Telecom
Abuse of Trusted Applications Grows by 51% in Latest Sophos Report
Sophos, a global leader in innovating and delivering cybersecurity as a service, today released “The Bite from Inside: The Sophos Active Adversary Report,” an in-depth look at the changing behaviors and attack techniques that adversaries used in the first half of 2024.
John Shier, field CTO, Sophos
The data, derived from nearly 200 incident response (IR) cases from across both the Sophos X-Ops IR team and Sophos X-Ops Managed Detection and Response (MDR) team, found that attackers are leveraging trusted applications and tools on Windows systems, commonly called “living off the land” binaries, to conduct discovery on systems and maintain persistence.
When compared to 2023, Sophos saw a 51% increase in abusing “Living off the Land” binaries or LOLbins; since 2021, it’s increased by 83%.
Among the 187 unique Microsoft LOLbins detected in the first half of the year, the most frequently abused trusted application was remote desktop protocol (RDP). Of the nearly 200 IR cases analyzed, attackers abused RDP in 89% of them.
This dominance continues a trend first observed in the 2023 Active Adversary report in which RDP abuse was prevalent in 90% of all IR cases investigated.
“Living-off-the-land not only offers stealth to an attacker’s activities but also provides a tacit endorsement of their activities. While abusing some legitimate tools might raise a few defenders’ eyebrows, and hopefully some alerts, abusing a Microsoft binary often has the opposite effect. Many of these abused Microsoft tools are integral to Windows and have legitimate uses, but it’s up to system administrators to understand how they are used in their environments and what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk missing key threat activity that often leads to ransomware,” says John Shier, field CTO, Sophos.
In addition, the report found that, despite the government disruption of LockBit’s main leak website and infrastructure in February, LockBit was the most frequently encountered ransomware group, accounting for approximately 21% of infections in the first half of 2024.
Other key findings from the latest Active Adversary Report:
· Root Cause of Attacks: Continuing a trend first noted in the Active Adversary Report for Tech Leaders, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023
· Network Breaches Dominate for MDR: When examining solely the cases from the Sophos MDR team, network breaches were the dominant incident the team encountered
· Dwell Times Are Shorter for MDR Teams: For cases from the Sophos IR team, dwell time (the time from when an attack starts to when it’s detected) has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks
· The Most Frequently Compromised Active Directory Servers Are Nearing End of Life: Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. In addition, a full 21% of the AD server versions compromised were already EOL
To learn more about attacker behaviors, tools and techniques, read “The Bite from Inside: The Sophos Active Adversary Report,” on Sophos.com.
The International Rescue Committee (IRC) has announced the formation of Airbel Ventures, a new humanitarian impact investing fund aimed at accelerating the introduction and scaling of breakthrough technologies in crisis-affected communities.
The fund will invest in companies whose ideas have the potential to change humanitarian response, including digital infrastructure for frontline health systems and climate-resilient agriculture.
The launch of Airbel Ventures follows a period of rapid innovation at the IRC, despite the humanitarian sector facing record funding cuts.
In the past year, the IRC’s Airbel Impact Lab has advanced more than twenty Artificial Intelligence (AI) and technology initiatives—from anticipatory action tools powered by climate and vulnerability data, to frontline service delivery using safe, orchestrated AI systems, to breakthrough diagnostic tools for emerging diseases.
Airbel Ventures’ first impact investment is in Signalytic, a company delivering solar-powered computing devices that ensure reliable electricity and connectivity for remote health facilities.
Following the investment, the IRC will pilot Signalytic’s technology with its Nigeria Health team, demonstrating the viability of next-generation digital infrastructure in humanitarian settings.
“We know breakthrough solutions already exist—what’s missing is the path to scale in humanitarian contexts,” said Dr. Jeannie Annan, Senior Vice President for Research & Innovation at the IRC and head of the Airbel Impact Lab.
MTN Nigeria, the country’s largest telecommunications operator, recorded a historic surge in network disruptions in 2025, suffering 9,218 fibre cuts as of December 31, alongside 211 base station sites affected by theft and vandalism, incidents that disrupted mobile and data services relied upon daily by millions of Nigerians.
The data was revealed by Dr Karl Toriola, chief executive officer/managing director, MTN Nigeria via a social media post titled ‘MTN Nigeria 2025 Wrapped’.
The scale of the damage highlights the growing vulnerability of Nigeria’s telecommunications infrastructure, which has come under increasing pressure from road construction activities, cable theft and deliberate acts of vandalism.
MTN said 5,478 fibre cuts occurred within just the first seven months of 2025, with 760 incidents recorded in July alone, underscoring the intensity of the challenge.
Some of the incidents had wide-ranging consequences, knocking out connectivity across multiple states simultaneously and affecting voice calls, data services, digital payments and enterprise operations.
The company described the situation as a national infrastructure problem, rather than an isolated corporate issue, given the economy’s deep dependence on mobile networks.
“These gaps were shaped by real operational challenges such as fibre cuts, theft, and vandalism. Their impact is felt directly by customers and reflected in what they tell us,” Toriola,
The disruptions were reflected in customer feedback volumes, as MTN handled an unprecedented number of complaints during the year. The operator said it resolved 1,624,263 customer complaints in 2025, spanning call centres, social media platforms, emails and physical service centres nationwide.
Despite the setbacks, MTN pointed to signs of operational resilience. The company retained its ranking as Nigeria’s best network by Ookla, returned to profitability after a challenging period, declared an interim dividend, and expanded its subscriber base to over 85 million users by September 2025.
The figures show that while Nigeria’s telecom operators continue to invest heavily in network expansion and customer service, infrastructure sabotage remains a major drag on service quality and operating costs.
MTN acknowledged that performance improvements remain a work in progress. “We are not where we want to be yet. We see you. We hear you. We exist because of you. And we will get better,” Toriola said.
As the company enters its 25th year of operations in Nigeria, Toriola said MTN is doubling down on customer-centricity, treating every piece of feedback as a guide for improvement, while also stepping up engagement with government agencies.
The CEO renewed calls for stronger regulatory and legal protections for telecommunications infrastructure, urging policymakers to classify fibre cables, base stations and other critical assets as national infrastructure and criminalise vandalism to deter repeat attacks.
Nigerian Communications Commission (NCC) has granted operating licences to six new Internet Service Providers (ISPs), effective January 1, 2026, raising the total number of authorised ISPs in the country to 231 from 225 recorded in December 2025.
NCC
The newly licensed firms are Intellvision Technologies Limited, Granet Technologies Limited, Fiber Sonic Limited, Dasol Solution Services Ltd, Boost ISP Limited, and Amazon Kuiper Nigeria Limited.
Five of these companies are headquartered in Lagos, while Granet Technologies Limited operates from Owerri in Imo State, highlighting the persistent concentration of broadband infrastructure in major commercial hubs like Lagos, Abuja, and Port Harcourt.
This development intensifies competition in Nigeria’s broadband market, which faces pressure from dominant mobile network operators such as MTN and Airtel, alongside rapid expansion by satellite providers like Starlink.
Traditional ISPs continue to grapple with shrinking customer bases, aggressive data pricing from telcos, and satellite disruptions, even as NCC data from Q2 2025 showed Spectranet, Starlink, and FibreOne controlling about 65 per cent of the 313,713 active ISP subscribers.
The inclusion of Amazon Kuiper Nigeria Limited marks a significant entry of global satellite broadband competition, building on Nigeria’s recent approvals for other low Earth orbit providers to enhance connectivity in underserved areas.
Industry analysts view the licences as a strategic push to improve internet quality amid rising demand for digital services, though geographic clustering underscores ongoing infrastructure challenges outside urban centres.
NCC’s move aligns with broader efforts to foster a competitive telecoms sector critical to Nigeria’s digital economy ambitions.
PalmPay User Shares Experience on Fintech Apps to Trust in Nigeria
Stakeholders Demand Stronger Governance and Infrastructure to Drive Tech Adoption @ Lagos AI Summit
Nigerians Target Self-Improvement, Business Startups in 2026 Google Data
35 Million Nigerians Face Acute Hunger in 2026, UN Warns
How Inside Jobs and Policy Shocks Trigger Nigeria’s Rising Loan Crisis
Banks quietly move to enforce new ₦50 transfer levy from Jan. 1
Jumia CEO says Black Friday Signals Nigeria’s E-Commerce Maturity
Galaxy Backbone Celebrates the Federal Government’s Paperless Civil Service Milestone
19 Nigerian Banks Meet CBN Recapitalization Targets Ahead of March Deadline
Nigeria’s Internet Usage Hits 1.24m Terabytes – NCC
E-Business3 days agoFirm Detected a Scam Exploiting OpenAI’s Teamwork Features
E-Financial3 days agoMoMo PSB Expands Cross-Border Transfers Across Africa
Broadcasting3 days agoDG NCC Tasks University Dons on Research Commercialization, IP Management to Build Global Competitive Ecosystems
E-Financial3 days agoBanks to Cut Fraud Response Times to Under 30 Minutes
Telecom3 days agoFG Expands 3MTT Programme Across the Country
News3 days agoFirms Face Gaps Between AI Ambition and Execution
Telecom3 days agoMTN Foundation Trains 2,000+ Young Nigerians in ICT for SME Growth
E-Financial1 day agoZenith Bank Gets Regulatory Approval for Full Takeover of Paramount Bank