E-Business
Check Point Identifies Trickbot, Emotet and the Log4j Plague as December 2021’s Most Wanted Malware
Check Point Research, the Threat Intelligence arm of Check Point Software Technologies, a leading provider of cyber security solutions globally, has published its latest Global Threat Index for December 2021.
In a month that saw the Apache Log4j vulnerability sweep the internet, researchers reported that Trickbot is still the most prevalent malware, albeit at a slightly lower rate affecting 4% of organizations worldwide (5% in November).
The recently resurgent Emotet has swiftly risen from seventh position to second. CPR also reveals that the most attacked industry continues to be Education/Research.
This month “Apache Log4j Remote Code Execution” is the most exploited vulnerability, affecting 48.3% of organizations globally. The vulnerability was first reported on December 9th in the Apache logging package Log4j – the most popular Java logging library used in many Internet services and apps with over 400,000 downloads from its GitHub project.
The vulnerability caused a new plague, impacting almost half of all companies worldwide in a very short space of time. Attackers are able to exploit vulnerable apps to execute cryptojackers and other malware on compromised servers.
Until now, most of the attacks have focused on the use of cryptocurrency mining at the expense of the victims however, advanced attackers have started to act aggressively and take advantage of the breach on high-quality targets.
“Log4j dominated headlines in December. It is one of the most serious vulnerabilities we have ever witnessed, and due to the complexity in patching it and its easiness to exploit, it is likely to stay with us for many years to come unless companies take immediate action to prevent attacks,” said Maya Horowitz, VP Research at Check Point Software. “This month we have also seen the Emotet botnet move from the seventh most prevalent malware to the second.
Just as we suspected, it has not taken long at all for Emotet to build a strong foothold since it resurfaced in November. It is evasive and is spreading fast via phishing emails with malicious attachments or links.
It is now more important than ever to have a robust email security solution in place and to ensure that users know how to identify a suspicious looking message or attachment.”
CPR revealed this month that Education/Research is the most attacked industry globally, followed by Government/Military and ISP/MSP. “Apache Log4j Remote Code Execution” is the most commonly exploited vulnerability, impacting 48.3% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which affects 43.8% of organizations worldwide. “HTTP Headers Remote Code Execution” remains in third place in the top exploited vulnerabilities list, with a global impact of 41.5%.
Top malware families
*The arrows relate to the change in rank compared to the previous month.
This month, Trickbot is the most popular malware impacting 4% of organizations worldwide, followed by Emotet and Formbook, both with a global impact of 3%.
In Nigeria, Ramnit is the most popular malware impacting 12.64% of organizations in the country, followed by Phorpiex at 10.34% and Formbook with a country impact of 8.05%.
- ↔ Ramnit – Ramnit is a banking Trojan which incorporates lateral movement capabilities. Ramnit steals web session information, enabling the worm operators to steal account credentials for all services used by the victim, including bank accounts, corporate and social networks accounts.
- ↑ Phorpiex – Phorpiex is a botnet (aka Trik) has been since 2010 and at its peak controlled more than a million infected hosts. Known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.
- ↔ Formbook – First detected in 2016, FormBook is an InfoStealer that targets the Windows OS. It is marketed as MaaS in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
Top Attacked Industries Globally:
This month, Education/Research is the most attacked industry globally, followed by Government/Military and ISP/MSP. In Africa the most attacked industry is Communications followed by ISP/MSP and Finance/Banking.
|
|
|
Top exploited vulnerabilities
This month, “Apache Log4j Remote Code Execution” is the most commonly exploited vulnerability, impacting 48.3% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which affects 43.8% of organizations worldwide. “HTTP Headers Remote Code Execution” remains in third place in the top exploited vulnerabilities list, with a global impact of 41.5%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↔ Web Server Exposed Git Repository Information Disclosure- An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
- ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
Top Mobile Malwares
This month, AlienBot takes first place in the most prevalent Mobile malwares, followed by xHelper and FluBot.
- AlienBot – AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker, as a first step, to inject malicious code into legitimate financial applications. The attacker obtains access to victims’ accounts, and eventually completely controls their device.
- xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisements. The application is capable of hiding itself from the user and can even reinstall itself in the event that it was uninstalled.
- FluBot – FluBot is an Android botnet distributed via phishing SMS messages, most often impersonating logistics delivery brands. Once the user clicks the link inside the message, FluBot is installed and gets access to all sensitive information on the phone.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.
Nigeria Data Protection Commission (NDPC) has issued a regulatory advisory to data controllers and processors across the country following what it described as escalating threats to Nigeria’s data security architecture.
NDPC
In a statement signed by Babatunde Bamigboye, lead of Legal, Enforcement and Regulations, the commission said its technical assessment revealed that some shadowy threat actors were engaged in coordinated operations targeting financial systems and critical digital infrastructure in Nigeria.
The commission urged public institutions to comply with the presidential directive of Bola Ahmed Tinubu, which emphasises the strategic importance of data in national development.
According to the NDPC, the President had declared that “data is the new oil,” stressing the need for Ministries, Departments and Agencies (MDAs) to rigorously capture and safeguard information in line with the Nigeria Data Protection Act, 2023.
The commission therefore advised all data controllers and processors to urgently strengthen their technical and organisational measures to protect personal data and ensure compliance with the law.
It listed key measures to include the appointment of trained and certified Data Protection Officers, implementation of comprehensive privacy policies and information security standards, as well as conducting Data Privacy Impact Assessments.
Other measures recommended by the NDPC include deployment of robust identity and access controls such as Multi-Factor Authentication, adoption of zero-trust security architecture, prompt remediation of system vulnerabilities, and continuous patch management.
The commission also emphasised the need to secure cloud infrastructure, application programming interfaces (APIs), databases and access credentials, alongside real-time monitoring, logging and threat detection systems.
Further recommendations include encryption and secure credential handling, regular vulnerability assessment and penetration testing of critical systems, as well as routine backup and resilience testing.
The NDPC warned that organisations that fail to implement appropriate data protection measures in accordance with the Nigeria Data Protection Act, 2023 risk legal liabilities.
It reiterated its commitment to providing regulatory support to organisations while ensuring the protection of personal data and strengthening institutional resilience across all sectors.
The forex market across Africa is witnessing more participants and more regulatory attention than it did just a few years ago. This growth is part of a bigger picture: Sub-Saharan Africa is expected to expand by 4.3% in 2026, while global forex turnover already hit an estimated $9.6 trillion daily in April 2025. However, there’s more to it than macroeconomic figures.
The trends reshaping the market are happening from within. Here are six worth paying close attention to.
1. Trading Has Moved to the Phone
The number of people accessing the market via mobile phones exceeds those accessing it via traditional bank systems. GSMA states that in Sub-Saharan Africa alone, there are more than 1.1 billion registered mobile money accounts.
The International Monetary Fund states that digitalisation and increased usage of the internet are changing payment systems in the Sub-Saharan Africa region.
Mobile access changes traders’ behavior. It lowers the barrier to entry and speeds up deposits and withdrawals. Therefore, brokers who can provide a quality mobile trading experience will have a huge advantage.
2. Regulators Are Watching
The market is becoming more structured and more transparent. In South Africa, the FSCA regulates market conduct for financial institutions. In Kenya, the Capital Markets Authority regulates capital markets and maintains a licensing system that includes online forex brokers.
Nigeria’s SEC has publicly warned that online retail forex trading can be subject to abuse when unregulated. It also provides tools for investors to check operators’ registrations.
As a result, in 2026, more traders are likely to favour brokers that can show clear licensing, transparent operations, and stronger investor safeguards.
3. Volatility Varies by Country
A common mistake is perceiving the African market as one entity. In reality, according to RegTech Afrika, there are 21 countries out of a total of 54 that have a chance of seeing their currencies depreciate in 2025, with some of them losing value by as much as 6% or more.
A trader watching the rand, naira, shilling, or cedi, regional headlines needs more than regional headlines. Country-level macro data, central bank moves, and the US dollar will still play a major role.
4. Cross-Border Payment Infrastructure Is Quietly Improving
Platforms like PAPSS are helping make payments across African countries faster and easier to complete in local currencies. According to official announcements of PAPSS, it has become operational in 18 countries across Africa, with its latest launch in Algeria in 2025. It has also become operational in Kenya through a partnership with KCB Group, as well as in Rwanda through a partnership with Bank of Kigali.
Step by step, Africa is becoming a more financially connected continent.
5. Execution Quality Is the New Standard
Data from the BIS shows that in April 2025, three-quarters of FX trades were intermediated by the global centers of the United Kingdom, the United States, Singapore, and Hong Kong. Therefore, the best liquidity and best prices are still linked to global conditions.
For local markets, this raises the bar. Forex traders are becoming increasingly aware that tight spreads, while important, mean little without reliable prices and execution. Brokers like JustMarkets that can bring all of these elements together are in a much stronger position than competitors.
6. Education as a Necessity
Regulatory disclosures from major global brokers illustrate how tough it is to trade without proper knowledge. According to publicly available disclosures, between 70% and 80% of retail investor accounts lose money when trading CFDs.
Forex traders who understand risk management and which financial news to follow have a better chance of surviving the market. Brokers who invest in education are more likely to be seen by traders as valuable partners rather than mere facilitators.
The Market Rewards the Prepared
Africa’s forex market in 2026 is shaped by volatility, stricter rules, and mobile-first trading. The traders who combine market knowledge with the right tools and the right broker will find real opportunity here, while those who don’t adapt will find the market increasingly unforgiving.
Corporate Affairs Commission (CAC) has raised alarm over a cybersecurity incident involving unauthorised access to parts of its information systems, urging users to update their login credentials as a precaution.
In a public notice yesterday, CAC, informed stakeholders that the Commission is currently reviewing the breach and assessing its potential impact.
According to the Commission, response protocols have been activated, with containment measures already in place to safeguard affected systems.
The CAC stated that it is working closely with the National Information Technology Development Agency (NITDA) and other relevant government agencies and partners to determine the scope of the incident and prevent further compromise.
“Appropriate containment measures have been implemented, and additional safeguards are in place,” the Commission stated, while advising users to monitor activities on the CAC portal and remain cautious of unsolicited communications that may arise from the breach.
Reports online claim that as many as 25 million documents may have been exfiltrated from the Commission’s infrastructure.
The claims, attributed to a cybercrime-tracking account, have not been independently verified, and the CAC has not confirmed the figures or identified any perpetrators.
The development has raised fresh concerns over the security of Nigeria’s corporate registry, particularly given the Commission’s increasing reliance on digital systems.
In February 2026, the CAC disclosed that it processes up to 10,000 business registration requests daily, following the deployment of artificial intelligence across its service delivery platforms.
It also handles an average of 5,000 customer enquiries each day via emails and call centres.
Despite the breach, the Commission reaffirmed its commitment to maintaining the integrity and security of its systems, assuring stakeholders that updates will be provided as investigations progress.
MTN Suspends Data, Airtime Borrowing Service over New FCCPC Lending Rules
Nigeria Customs Deploys AI to Cover Revenue Leaks
Top 7 Reliable Virtual Cards for Running Ads in Nigeria
Nokia, Orange Partner on AI-native 6G Networks
NDPC Issues Critical Advisory as Hackers Target Nigeria’s Key Digital Systems
Kuda MFB Increases Kuda for Her Business Grants to ₦10 Million
Canal+ to Cut Jobs as Part Sweeping Restructuring
Nigeria tops global rankings for USDT, USDC ownership
NBC Boss Urges Content Ceators to Participate in DSO
NITDA Takes Over National Digital Architecture System
General News2 days agoGuinness Nigeria Surpasses ₦1Trillion Market Capitalisation, Signalling Strong Investor Confidence and Sustained Value Creation
News2 days agoCISA Asks NDPC, Police to Act on Alleged Data Breach by NIPSS
E-Financial2 days agoFG Investigates ‘Sharp Sharp’ Loan Operators over Alleged Privacy Violations
Telecom2 days agoAmazon Satellite to Challenge Starlink in Africa with Globalstar Acquisition
E-Financial2 days agoEcobank Delivers Strong Results, Posts $801m in Pre-Tax Profit for 2025
News2 days agoTinubu Tasks NRS to Restore Public Trust Amid Fiscal Changes
Broadcasting2 days agoFela Makes History as First African to be Inducted into Rock and Roll Hall of Fame
News2 days agoKaspersky Reports Online Scam Exposure Remains Widespread Despite High Levels of Self-assurance