Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.

After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.

While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.

“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.

“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.

“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.

“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”

Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.

While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.

In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.

Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.

Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.

However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.

“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.

“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.

To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).

For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.

National Centre for Artificial Intelligence and Robotics (NCAIR), with support from Google, on Tuesday announced the launch of the AI Fund, a ₦100 million initiative aimed at supporting Nigerian startups that are leveraging Artificial Intelligence (AI) to develop innovative solutions.

This initiative follows a series of strategic programs by the Ministry of Communications, Innovation & Digital Economy, aimed at harnessing the potential of AI to drive development, innovation, and well-being in Nigeria.

Earlier this year, the Ministry held the Artificial Intelligence Strategy Workshop in April, bringing together key stakeholders to discuss the future of AI in Nigeria.

This was followed by the release of the National AI Intelligence Strategy in August, which outlined the country’s roadmap for integrating AI into various sectors to enhance growth and societal well-being.

The AI Fund is a significant step in actualizing these plans, providing Nigerian startups with the necessary resources to innovate and scale their AI solutions.

The AI Fund is open to Nigerian-based startups that are focused on AI-driven technology solutions with the potential for significant impact.

Selected startups will receive up to ₦10 million in funding, along with access to Google’s extensive resources, including AI tools, mentorship, and a global network designed to help them scale their innovations.

Dr. Bosun Tijani, Minister of Communications, Innovation and Digital Economy, emphasized the importance of this initiative: “The AI Fund is a critical step in nurturing homegrown innovation that addresses local challenges and contributes to economic growth.

“By supporting our startups, we are not only investing in their success but also in the future of Nigeria’s digital economy.”

Dr. Bunmi Ajala, National Coordinator of NCAIR, highlighted the collaborative effort: “Our partnership with Google is a reflection of our shared vision for Nigeria’s technological advancement.

“The AI Fund is designed to empower our entrepreneurs with the resources they need to create impactful AI solutions.

“We are excited to see the transformative innovations that will emerge from this program.”

Olumide Balogun, West Africa Director, Google, reiterated Google’s commitment: “Google’s support for the AI Fund is part of our broader mission to enhance digital capabilities across Africa.

“We are committed to providing Nigerian startups with the tools, mentorship, and resources they need to innovate and succeed on a global stage.”

Google’s involvement in the AI Fund aligns with its broader AI commitments across Africa. Recently, Google announced a new cohort for its Google for Startups Accelerator Africa program, focusing on building Africa-centric products and services using AI in transformative ways.

The cohort includes five Nigerian startups, further demonstrating Google’s dedication to nurturing AI innovation on the continent.

Who Can Apply: The AI Fund is open to startups that:

• Are headquartered in Nigeria.

• Have at least one Nigerian founder.

• Focus on building AI-driven solutions with the potential to scale beyond the local market.

• Have a live product in the market, demonstrating early traction and product-market fit.

Benefits of the AI Fund: Selected startups will receive:

• Funding: Up to ₦10 million to accelerate their growth.

• Technical Expertise: Access to Google’s AI tools and mentorship from Google engineers.

• Global Network: Opportunities for international exposure and connections to Google’s vast network.

Application Details:

• Applications Open: September 10, 2024

• Applications Close: September 25, 2024

• Application Link: https://ncair.nitda.gov.ng/aifund/

The selection process will be rigorous, with a focus on identifying startups that not only have innovative AI solutions but also the potential for significant impact and scalability. Successful applicants will be announced in October 2024, with the program officially kicking off shortly thereafter.

The 100M Naira AI Fund provides an opportunity for the Nigerian startup ecosystem. For ambitious startups in the AI space, this fund represents a unique opportunity to gain access to world-class resources, mentorship, and networks that can accelerate their growth and amplify their impact. By backing the brightest AI-driven ideas, NCAIR and Google are helping to cultivate a new wave of innovation that will not only solve critical challenges but also propel these startups to new heights within the global tech arena.

For more information and to apply, visit https://ncair.nitda.gov.ng/aifund/.

Nigeria’s telecom sector is at risk of shutdown as workers under the aegis of Private Telecommunications and Communications Senior Staff Association (PTECSSAN) have embarked on strike over sack, and poor working conditions among others.

Gbenga Adebayo, chairman, ALTON

This was as the union on Monday threatened to cripple telecommunications services nationwide.

Okonu Abdullahi, secretary-general, made this known in a statement on Monday while announcing the commencement of the strike.

Gbenga Adebayo, chairman, Association of Licensed Telecom Operators of Nigeria (ALTON), reacting to the development, said that the group is unknown to its members which include MTN, Globacom, Airtel, 9-mobile and other telcos in the country.

But Abdullahi, said that the action of his union “ has become inevitable because of the prevalent precarious working conditions our members are enduring in the sector, the refusal of the employers to recognise and respect the constitutional right of these workers to freely associate with the union, and the unjust sack of three members of the union,”

He noted that its members are over 800 working at various Nigeria telecoms company facilities, network centers and other critical telecommunications, including IHS and Huawei.

The union, among other things, is demanding the reinstatement of some of its sacked workers, recognition of the union, improved working conditions, and remittance of membership dues.

“The implications of the strike will be massive because we have told all our members not to respond to any service outage from our employers.

“The fact remains that there are outages every day, and if our engineers do not respond to those outages, subscribers in those areas will be affected,” he said.

However, Adebayo of ALTON, said that “This group is not known to us in ALTON, and the companies mentioned are not members of ALTON”,