Connect with us

News

Check Point Research Reveals XLoader as August’s Top Malware in Nigeria

Published

on

Kindly share this post

Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies, a provider of cyber security solutions globally, has published its latest Global Threat Index for August 2022.

 

In Nigeria, XLoader is the most widespread malware this month impacting 14.47% of organisations in the country, followed by Phorpiex and Guloader both with 6.58%.

Globally, CPR reports that FormBook is now the most prevalent malware, taking over from Emotet, which has held that position since its reappearance in January.

FormBook is an Infostealer targeting Windows OS which, once deployed, can harvest credentials, collect screenshots, monitor and log keystrokes as well as download and execute files according to its command and control (C&C) orders.

Since it was first spotted in 2016, it has continued to make a name for itself, marketed as a Malware as a Service (MaaS) in underground hacking forums, known for its strong evasion techniques and relatively low price.

August also saw a rapid increase in GuLoader activity, which resulted in it being the fourth most widespread malware. GuLoader was initially used to download Parallax RAT but has since been applied to other remote access trojans and infostealers such as Netwire, FormBook and Agent Tesla.

It is commonly distributed through extensive email phishing campaigns, that lure the victim into downloading and opening a malicious file, allowing the malware to get to work.

Additionally, Check Point Research reports that Joker, an Android spyware, is back in business and has claimed third place in the top mobile malware list this month. Once Joker is installed, it can steal SMS messages, contact lists and device information as well as sign the victim up for paid premium services without their consent. Its rise can partially be explained by an uplift in campaigns as it was recently spotted to be active in some Google Play Store applications.

“The shifts that we see in this month’s index, from Emotet dropping from first to fifth place to Joker becoming the third most prevalent mobile malware, is reflective of how fast the threat landscape can change” said Maya Horowitz, VP Research at Check Point Software.

“This should be a reminder to individuals and companies alike, of the importance of keeping up to date with the most recent threats as knowing how to protect yourself is essential.

“Threat actors are constantly evolving and the emergence of FormBook shows that we can never be complacent about security and must adopt a holistic, prevent-first approach across networks, endpoints and the cloud.”

CPR also revealed this month that the Education/Research sector is still the most targeted industry by cybercriminals globally. With Government/Military and Healthcare taking second and third place as the most attacked sectors.

“Apache Log4j Remote Code Execution” returns to first place as the most exploited vulnerability, impacting 44% of organizations worldwide, after overtaking “Web Server Exposed Git Repository Information Disclosure” which had an impact of 42%.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

FormBook is the most widespread malware this month impacting 5% of organizations worldwide, followed by AgentTesla with an impact of 4% and XMRig with 2%.

  1. XLoader – XLoader is an Android Spyware and Banking Trojan developed by the Yanbian Gang, a Chinese hacker group. This malware uses DNS spoofing to distribute infected Android apps to collect personal and financial information..
  2. Phorpiex – Phorpiex is a botnet (aka Trik) that has been active since 2010 and at its peak controlled more than a million infected hosts. It is known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.
  3. Guloader – GuLoader is a downloader that has been widely used since December 2019. When it first appeared, GuLoader was used to download Parallax RAT but has been applied to other remote access trojans and info-stealers such as Netwire, FormBook, and Agent Tesla.

Top Attacked Industries Globally

This month the Education/Research sector remained in first place as the most attacked industry globally, followed by Government/Military and Healthcare.

  1. Education/Research
  2. Government/Military
  3. Healthcare

Top Exploited Vulnerabilities

This month, “Apache Log4j Remote Code Execution” is the most common exploited vulnerability, impacting 44% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which dropped from first place to second with an impact of 42%. “Web Servers Malicious URL Directory Traversal” remains in the third place, with a global impact of 39%.

  1. Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
  2. Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow unintentional disclosure of account information.
  3. ↔ Web Servers Malicious URL Directory Traversal (CVE-2010-4598,CVE-2011-2474,CVE-2014-0130,CVE-2014-0780,CVE-2015-0666,CVE-2015-4068,CVE-2015-7254,CVE-2016-4523,CVE-2016-8530,CVE-2017-11512,CVE-2018-3948,CVE-2018-3949,CVE-2019-18952,CVE-2020-5410,CVE-2020-8260) – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.

Top Mobile Malwares

This month AlienBot is the most prevalent Mobile malware, followed by Anubis and Joker.

  1. AlienBot – AlienBot is a banking Trojan for Android, sold underground as a Malware-as-a-Service (MaaS). It supports keylogging, dynamic overlays for credentials theft, as well as SMS harvesting for 2FA bypass. Additional remote control capabilities are provided by using a TeamViewer module.
  2. Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger and audio recording capabilities as well as various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
  3. Joker – An Android Spyware in Google Play, designed to steal SMS messages, contact lists and device information. Furthermore, the malware can also sign the victim up for paid premium services without their consent or knowledge.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

News

TI-Nigeria Boss Alleges Nigerian Banks Offer Opportunities for Terrorism Tinancing

Published

on

Kindly share this post

Awual Rafsanjani, executive director, Civil Society Legislative Advocacy Centre (CISLAC) and head,  Transparency International in Nigeria (TI-Nigeria), has accused banks of offering opportunities for terrorism financing in the country.

TI-Nigeria Boss Alleges Nigerian Banks Offer Opportunities for Terrorism Tinancing

Rafsanjani, stated this at the multi-stakeholder meeting on terrorism financing and violent extremism in the North-East, organised by CISLAC and TI-Nigeria, financed by GIABA-ECOWAS.

According to Rafsanjani, “The financial sector has been exploited for terrorism financing. The use of the financial sector indicates the increasing capabilities of some terrorist groups. These include the Bureau de Change operators, Point of Sale (POS) devices, wire transfers, and Designated Non-Financial Businesses and Professions, among other enabling platforms expanding the scope and depth of terrorism financing.

“It is worrisome that illegal money exchangers including Bureau De Change have been featured in several Terrorism Financing investigations. The 2022 National Inherent Risk Assessment of Terrorism Financing report reveals that between 2019 and 2022, about 19 companies were linked to illegal money exchangers who have used their companies to commingle funds considered to be linked to Terrorism Financing.”

In his goodwill message, Ola Olukoyede, chairman, Economic and Financial Crimes Commission (EFCC)  said that the commission is settling for the use of technology to combat illicit flow of monies into the hands of terrorists.

Olukoyede expressed worry over the dimension terrorism financing has taken, disclosing that the EFCC has discovered platforms other than Binance, which are being used for terrorism financing, saying over a thousand of such accounts were closed.

He said: “The challenge before us is to seek solutions to end this decade-long nightmare and restore order to the troubled region. The quest for a solution is not entirely new. Several conferences and workshops have been convoked, yet the situation remains dire.

“For us in the EFCC, like most Nigerians, the concern is on how this crisis continues to defy solutions and fester? How is it that the terrorist groups in the region are able to sustain their operations, acquire more sophisticated weaponry and engage in daring combat with the Nigerian military?

“It would seem that an economy of criminality has developed around terrorism and violent extremism in the region, where actors who are profiting from the chaos do not cherish the return of civil order. How for instance do we explain the activities of supposed non-profit organisations who profess to want to provide succor to the distressed but end up exploiting their misery for financial gains?

“How do we explain the action of unscrupulous actors who hide under the cover of humanitarian activities to fund terrorist groups? These are issues that we must continue to interrogate.

“The EFCC has had cause to prosecute so-called promoters of non-profit organisation who exploited the desperate conditions in the North-East to profiteer. I am sure many of you are aware of a lady that is called Mama Boko Haram, who at the peak of the insurgency positioned herself as a credible intermediary for the insurgents, but is now in jail for exploiting the distressed citizens of the North-East for personal gain.

“Part of the focus of the EFCC in the quest to tackle terrorism and violent extremism in that region is to follow the funds trail of critical actors in the region and cutting off the supply line of illicit funds to known criminal groups. This responsibility has seen the Commission pay more attention to the movement of funds by NPOs in the region, who are now required to make a declaration to the EFCC.

“Some of our discoveries recently into investigating some of these platforms was mind bugging, and we thought Binance was a major one, yes a major one and we are prosecuting them but much more, other platforms we have discovered, of course you are aware that EFCC has to freeze over a thousand account, and it will shock you what some of those accounts are used for, and some of them are used to fund terrorism activities.

“You can imagine the dimension the whole problem is taking and so, it is important for us to adopt the use of technology, and that is what we are going to do to see how we can adopt technology to be able to track every Naira,” he said.

Also, in a goodwill speech, Dr Musa Aliyu, SAN, chairman, Independent Corrupt Practices and other related Offences Commission, (ICPC), said, “ICPC is fully committed to contributing its expertise and resources to this fight. We are prepared to intensify our efforts in financial oversight, enhance our investigative and prosecutorial capacities, and work closely with all stakeholders to disrupt the financial networks that fuel terrorism.”

 

 


Kindly share this post
Continue Reading

News

Afreximbank Deepens Ties On $350m Project Support Facility

Published

on

Kindly share this post

African Export-Import Bank (Afreximbank) has concluded arrangements for a facility of $250 million with the International Islamic Trade Finance Corporation (ITFC) and $100 million with the Islamic Corporation for Development of the Private Sector (ICD) in support of trade and projects in Africa.

The arrangement took place on the sidelines of the recently concluded 2024 Islamic Development Bank (IsDB) Group Annual Meetings and Golden Jubilee Celebrations.

The lines of financing expected from ICD would strengthen the bank’s capacity and reinforce its intervention in the private sector, particularly for enterprises with substantial development impact in ICD and Afreximbank’s member states.

The facility from ITFC, on the other hand, will provide compliant syndicated trade financing line, thereby complementing the bank’s trade finance offerings to its clients.

As partners of the Arab Africa Trade Bridges (AATB) Programme, Afreximbank, ITFC and ICD are committed to promoting south-to-south trade among African and Arab countries for a common goal of advancing socio-economic prosperity and building sustainable trade and development across the regions.

The collective support from ITFC and ICD will also allow the bank to deliver on its continental mandate of fostering industrialisation, developing exports and full implementation of the African Continent Free Trade Area (AfCFTA).

Speaking during the signing ceremony, Prof. Oramah, President and Chairman of the Board of Directors of Afreximbank, said: “I take this opportunity to thank Eng. Hani Salem Sonbol and the entire team at ITFC and ICD for the continued partnership with Afreximbank.

 


Kindly share this post
Continue Reading

News

Court Denies Binance Executive Tigran Gambaryan Bail

Published

on

Kindly share this post

Justice Emeka Nwite of the Federal High Court Abuja, has dismissed the bail application of an Executive of Binance Holdings Limited, Tigran Gambaryan. Justice Nwite held that Gambaryan is likely to jump bail if bail is granted to him.

The company and its executive were arraigned on a five-count charge bordering on money laundering. When the charges were read out, the defendants pleaded not guilty.

Moving an application, Counsel to the Defendant, Mark Mordi, argued that the court had the power to grant bail to the defendant and impose conditions to ensure his presence in court.

The Prosecution Counsel, Ekele Iheanacho, however opposed the bail application, stating that the defendant was a flight risk.

He stated that the defendant attempted to obtain a new passport which he claimed was stolen, and this was a suspicious act given the proximity to his colleague’s escape from custody.

He added that the court cannot risk granting him bail, especially since he is not attached to any community in Nigeria.

“The fact that the passport of the defendant is with the complainant does not guarantee that he will remain in Nigeria because the defendant is not only an American citizen but also an Armenian citizen by birth.

He urged the court to refuse the application and instead remand him in EFCC custody to ensure his safety and prevent potential flight risk.

Delivering ruling, the presiding judge said several factors including the nature of offence and its severity must be considered when trying to decide whether or not bail should be granted to the defendant applicant.

Justice Nwite agreed with the depositions made by prosecution and was of the view that the applicant will jump bail if bail is granted to him.

He subsequently ordered that the trial be given an accelerated hearing.


Kindly share this post
Continue Reading

Trending