E-Business
Cyber Attackers Getting More Undetected in Target Networks – Sophos Report
New report released by Sophos has revealed that Cyber attackers are not only becoming sophisticated now, they are even getting more time undetected in target networks.
John-Shier, Senior-Security-Advisor-at-Sophos
Sophos, a global leader in next-generation cybersecurity, which released the “Active Adversary Playbook 2021,” detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020.
The TTP detection data also covers early 2021. The findings show that the median attacker dwell time before detection was 11 days – or 264 hours – with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
The playbook is based on Sophos telemetry as well as 81 incident investigations and insight from the Sophos Managed Threat Response (MTR) team of threat hunters and analysts and the Sophos Rapid Response team of incident responders.
The aim is to help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on their network.
Key findings in the playbook include:
- The median attacker dwell time before detection was 11 days – To put this in context, 11 days potentially provide attackers with 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
Considering that some of these activities can take just minutes or a few hours to implement – often taking place at night or outside standard working hours – 11 days offers attackers plenty of time to cause damage in an organization’s network.
It is also worth noting that ransomware attacks tend to have a shorter dwell time than “stealth” attacks, because they are all about destruction
- 90% of attacks seen involved the use of the Remote Desktop Protocol (RDP) – and in 69% of all cases, attackers used RDP for internal lateral movement – Security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access.
However, these don’t work if the attacker is already inside the network. The use of RDP for internal lateral movement is increasingly common in active, hands-on-keyboard attacks such as those involving ransomware
- Interesting correlations emerge among the top five tools found in victim networks. For instance, when PowerShell is used in an attack, Cobalt Strike is seen in 58% of cases, PsExec in 49%, Mimikatz in 33%, and GMER in 19%.
Cobalt Strike and PsExec are used together in 27% of attacks, while Mimikatz and PsExec occur together in 31% of attacks. Lastly, the combination of Cobalt Strike, PowerShell and PsExec occurs in 12% of all attacks.
Such correlations are important because their detection can serve as an early warning of an impending attack or confirm the presence of an active attack
- Ransomware was involved in 81% of the attacks Sophos investigated. The release of ransomware is often the point at which an attack becomes visible to an IT security team. It is, therefore, not surprising that the vast majoirty of the incidents Sophos responded to involved ransomware.
Other attack types Sophos investigated included exfiltration only, cryptominers, banking trojans, wipers, droppers, pen test/attack tools, and more
“The threat landscape is becoming more crowded and complex, with attacks launched by adversaries with a wide range of skills and resources, from script kiddies to nation-state backed threat groups. This can make life challenging for defenders,” said the Senior Security Advisor at Sophos, John Shier. “Over the last year, our incident responders helped to neutralize attacks launched by more than 37 attack groups, using more than 400 different tools between them. Many of these tools are also used by IT administrators and security professionals for their everyday tasks and spotting the difference between benign and malicious activity isn’t always easy.
“With adversaries spending a median of 11 days in the network, implementing their attack while blending in with routine IT activity, it is critical that defenders understand the warning signs to look out for and investigate. One of the biggest red flags, for instance, is when a legitimate tool or activity is detected in an unexpected place. Most of all, defenders should remember that technology can do a great deal but, in today’s threat landscape, may not be enough by itself. Human experience and the ability to respond are a vital part of any security solution.”
Other topics covered in the playbook include the tactics and techniques most likely to signpost an active threat and warrant closer investigation, the earliest signs of attack, the most widely seen stagers, threat types and malicious artefacts, the most prevalent adversary groups seen, and more.
To learn more about attacker behaviors, tactics, techniques and procedures (TTPs) read the Sophos Active Adversary Playbook 2021 on Sophos News.
Kaspersky, a global cybersecurity company, and the Small and Medium Enterprises Development Agency of Nigeria (SMEDAN) have signed a memorandum of understanding (MoU) to assist small and medium businesses in the country to become more cyber-aware and less vulnerable to developing cyber threats.
The MoU reflects a shared view that SMEs, being the backbone of economy, require strong cybersecurity measures. Kaspersky and SMEDAN will work together on information sharing, training programmes, and other practical steps to raise awareness of digital threats and cybersecurity measures.
“Small and medium business owners are juggling a dozen things – accounting, promotion, legal issues. They are not cybersecurity experts. But they are being targeted by cybercriminals through malware, phishing, and online schemes using social engineering tactics that make them look realistic.
“Our aim is to provide these organisations with some best practice tools and inform about measures that will help them stay safer online,” says Chris Norton, General Manager for Sub-Saharan Africa at Kaspersky.
The cooperation will feed into SMEDAN’s wider SME development efforts, with Kaspersky contributing cybersecurity knowledge and joining forces on awareness campaigns. The idea is to bring cybersecurity-focused guidance into existing business support channels, and to do it in a way that actually makes sense to entrepreneurs who may not have technical teams behind them.
Charles Odii, DG/CEO of SMEDAN, comments: “Since the COVID-19 pandemic, digital adoption among business owners has accelerated significantly. Many now operate WhatsApp shops, use online banking, and send invoices via email, which has increased their exposure to cyber risks.
Together with Kaspersky, we intend to strengthen cybersecurity awareness and practices across Nigeria, helping SMEs protect their businesses as they embrace the digital economy.”
SMEDAN has long been a government agency that has consistently shown up for small business owners in Nigeria. Its work cuts across industries, regions, and stages of growth from traders and artisans to early-stage tech startups trying to get formalised. This partnership gives it another tool to help those businesses operate more securely in a digital world. For Kaspersky, the collaboration is part of a wider push across the continent to support under-resourced sectors that are quietly being targeted online.
Kashifu Inuwa, CCIE, the Director General of the National Information Technology Development Agency (NITDA), has emphasised that integrating intelligence, security, and sustainability is critical to driving Nigeria’s digital transformation and global competitiveness.
Inuwa made the remarks on Tuesday in Kano while delivering a goodwill message at the opening of the 19th International Conference (CONNOVATE 2025) of the Nigerian Computer Society (NCS), themed “Intelligent, Secure, and Sustainable Innovations for a Connected World.”
Represented by Engr. Salisu Kaka, Director of E-Government and Digital Economy Development, Inuwa said the three elements were now indispensable drivers of national progress. He highlighted the need for their convergence to unlock new opportunities in Nigeria’s technology sector, citing Estonia’s X-Road platform — which enables 99% of government services online — as a global model.
“In Nigeria, trust is the ultimate currency in our high-stakes digital environment, where scams and cybercrime are prevalent. Security builds and protects this trust,” Abdullahi said.
He stressed that while security provides the foundation, intelligence builds the structure, pointing to Artificial Intelligence (AI), Machine Learning (ML), and data analytics as tools for addressing Nigeria’s complex challenges. Warning that “innovation without security is unsustainable,” he likened it to “a high-performance race car without brakes.”
The DG urged the next wave of Nigerian startups to go beyond digitising existing processes to creating new value, citing AI-powered wealth management and ML-driven remote diagnostics as examples.
He further highlighted the various Federal Ministry of Communications, Innovation and Digital Economy (FMCIDE) initiatives supporting this vision, including the National Centre for Artificial Intelligence and Robotics (NCAIR), the Computer Emergency Readiness and Response Team (CERRT), the Nigeria Data Protection Act (NDPA) 2023, the national digital identity programme, interoperable payments, and human capital initiatives such as the 3 Million Technical Talent (3MTT) and Digital Literacy for All (DL4ALL) programmes.
Inuwa cited example with International Federation for Information Processing (IFIP) President, Antony Wong, that called for stronger protection and strategic use of data in the Global South to safeguard indigenous knowledge. He stressed the importance of legal clarity on data ownership as Nigeria’s cultural heritage in medicine, ecology, and art is digitised and incorporated into AI systems. Wong praised Nigeria’s role in the recent World Intellectual Property Organization (WIPO) treaty protecting genetic resources and traditional knowledge.
Delivering his welcome address, the NCS President, Dr. Muhammad Sirajo, said the conference would serve as a platform for IT professionals to address critical issues, including intelligent systems, fintech, sustainable energy, and innovations in agriculture, health, education, and national planning.
“This conference will provide an interdisciplinary platform for researchers, practitioners, and educators to present and discuss recent innovations, trends, and solutions for improving technological systems,” Sirajo said.
The week-long event includes plenary sessions, a doctoral consortium, a youth and entrepreneurship forum, the Fellows Forum, the Annual General Meeting, an IT quiz competition for students, and an induction ceremony for new members. It will conclude with the election of new national executives, a dinner, and an awards night honouring contributions to the ICT sector.
The African Development Bank (AfDB) is betting big on Artificial Intelligence (AI) as a catalyst for delivering Africa’s ambitious Agenda 2063.
With hands-on training in tools like ChatGPT and Google Gemini, the Bank believes the results could redefine how the continent plans, measures, and delivers its development goals.
Through its Joint Secretariat Support Office, the AfDB has provided technical and financial support to the 5th annual training workshop for African Union member states, focusing on the use of AI to track and implement the second ten-year plan (2024–2033) of Agenda 2063.
The five-day workshop, held in Lusaka, Zambia, was co-organised by the African Union Commission and the African Capacity Building Foundation.
Participants from across the continent rolled up their sleeves for hands-on training with emerging AI platforms like Ailyse, Google AI Studio, and Perplexity.
The goal of Africa’s multilateral development finance institution is to turn complex development data into actionable insights that can drive smarter decisions, faster interventions, and more accountable governance.
AbibuTamu, lead programme co-ordinator at the AfDB, said AI was now an indispensable tool for Africa’s future.
“These tools are not only revolutionizing how data is collected, analysed, and reported, they are also enabling more targeted policy interventions and efficient resource allocation,” Tamu told delegates.
Agenda 2063, dubbed “The Africa We Want,” is the African Union’s 50-year blueprint for inclusive growth and sustainable development. The second 10-year plan prioritises industrialisation, digital transformation, and sustainable livelihoods.
With AI now in the mix, African policymakers can track progress in real-time, spot bottlenecks before they choke projects, and reallocate resources where they are needed most.
The AfDB’s backing underscores a broader strategy of boosting both human and institutional capacity that propels African states to harness the digital revolution.
Beyond technical skills, the Lusaka workshop doubled as a peer-learning platform, with countries sharing real-world success stories on integrating AI into national planning and reporting.
“If Agenda 2063 is Africa’s long-term roadmap, this AI training is about upgrading the continent’s GPS that ensures leaders not only know the destination, but also have the intelligence to navigate every twist and turn on the way,” said Tamu.
Kaspersky, SMEDAN to Support SMEs in Nigeria with Cybersecurity Knowledge
NGF Launches Digital Platform to Bridge $100bn Infrastructure Gap
TD Africa Secures AI ISO Certifications
Data Is Life: Why MTN Wants You to Get Smarter with Your Data
Paradigm Initiative Equips Prosecutors for the Digital Age of Crime
Telecom3 days agoNCC Claims to Have Eliminated Unregistered SIMs from Telecoms Networks
Telecom3 days agoAliyu Aboki Applauds Broadband Mapping as About Expanding Opportunity in Africa
Telecom2 days agoFG Scraps 5 Percent Telecom Excise Duty Under New Tax Law
E-Financial3 days agoUBA Secures N5Bn BoI Fund to Boost Women Entrepreneurs, Others
Telecom3 days agoMTN Group Restructures Executive Team, Appoints Toriola VP for Francophone Africa
- News3 days ago
Telcos See Biggest Growth Post-COVID – ALTON
News3 days agoNITDA, Bauchi State Partner on Digital Literacy and Skills Framework
General News3 days agoVirtual Reality in Healthcare: Nigeria’s Untapped Opportunity for Training, Patient Care, and Medical Innovation