Connect with us

Telecom

Abuse of Trusted Applications Grows by 51% in Latest Sophos Report

Published

on

John Shier, field CTO, Sophos
Kindly share this post

Sophos, a global leader in innovating and delivering cybersecurity as a service, today released “The Bite from Inside: The Sophos Active Adversary Report,” an in-depth look at the changing behaviors and attack techniques that adversaries used in the first half of 2024.

John Shier, field CTO, Sophos

John Shier, field CTO, Sophos

The data, derived from nearly 200 incident response (IR) cases from across both the Sophos X-Ops IR team and Sophos X-Ops Managed Detection and Response (MDR) team, found that attackers are leveraging trusted applications and tools on Windows systems, commonly called “living off the land” binaries, to conduct discovery on systems and maintain persistence.

When compared to 2023, Sophos saw a 51% increase in abusing “Living off the Land” binaries or LOLbins; since 2021, it’s increased by 83%.

Among the 187 unique Microsoft LOLbins detected in the first half of the year, the most frequently abused trusted application was remote desktop protocol (RDP). Of the nearly 200 IR cases analyzed, attackers abused RDP in 89% of them.

This dominance continues a trend first observed in the 2023 Active Adversary report in which RDP abuse was prevalent in 90% of all IR cases investigated.

“Living-off-the-land not only offers stealth to an attacker’s activities but also provides a tacit endorsement of their activities. While abusing some legitimate tools might raise a few defenders’ eyebrows, and hopefully some alerts, abusing a Microsoft binary often has the opposite effect. Many of these abused Microsoft tools are integral to Windows and have legitimate uses, but it’s up to system administrators to understand how they are used in their environments and what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk missing key threat activity that often leads to ransomware,” says John Shier, field CTO, Sophos.

In addition, the report found that, despite the government disruption of LockBit’s main leak website and infrastructure in February, LockBit was the most frequently encountered ransomware group, accounting for approximately 21% of infections in the first half of 2024.

Other key findings from the latest Active Adversary Report:

· Root Cause of Attacks: Continuing a trend first noted in the Active Adversary Report for Tech Leaders, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023

· Network Breaches Dominate for MDR: When examining solely the cases from the Sophos MDR team, network breaches were the dominant incident the team encountered

· Dwell Times Are Shorter for MDR Teams: For cases from the Sophos IR team, dwell time (the time from when an attack starts to when it’s detected) has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks

· The Most Frequently Compromised Active Directory Servers Are Nearing End of Life: Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. In addition, a full 21% of the AD server versions compromised were already EOL

To learn more about attacker behaviors, tools and techniques, read “The Bite from Inside: The Sophos Active Adversary Report,” on Sophos.com.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

NCC Orders Telcos Inform Subscribers of Data Breach within 48 Hours

Published

on

Kindly share this post

Nigerian Communications Commission (NCC) has directed telecom operators in the country to notify affected customers of any data breach within 48 hours ( that is two day) of detecting such unauthorised infringement.

NCC Orders Telcos Inform Subscribers of Data Breach within 48 Hours

This directive was  contained in the revised Internet Code of Practice 2026 by the NCC, on Friday.

The document seeks to define the rights and obligations of telecom operators in handing the rights of internet users to an open internet.

In the move to protect customer information, Mobile Network Operators (MNOs) and Internet Service Providers (ISPs) are to take necessary measures to protect customers’ data from unauthorised use, disclosure, access or breach.

Telecom operators must now notify affected customers within 48 hours of detecting a compromise through text message, email or any other effective means. As contained in Chapter 3.4 of the regulation titled “Data Breach Notifications,”

The telecoms companies are also directed to notify the NCC of such a breach not later than 48 hours after determining such a breach.

Where full details of the breach are not immediately available, the provider shall issue a preliminary notification within the same period and furnish a comprehensive update within Fourteen (14) days thereafter, or within such extended period as the Commission may approve,” part of the section reads.

The guidelines, according to NCC, are in tandem with the provisions contained in the Nigerian Data Protection Act 2023 and Part VI of Schedule 1 of the Consumer Code of Practice Regulations 2024.

The regulation also joins other agencies’ policies, ensuring protection. Agencies such as the Nigeria Data Protection Commission (NDPC) and the Federal Competition and Consumer Protection Commission (FCCPC) protect consumers against misuse of personal data, identity theft, financial loss, and reputation damage.

The review comes at a time when privacy becomes core amid frequent breaches and illegal harvest of data such as biometric, national IDs, financial information, traffic and usage, and others.

Regulations are necessary for the proper handling, consent, and regulatory compliance regarding sensitive data, ensuring it is only processed for legitimate purposes.

Under Chapter 3.5, the Internet Code of Practice 2026 addressed the handling of harvesting of transactional data by notifying and getting approval from the NCC of any usage by a third party. It noted that the NCC approval will be defined by a review and assessment of such access and “its potential effects on national considerations, consumer information and personal data.”


Kindly share this post
Continue Reading

Telecom

Globacom Promotes Valentine Gifting with Huge Discounts on Smartphones

Published

on

Kindly share this post

Globacom has announced a Valentine Smartphone promotion, which provides incredible savings on a variety of high-end smartphones from top manufacturers including Tecno, Samsung, and Infinix.

Starting on February 9, the promotion provides substantial price reductions on a number of Samsung models, including the Galaxy Z Fold 7, Galaxy A07, Galaxy A56 5G, Galaxy A36 5G, and Galaxy A26 5G. Customers who buy any of the phones will also receive a complimentary travel pouch and charger, as well as up to 18GB of extra data for six months, only available on the Glo network.

Along with other Infinix models, Tecno devices are also offered at attractive discounts, giving customers a large range of smartphones to fit a variety of tastes and price ranges.

The goal of the Glo Valentine promotion is to provide customers with the best possible deals on carefully chosen smartphones that are renowned for their cutting-edge technology, stylish designs, and dependable performance. The offer, which includes alternatives to suit a range of budgets and lifestyles, reaffirms Globacom’s dedication to customer happiness, digital adoption, greater data usage, and client centricity.

The company revealed that the promotion aligned with customers’ expectations during celebratory seasons, when demand is highest for quality smartphones at affordable prices. The company added that its partnership with trusted global and regional brands such as Samsung, Infinix, and Tecno ensures that customers enjoy premium features without compromising on value.

“The Valentine season is about connection, and what better way to stay connected than with a smartphone that fits your needs and aspirations,” the company stated. “This promo gives our customers the chance to get their dream smartphones at some of the best prices of the year, along with generous data bonuses to keep them connected,” the company disclosed.

Customers are encouraged to visit Gloworld outlets nationwide to take advantage of the Valentine Smartphone Promo while stocks last.

 


Kindly share this post
Continue Reading

Telecom

GBB Expands Broadband to 13 Underserved Communities In 2025

Published

on

Kindly share this post

Galaxy Backbone Limited (GBB) has recorded a significant milestone in Nigeria’s digital transformation journey by advancing broadband connectivity to 13 underserved institutions and communities nationwide in 2025, reinforcing its position as the nation’s digital backbone and a trusted partner in national development.

Guided by its mandate to enable a digitally inclusive Nigeria, GBB deliberately extended connectivity to locations within reach of its infrastructure footprint, particularly institutions with strong potential for productive use but limited readiness for immediate commercial engagement. Through this effort, the organisation continues to unlock opportunity, stimulate innovation, and support sustainable growth across critical sectors of the economy.

The expansion reached three Federal Universities, two Local Government Areas, and eight Federal Secretariats, strengthening digital capabilities in education and public administration while enhancing service delivery across the country.

GBB also extended reliable broadband connectivity to strategic and cultural landmarks such as the Nnamdi Azikiwe International Airport, Abuja, underscoring its commitment to supporting national infrastructure that drives economic activity, mobility, and global connectivity.

These deployments highlight Galaxy Backbone’s resolve to bridge the digital divide and empower institutions that shape Nigeria’s future. They demonstrate the measurable national impact of GBB’s infrastructure investments and reflect the tangible progress of the Integrated Digital Transformation Strategy (IDTS), further solidifying the organisation’s role as the platform upon which government institutions and communities can confidently build their digital future.

More importantly, the milestone illustrates that GBB’s work extends beyond technology by enabling education, improving governance, supporting economic participation, and connecting citizens to opportunity.

The initiative aligns with the Federal Government’s broadband penetration objectives and complements national programmes such as Project 774 – Universities’ Hostel Connectivity, ensuring coordinated, scalable, and sustainable impact across the country. Commenting on the achievement, Galaxy Backbone noted that every new connection brings Nigeria closer to a more inclusive digital economy while reinforcing the infrastructure required for innovation and national competitiveness.

As implementation continues, GBB remains committed to expanding access, pushing boundaries, and delivering on the promise of a fully digital nation, with further updates expected as additional phases of the deployment progress.

Galaxy Backbone Limited is the Federal Government’s digital infrastructure and shared services provider, dedicated to delivering secure, reliable, and scalable ICT solutions that support efficient governance, innovation, and sustainable national development.

 


Kindly share this post
Continue Reading

Trending