Telecom
Abuse of Trusted Applications Grows by 51% in Latest Sophos Report
Sophos, a global leader in innovating and delivering cybersecurity as a service, today released “The Bite from Inside: The Sophos Active Adversary Report,” an in-depth look at the changing behaviors and attack techniques that adversaries used in the first half of 2024.
John Shier, field CTO, Sophos
The data, derived from nearly 200 incident response (IR) cases from across both the Sophos X-Ops IR team and Sophos X-Ops Managed Detection and Response (MDR) team, found that attackers are leveraging trusted applications and tools on Windows systems, commonly called “living off the land” binaries, to conduct discovery on systems and maintain persistence.
When compared to 2023, Sophos saw a 51% increase in abusing “Living off the Land” binaries or LOLbins; since 2021, it’s increased by 83%.
Among the 187 unique Microsoft LOLbins detected in the first half of the year, the most frequently abused trusted application was remote desktop protocol (RDP). Of the nearly 200 IR cases analyzed, attackers abused RDP in 89% of them.
This dominance continues a trend first observed in the 2023 Active Adversary report in which RDP abuse was prevalent in 90% of all IR cases investigated.
“Living-off-the-land not only offers stealth to an attacker’s activities but also provides a tacit endorsement of their activities. While abusing some legitimate tools might raise a few defenders’ eyebrows, and hopefully some alerts, abusing a Microsoft binary often has the opposite effect. Many of these abused Microsoft tools are integral to Windows and have legitimate uses, but it’s up to system administrators to understand how they are used in their environments and what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk missing key threat activity that often leads to ransomware,” says John Shier, field CTO, Sophos.
In addition, the report found that, despite the government disruption of LockBit’s main leak website and infrastructure in February, LockBit was the most frequently encountered ransomware group, accounting for approximately 21% of infections in the first half of 2024.
Other key findings from the latest Active Adversary Report:
· Root Cause of Attacks: Continuing a trend first noted in the Active Adversary Report for Tech Leaders, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023
· Network Breaches Dominate for MDR: When examining solely the cases from the Sophos MDR team, network breaches were the dominant incident the team encountered
· Dwell Times Are Shorter for MDR Teams: For cases from the Sophos IR team, dwell time (the time from when an attack starts to when it’s detected) has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks
· The Most Frequently Compromised Active Directory Servers Are Nearing End of Life: Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. In addition, a full 21% of the AD server versions compromised were already EOL
To learn more about attacker behaviors, tools and techniques, read “The Bite from Inside: The Sophos Active Adversary Report,” on Sophos.com.
Lynda Saint-Nwafor, chief Enterprise business officer, MTN Nigeria, has assured the network subscribers that the new end-user billing system for the use of USSD services will jot affect them.
USSD, otherwise Unstructured Supplementary Service Data codes are commonly used for banking transactions, airtime recharges, and other mobile services.
The telco said that there is no significant impact or change other than the fact that they will now pay the same N6.98 per session (120 seconds) with their airtime instead of direct bank debit.
Saint-Nwafor, said this during a chat with MTN MIP fellows, explaining that the Central Bank of Nigeria (CBN) and the Nigerian Communications Commission (NCC) have ordered telecom operators to ensure that the new billing model resolves trust issues and ensures transparency in the billing process.
“Our regulator insisted that at the end of every month, we are going to be providing history and statistics on the performance of the service across the board”, she explained.
Saint-Nwafor added that the new billing model has standardized messaging across all operators and ensures consistent communication with customers.
“We will take all the error codes and map them into messages that are standardised across the board. So, if you initiate a transaction, you will know if it is failing. And, when the transaction fails, you will know if it is from your bank or the telco,” she explained.
The U.S. government has recovered $225 million in what is now the largest seizure of funds linked to a cryptocurrency investment scam.
In a statement released Wednesday, June 18, the U.S. Attorney’s Office said the recovery followed an extensive investigation by the FBI and the U.S. Secret Service, using blockchain analysis and other forensic tools. The statement did not confirm whether any arrests had been made.
According to the authorities, the stolen funds originated from fraudulent cryptocurrency investment schemes that tricked victims into believing they were making legitimate investments. More than 400 individuals around the world, including dozens in the United States, were reportedly affected.
The operation involved a sophisticated money laundering network that carried out hundreds of thousands of blockchain transactions to obscure the source and ownership of the stolen assets.
“These scams prey on trust, often resulting in extreme financial hardship for the victims,” said Shawn Bradstreet, Special Agent in Charge at the U.S. Secret Service office in San Francisco.
Bradstreet added that U.S. officials hope the recovered funds can eventually be returned to the rightful victims.
Cryptocurrency investment fraud accounted for over $5.8 billion in reported losses in 2024 alone, according to the statement.
In a rousing declaration that is electrifying minds across the continent, Hon. Nnaemeka Ani, Special Adviser on ICT to Enugu State Governor, Dr. Peter Mbah, has called for a homegrown digital revolution under the banner “Africa Will Rise: By Code, By Courage, By Us.”
Hon. Nnaemeka Ani
The message, part challenge, part philosophical—seeks to galvanize African innovators to move beyond buzzwords and build technology with impact and legacy in mind.
“Let’s stop building for hype. Let’s start building for legacy,” Ani urged while speaking to ICT journalists over the weekend. “Let’s stop waiting for someone else. Let’s start creating the future—on our own terms.”
At the heart of Ani’s vision is a shift from tech consumerism to tech authorship. With innovation hubs sprouting across cities like Enugu, Lagos, Kigali, Jo’Burg, and Nairobi, and a growing community of developers, engineers, and entrepreneurs determined to solve Africa’s unique challenges, the movement is already taking shape.
Ani emphasized that Africa’s future lies not in flashy apps or international admiration but in persistent, intentional solutions that uplift communities—solutions that digitize public services, bridge rural-urban divides, empower women and youth, and build resilience in food and climate systems.
“We have the talent,” he said. “Now it’s time to harness it—to stop building for likes and start building for lasting impact.”
With support from leaders like Ani and rising momentum in Africa’s tech corridors, it seems that a new chapter is being written—one line of code at a time.
MTN Says New N6.98 USSD Charge Won’t Affect Airtime Recharge
Sofri Microfinance Bank Rejig Digital Platforms for Better Customer Experience
DLM Group Unveils Innovative Sovereign Bond Backed Composite Notes
Study Reveals 7% of Industrial Organizations Tackle Vulnerabilities Only When Necessary
NITDA, NCFRMI Forge Strategic Alliance for Inclusive Digital Transformation of Displaced Nigerians
General News2 days agoNASRDA, Galaxy Space Firm Sign MoU on Satellite Connectivity
Telecom2 days agoOver 1m Nigerians Reached through MTN Staff’s Digital and Community Outreach
Telecom2 days agoMafab Gets 0724 Number Series, Launches Mcom 5G Brand
News2 days agoDBN Awards N13m in Grants to Tech Startups
Telecom2 days agoNCC to Name, Shame Telecom Infrastructure Vandals
News2 days agoFCCPC Shuts France, Belgium, and Italy Visa Centres in Abuja Over Alleged Consumer Rights Violations
Telecom2 days agoWSIS Review: Nigerian ICT Leaders Urged to Shape Global Digital Future
E-Financial2 days agoBank Customers Petition CBN over Illegal Deductions, Demand Action