AI systems in Nigeria,” he said, stressing that the country must take ownership of its AI future.
He noted that Nigeria’s approach to artificial intelligence extends beyond innovation to include governance, infrastructure, data sovereignty, and policy evolution.
According to him, “Responsible AI is never a finished job; it is an iterative journey. Our policies must evolve as the technology evolves, and we must avoid frozen laws by adopting living policies that adapt over time.”
He cited the implementation of the Digital Economy and E-Governance Bill as a key mechanism for generating insights that will help refine AI regulations and governance frameworks.
Inuwa also highlighted the challenge of data representation in global AI systems, noting that most models are trained on non-African datasets, which often results in bias against local dialects, cultures, and demographics.
“If a model shows bias against a local dialect or demographic, we cannot just patch it. We must reinvest in infrastructure to retrain it with inclusive and representative local datasets,” he stated.
He added that building national AI infrastructure is critical to achieving data sovereignty and ensuring that Nigeria is not merely an end user of foreign AI systems.
He further called for strategic partnerships with global technology companies and hyperscalers to build AI infrastructure in Nigeria while aligning with local values and national priorities.
“The world today is a global village. We need to work with global players, but they must understand our local nuances and help us build the infrastructure to retrain and develop AI models that reflect our context,” he said.
The NITDA Director General explained that adopting a comprehensive AI lifecycle approach, from responsible data collection and governance to deployment and continuous feedback, will enable Nigeria to move from reacting to AI developments to proactively designing indigenous AI systems.
“Without understanding how AI models are trained, how decisions are made, and how models are retrained, it will be difficult to build a responsible and trustworthy AI system,” he warned.
He reaffirmed that the Federal Government is intentional about promoting responsible AI and is working closely with the technology ecosystem to co-design national AI guardrails. He described platforms such as the InnovateAI Conference and other national AI dialogues as critical to shaping Nigeria’s AI future.
Mutual Benefits Assurance, a leading Nigerian insurance company, has paid a total of ₦5,937,665,353.57 in claims to policyholders in January 2026 alone, underlining its strong financial capacity and unwavering commitment to prompt claims settlement.
Mutual Benefits Assurance
A breakdown of the figures shows that ₦3,426,602,834.28 was paid under its General (Non-Life) Insurance portfolio, while ₦2,511,062,519.29 was paid across its Life businesses, including Group Life and Retail Life policies.
The significant payout within a single month reinforces Mutual Benefits’ reputation as a dependable insurer that honors its obligations swiftly and responsibly.
Commenting on the development, Olufemi Asenuga, Managing Director, Mutual Benefits Assurance Plc stated that claims settlement remains the core promise of insurance and the ultimate test of an insurer’s credibility.
“Insurance is built on trust. Our ability to settle over ₦5.9 billion in claims in one month demonstrates not only our financial strength, but also our deep commitment to our policyholders. At Mutual Benefits, we do not just sell policies. We stand by our promises,” he said.
With over three decades of operations, Mutual Benefits has consistently positioned itself as a strong and well-capitalised insurer.
The company operates both Life and General Insurance businesses and remains fully compliant with regulatory capital requirements as stipulated by the National Insurance Commission (NAICOM).
The January payout reflects Mutual Benefit’s robust underwriting standards, prudent risk management practices and efficient claims administration framework.
It also aligns with the company’s broader record of substantial claims settlement in recent years, reinforcing its standing as a trusted brand in the Nigerian insurance industry.
Mutual Benefits employs over 5,000 staff, managed by seasoned management team and an experienced Board of Directors. Industry observers note that prompt claims payment remains one of the most critical differentiators in Nigeria’s competitive insurance landscape.
By consistently settling valid claims without delay, Mutual Benefits continues to strengthen customer confidence, deepen market trust and expand its footprint across retail and corporate segments.
As the company begins 2026 on a strong footing, it reiterates its commitment to innovation, service excellence and delivering value to policyholders and stakeholders alike. Mutual Benefits Assurance focused on its mission to provide reliable risk protection solutions while maintaining the highest standards of professionalism and integrity.
National Information Technology Development Agency (NITDA) has issued an urgent cybersecurity warning about a serious Microsoft Office vulnerability (CVE-2026-21509) that attackers are actively exploiting.
This advisory, shared through Nigeria’s Computer Emergency Response Team (CERRT.NG), highlights the risks of this flaw and recommends immediate action to protect systems.
Microsoft has released quick security updates to fix this vulnerability, which has a severity score of 7.8, showing it is a serious risk. Attackers have already used it in targeted attacks.
CVE-2026-21509 affects multiple versions of Microsoft Office, including Office 2016, Office 2019, Microsoft 365 Apps, Office 2021, and later versions.
This flaw allows attackers to bypass security features meant to stop harmful Object Linking and Embedding (OLE) controls. OLE is an older Microsoft technology that can be used to embed links or content, but it has often been exploited by malware.
By exploiting this flaw, attackers can create specially designed Office documents.
When a user opens these documents, they can run malicious code or gain further access to the system.
Exploitation requires user interaction, meaning attackers often trick people into opening harmful Word, Excel, or other Office documents. Common methods include using email attachments or files from untrusted sources.
Because Microsoft confirmed that the vulnerability is being actively exploited, they have made emergency security updates available outside their usual schedule. Users and organisations should:
- Install the latest Microsoft Office security updates for all affected versions.
- Restart Office applications for Office 2021 and later to ensure that the updates take effect.
- Use registry-based settings for protection if updates can’t be applied right away.
- Follow good cybersecurity practices, like using endpoint protection and filtering emails.
Microsoft’s updates for Office 2021 and newer versions are automatically applied, but need a restart of the applications to be active.
ABoICT Lecture 2026 to Focus on Impact of AI, IoT on Business Operational Efficiency
Leo Stan @ 70: Blessed and Bruised by Country, Eyes Next Disruption
IXPN Positions as the Regional Internet Exchange Hub for West Africa
Pheelz Shares His Journey on Glo-Sponsored African Voices
AI-Driven Memory Chip Fuels Global Phone Price Surge
Nigeria’s 9 Top FinTech Firms Valued at $10.6Bn in January 2026
Kaspersky Launches OT Calculator to Align Cybersecurity Investments with Business Goals
CBN Upgrades Licences of Opay, Moniepoint, Kuda, Palmpay, Paga to National Status
NITDA, NBC Explore Strategic Collaboration on Digital Transformation, Media Regulation
Accidental Billionaire Opts for Jail Instead of Returning Money Credited Him by Mistake
Telecom2 days agoBanks, Telcos Settle Four-Year Dispute over N300Bn USSD Debt
General News1 day agoHow JustMarkets Is Empowering African Traders with Global Market Access
E-Financial2 days agoACAMB Educates Content Creator to Curb Misinformation on Bank Recapitalisation
Telecom1 day agoGroup Condemns Gabon’s Social Media Shutdown Amid Protests
General News2 days agoPalmPay Unveils First Batch of Winners in #LoveWithPalmPay Campaign
E-Financial2 days agoFirstCap MD says Payment Security Remains Biggest Barrier to Bankable Gas and Power Projects
E-Business1 day agoMutual Benefits Assurance Settles ₦5.9bn Claims in January 2026
General News2 days agoCourt Freezes MCSN Copyright Levies amid Record Label Legal Battle