E-Business
Cyber Attackers Getting More Undetected in Target Networks – Sophos Report
New report released by Sophos has revealed that Cyber attackers are not only becoming sophisticated now, they are even getting more time undetected in target networks.
John-Shier, Senior-Security-Advisor-at-Sophos
Sophos, a global leader in next-generation cybersecurity, which released the “Active Adversary Playbook 2021,” detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020.
The TTP detection data also covers early 2021. The findings show that the median attacker dwell time before detection was 11 days – or 264 hours – with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
The playbook is based on Sophos telemetry as well as 81 incident investigations and insight from the Sophos Managed Threat Response (MTR) team of threat hunters and analysts and the Sophos Rapid Response team of incident responders.
The aim is to help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on their network.
Key findings in the playbook include:
- The median attacker dwell time before detection was 11 days – To put this in context, 11 days potentially provide attackers with 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
Considering that some of these activities can take just minutes or a few hours to implement – often taking place at night or outside standard working hours – 11 days offers attackers plenty of time to cause damage in an organization’s network.
It is also worth noting that ransomware attacks tend to have a shorter dwell time than “stealth” attacks, because they are all about destruction
- 90% of attacks seen involved the use of the Remote Desktop Protocol (RDP) – and in 69% of all cases, attackers used RDP for internal lateral movement – Security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access.
However, these don’t work if the attacker is already inside the network. The use of RDP for internal lateral movement is increasingly common in active, hands-on-keyboard attacks such as those involving ransomware
- Interesting correlations emerge among the top five tools found in victim networks. For instance, when PowerShell is used in an attack, Cobalt Strike is seen in 58% of cases, PsExec in 49%, Mimikatz in 33%, and GMER in 19%.
Cobalt Strike and PsExec are used together in 27% of attacks, while Mimikatz and PsExec occur together in 31% of attacks. Lastly, the combination of Cobalt Strike, PowerShell and PsExec occurs in 12% of all attacks.
Such correlations are important because their detection can serve as an early warning of an impending attack or confirm the presence of an active attack
- Ransomware was involved in 81% of the attacks Sophos investigated. The release of ransomware is often the point at which an attack becomes visible to an IT security team. It is, therefore, not surprising that the vast majoirty of the incidents Sophos responded to involved ransomware.
Other attack types Sophos investigated included exfiltration only, cryptominers, banking trojans, wipers, droppers, pen test/attack tools, and more
“The threat landscape is becoming more crowded and complex, with attacks launched by adversaries with a wide range of skills and resources, from script kiddies to nation-state backed threat groups. This can make life challenging for defenders,” said the Senior Security Advisor at Sophos, John Shier. “Over the last year, our incident responders helped to neutralize attacks launched by more than 37 attack groups, using more than 400 different tools between them. Many of these tools are also used by IT administrators and security professionals for their everyday tasks and spotting the difference between benign and malicious activity isn’t always easy.
“With adversaries spending a median of 11 days in the network, implementing their attack while blending in with routine IT activity, it is critical that defenders understand the warning signs to look out for and investigate. One of the biggest red flags, for instance, is when a legitimate tool or activity is detected in an unexpected place. Most of all, defenders should remember that technology can do a great deal but, in today’s threat landscape, may not be enough by itself. Human experience and the ability to respond are a vital part of any security solution.”
Other topics covered in the playbook include the tactics and techniques most likely to signpost an active threat and warrant closer investigation, the earliest signs of attack, the most widely seen stagers, threat types and malicious artefacts, the most prevalent adversary groups seen, and more.
To learn more about attacker behaviors, tactics, techniques and procedures (TTPs) read the Sophos Active Adversary Playbook 2021 on Sophos News.
Kaspersky has detected a rapidly escalating malicious campaign that has targeted over 1,100 corporate users since June 2025. The attackers pose as a legal firm and in their emails threaten recipients with lawsuits over alleged domain name patent violations, aiming to deploy malware.
Victims who opened and launched the attached files – that mimicked legal documents – had a Trojan installed on their devices, and the attackers could spy on the content of their screens. Organisations across healthcare, finance, and education sectors have been targeted.
The campaign began with 95 emails on June 11 and has since continued to escalate. Apart from claiming that the recipient’s domain name violates patented combinations of a major brand and threatening litigation, in the email the fake legal bureau also expresses the patent holders’ interest in acquiring the domain and offers getting acquainted with the details of the alleged violations by opening the attached archive with “documents”.
It is worth noting that the attackers, likely to avoid detection, attach an archive that is not password protected, and inside it includes another archive that is password protected and a file containing the password along with it.
After the user entered the archive password and clicked on the alleged legal document inside, a Trojan was installed on the device. The user saw a message displayed that read, “This document cannot be opened on this device. Try opening it on another windows device,” and simultaneously the Tor Browser was covertly downloaded and installed in the background.
Through it, the malware regularly sent snapshots of the user’s screen to the attackers over the Tor network. The malware also autostarts whenever the computer is restarted.
“This campaign is a sophisticated blend of psychological manipulation and technical deception, leveraging fear of legal action to coerce businesses into executing harmful files hidden in attached archives. Its rapid growth since June 11 underscores the urgency for organisations to bolster defenses.
Victims face the risk of losing their private data. Robust email security, employee training, and swift incident reporting are essential to counter this evolving threat,” comments Anna Lazaricheva, spam analyst at Kaspersky.
In a sobering revelation of the evolving threat landscape facing the digital asset ecosystem, blockchain intelligence firm TRM Labs has disclosed that over $2.1 billion worth of cryptocurrency was stolen in the first half of 2025 alone, spanning at least 75 high-profile hacks and exploits.
This staggering figure marks a 10 per cent surge over the previous first-half record set in 2022 and nearly eclipses the total stolen in all of 2024.
But beyond the monetary scale, the report reveals a deeper concern: a growing trend of state-sponsored cyber aggression weaponising crypto assets for strategic and geopolitical purposes.
The most devastating breach to date occurred in February when Dubai-based exchange Bybit lost $1.5 billion—the largest crypto heist in history.
TRM Labs attributes the attack to North Korean state actors, noting that the incident alone accounted for nearly 70 percent of total losses during the period and doubled the average hack size to $30 million.
“The Bybit hack redefined the threat landscape,” the report stated.
“It exemplifies how digital asset theft has transcended criminal opportunism and morphed into a tool of statecraft.”
Indeed, North Korea-linked entities were responsible for an estimated $1.6 billion of the total stolen, further entrenching Pyongyang’s status as the most prolific nation-state threat actor in the crypto sphere.
Yet the menace is diversifying. On June 18, Iranian crypto exchange Nobitex was breached for over $90 million by a group reportedly linked to Israel, Gonjeshke Darande (Predatory Sparrow).
Unusually, the stolen funds were routed to unusable vanity addresses, underscoring symbolic and political motives rather than financial gain.
TRM Labs flagged this as a “disturbing shift,” with digital asset theft increasingly deployed as a weapon in asymmetric geopolitical conflict.
The report also found that more than 80 percent of losses stemmed from infrastructure breaches, including private key theft, seed phrase leaks, and front-end compromises— attacks typically ten times costlier than other vectors.
Meanwhile, DeFi exploits such as flash loan manipulations accounted for 12 percent of losses, reflecting persistent smart contract vulnerabilities despite years of scrutiny.
As digital currencies become enmeshed in global rivalries, TRM Labs warns that conventional cybersecurity approaches are now inadequate.
“Massive breaches, often tied to nation-state operations, require a new defence paradigm,” the firm asserted, urging industrywide adoption of advanced safeguards and cross-border collaboration among regulators and law enforcement.
Corporate Affairs Commission (CAC) has inaugurated the pilot take-off of its new Artificial Intelligence (AI)-powered registration portal.
A statement issued by the commission explained that Malam Hussaini Magaji, registrar-general of the CAC, made the announcement during the 2025 Stakeholders Forum in Port Harcourt.
According to him, “the initiative is a major milestone in Nigeria’s business facilitation drive.”
The Registrar further explained that the upgraded portal marks a complete overhaul of the Company Registration Portal (CRP), saying that it comes with advanced features designed to simplify and speed up business registration.
The new system, according to him, allows for instant name reservation approvals, likening the ease to creating an email account, and stressing that the AI-powered platform could suggest available alternatives to business names and approve them immediately.
Another innovation, he stated, is the ability to register a business using only the National Identification Number (NIN) of a director or proprietor, pointing out that there is an ambitious target of completing business registration and certificate generation within 30 minutes, subject to real-time NIN validation.
DBI, Miva Open University Partner to Advance Digital Innovation, Education
GTCO to Become First Nigerian Bank to List on London Stock Exchange
IFC, AfDB Collaborate with EbonyLife Media to Explore Supporting the African Film Industry to Drive Job Creation
FIRS Commits to Fostering Trust, Voluntary Compliance Nationwide @ Tax Clinic
NAICOM Issues New Licenses to SanlamAllianz Life, General Insurance
Telecom2 days agoAVEVA Highlights Climate Impact Gains in 2024 Sustainability Report
General News2 days agoAfCFTA Opens Opportunity for Logistics Sector
Telecom2 days agoALTON Explains SIM-related Services Disruption Across Mobile Networks
Telecom1 day agoNCC Approves MTN, 9Mobile Roaming Collaboration Deal
E-Financial1 day agoWorld Bank Approves Extra $65m for Nigeria’s SPESSE
Telecom2 days agoMTN Foundation, NDLEA, UNODC Unite in Abuja Against Substance Abuse
E-Financial1 day agoEcobank Taps Google Cloud to Deepen Financial Inclusion
E-Business1 day agoCAC Launches AI-powered Business Registration Portal