E-Business
Cyber Attackers Getting More Undetected in Target Networks – Sophos Report
New report released by Sophos has revealed that Cyber attackers are not only becoming sophisticated now, they are even getting more time undetected in target networks.
John-Shier, Senior-Security-Advisor-at-Sophos
Sophos, a global leader in next-generation cybersecurity, which released the “Active Adversary Playbook 2021,” detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020.
The TTP detection data also covers early 2021. The findings show that the median attacker dwell time before detection was 11 days – or 264 hours – with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
The playbook is based on Sophos telemetry as well as 81 incident investigations and insight from the Sophos Managed Threat Response (MTR) team of threat hunters and analysts and the Sophos Rapid Response team of incident responders.
The aim is to help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on their network.
Key findings in the playbook include:
- The median attacker dwell time before detection was 11 days – To put this in context, 11 days potentially provide attackers with 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
Considering that some of these activities can take just minutes or a few hours to implement – often taking place at night or outside standard working hours – 11 days offers attackers plenty of time to cause damage in an organization’s network.
It is also worth noting that ransomware attacks tend to have a shorter dwell time than “stealth” attacks, because they are all about destruction
- 90% of attacks seen involved the use of the Remote Desktop Protocol (RDP) – and in 69% of all cases, attackers used RDP for internal lateral movement – Security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access.
However, these don’t work if the attacker is already inside the network. The use of RDP for internal lateral movement is increasingly common in active, hands-on-keyboard attacks such as those involving ransomware
- Interesting correlations emerge among the top five tools found in victim networks. For instance, when PowerShell is used in an attack, Cobalt Strike is seen in 58% of cases, PsExec in 49%, Mimikatz in 33%, and GMER in 19%.
Cobalt Strike and PsExec are used together in 27% of attacks, while Mimikatz and PsExec occur together in 31% of attacks. Lastly, the combination of Cobalt Strike, PowerShell and PsExec occurs in 12% of all attacks.
Such correlations are important because their detection can serve as an early warning of an impending attack or confirm the presence of an active attack
- Ransomware was involved in 81% of the attacks Sophos investigated. The release of ransomware is often the point at which an attack becomes visible to an IT security team. It is, therefore, not surprising that the vast majoirty of the incidents Sophos responded to involved ransomware.
Other attack types Sophos investigated included exfiltration only, cryptominers, banking trojans, wipers, droppers, pen test/attack tools, and more
“The threat landscape is becoming more crowded and complex, with attacks launched by adversaries with a wide range of skills and resources, from script kiddies to nation-state backed threat groups. This can make life challenging for defenders,” said the Senior Security Advisor at Sophos, John Shier. “Over the last year, our incident responders helped to neutralize attacks launched by more than 37 attack groups, using more than 400 different tools between them. Many of these tools are also used by IT administrators and security professionals for their everyday tasks and spotting the difference between benign and malicious activity isn’t always easy.
“With adversaries spending a median of 11 days in the network, implementing their attack while blending in with routine IT activity, it is critical that defenders understand the warning signs to look out for and investigate. One of the biggest red flags, for instance, is when a legitimate tool or activity is detected in an unexpected place. Most of all, defenders should remember that technology can do a great deal but, in today’s threat landscape, may not be enough by itself. Human experience and the ability to respond are a vital part of any security solution.”
Other topics covered in the playbook include the tactics and techniques most likely to signpost an active threat and warrant closer investigation, the earliest signs of attack, the most widely seen stagers, threat types and malicious artefacts, the most prevalent adversary groups seen, and more.
To learn more about attacker behaviors, tactics, techniques and procedures (TTPs) read the Sophos Active Adversary Playbook 2021 on Sophos News.
Corporate Affairs Commission (CAC) in partnership with the Nigeria Inter-Bank Settlement System (NIBSS) has unveiled a new Application Programming Interface (API) integration system to allow private firms access company data from the Commission’s database.
Hussaini Ishaq Magaji (SAN), registrar general of CAC, who spoke in Abuja at the unveiling said the system would give selected private organizations access to CAC services through technology-based companies, called “super agents.”
“This is a practical step to show that the Commission is committed to meeting the expectations of our customers,” he said.
Magaji explained that the integration allows the agents to retrieve data from the CAC database for use in specific client requests, outside the standard services provided by the Commission.
“Before now, only a few government agencies had this integration, especially those involved in investigations, anti-money laundering, and terrorism financing. Now, private companies that meet the criteria can also access it,” he said.
He said the system complies with the Nigerian Data Protection Act 2023, and information such as residential addresses, phone numbers, and dates of birth may be restricted.
“This is a call to law firms and companies with the right technology. We’ve started with NIPS because of their credibility. Embassies and banks can now authenticate company records directly through them.”
“There are prescribed fees. We already collect them on our portal, and now customers can also pay through these agents,” he explained.
He named NIPS, MoneyPoint, and OPE as some of the companies involved.
“OPE and MoneyPoint handle only registrations. But NIPS has moved further into validation and verification,” he said.
Ngover Ihyembe-Nwankwo, executive director at NIBSS, who represented Premier Oiwoh, managing director, said the service allows secure and efficient data verification.
“This is the result of years of effort to connect our systems with CAC. It will help users verify data within the limits of data protection laws,” she said.
She said the move is a way to lower costs and promote interoperability across the financial sector.
Ministry of Interior has announced the launch of a new Online Citizenship and Business Management Platform in line with the Renewed Hope Agenda of President Bola Tinubu.
A statement signed by Dr Magdalene Ajani, permanent secretary, Ministry of Interior’s said the initiative forms a key part of its ongoing reforms aimed at promoting transparency, enhancing operational efficiency, and significantly improving service delivery to the public.
The new digital platform is designed to streamline the application and processing of citizenship and business-related services, ensuring faster turnaround times and improved user experience.
The platform allows users to apply for and manage business permits, ensuring that both local and foreign businesses operate legally in Nigeria.
It includes an Expatriate Quota System to manage work permits for foreign employees, helping companies hire skilled workers while complying with Nigeria’s immigration laws.
The Citizenship Administration and Management System provides a streamlined online process for applying, tracking, and managing Nigerian citizenship applications and related services.
Members of the public, corporate entities, and other stakeholders are expected to access the platform through the ministry’s website: https://interior.gov.ng , Direct Portal Access: https://candb.interior.gov.ng , or contact [email protected] for support and inquiries.
“The Ministry of Interior remains committed to establishing a more efficient, transparent, and secure framework for citizenship administration, while continuously enhancing service delivery through digital transformation,” the statement read in part.
Fifty selected young unemployed Nigerians have completed a four-week intensive digital skills bootcamp under the Digital Literacy for All (DL4ALL) initiative, gaining practical training in Data Science, Artificial Intelligence (AI), and IT Essentials.
The programme, a collaborative effort between the National Information Technology Development Agency (NITDA) and Cisco, was hosted at NITDA’s South West Zonal Office in Victoria Island, Lagos.
Speaking on behalf of the Director General of NITDA, Kashifu Inuwa , the Head of the South West Zonal Office, Mrs. Chioma Okee-Agugwo, described the initiative as a vital component of Nigeria’s digital future. “This is not just a closing ceremony. It is the launchpad for new journeys—anchored in digital knowledge and powered by innovation,” she remarked.
According to the Director General, the initiative is rooted in NITDA’s Strategic Roadmap and Action Plan (SRAP 2.0) and reflects key focus areas including Digital Literacy, Emerging Technologies, and Youth Empowerment. It also aligns with President Bola Ahmed Tinubu’s Renewed Hope Agenda, which seeks to accelerate economic diversification through digitisation, innovation, and skills development.
Inuwa noted that the DL4ALL initiative forms part of Nigeria’s broader commitment to digital inclusion—ensuring that no one is left behind in the evolving digital economy. It also supports the ambitious goal of achieving 70% digital literacy by 2027, championed by the Honourable Minister of Communications, Innovation and Digital Economy, Dr. Bosun Tijani. This national vision aims to equip millions of Nigerians with the skills required to thrive in a tech-driven world.
He further emphasized the importance of empowering youth with globally relevant skills. “They are no longer just consumers of technology. They are creators, innovators, and future employers,” he said.
The NITDA boss explained that throughout the bootcamp, participants engaged in hands-on learning experiences designed to build both technical proficiency and digital leadership capabilities.
“This is only the beginning,” he stated. “Through our zonal strategy, we are bringing innovation closer to local communities. This is how we democratise access and unlock Nigeria’s full digital potential.”
Inuwa expressed appreciation to Cisco for delivering high-impact training and called on stakeholders to continue investing in partnerships, people, and platforms that drive digital inclusion.
He asserted that the newly certified participants are now equipped to contribute meaningfully to Nigeria’s digital economy—armed with the skills to build solutions, secure infrastructure, and launch tech ventures that solve real-world problems.
At the end of the bootcamp, participants demonstrated their knowledge through impressive presentations that showcased the integration of skills acquired across Data Science, AI, and IT Essentials. Many spoke passionately about how the programme had expanded their technical competence and sparked a drive to create job opportunities—not only for themselves but also for others—as entrepreneurs and digital solution providers in their communities.
Telcos Warns of Nationwide Telecom Blackout over Diesel Shortage
Nigerians Spend N5.3 Trillion on Telecom Services
Canal+ Buyout Of South Africa’s MultiChoice one Step Closer
CBN, SEC Fine Access Holdings N1.21Bn for Infractions
Nigerians, Others Lost $70m to Denied Visas Applications to Europe in 2024
NBC Loses Appeal as Tribunal Upholds ₦190m Fine for Misleading Packaging
NITDA Advocates Strategic Partnership in Research to Unlock Nigeria’s Digital Potential
MTN Appoints Egerton Idehen as Chief Broadband Officer
CBN Slams ₦250m Fine on Paystack Over Zap Wallet Operations
Nigeria Hits 1 Terabit Internet Traffic Milestone
E-Financial2 days agoAccess Bank Faces Charges over Alleged Diversion of N826m
E-Financial2 days agoFidelity Bank Seeks Supreme Court Judgement Interpretation, Condemns Malicious Publication
Telecom2 days agoMart Networks Rolls Out Tailored Cybersecurity Solution for Fintechs
E-Financial2 days agoDon’t Panic, Banking Sector is Safe and Sound- CBN
News2 days agoNigeria’s Digital Economy Sector Attracts $191m FDI
General News2 days agoNigeria to Launch 4 Satellites for Surveillance, Others
General News2 days agoShell Reports 122 Percent Surge in Oil Spills from Nigerian Operations in 2024
E-Financial2 days agoCourt to Hear NIBSS Suit Seeking Exclusive Power to Manage BVN Database