Telecom
Cybercriminals Are Doubling Down on Credential Theft, Launching More Innovative Ransomware Attacks – Sophos 2023 Threat Report Reveals
Sophos, a global leader in innovating and delivering cybersecurity as a service, has on Monday published its 2023 Threat Report.
The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service.
The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.
Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up.
Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.
“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors.
“For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities.
“The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”
With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.
“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.
Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.
“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.
The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”
Sophos also analyzed the following trends:
·The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.
· Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in“bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.
· Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.
· The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.
To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.
Nigerian Communications Commission (NCC) has reiterated its commitment to safeguarding telecommunications infrastructure across the country, in line with President Bola Tinubu’s Executive Order, which criminalises the vandalism, theft or obstruction of critical national infrastructure.
The Commission noted that the enforcement drive is aimed at curbing the growing incidence of sabotage at telecom sites, which continues to degrade the quality of network services nationwide.
Speaking during a courtesy visit by the Executive of the Nigeria Union of Journalists (NUJ), Federal Capital Territory (FCT) Council to the Commission’s headquarters in Abuja, Mrs Nnenna Ukoha, head of Public Affairs at the NCC, reaffirmed the Commission’s resolve to act.
She stated, “President Tinubu signed the Executive Order on 24th June 2024, declaring telecom infrastructure as Critical National Information Infrastructure (CNII). The NCC is now mandated to implement this order fully, and anyone found tampering with these facilities will face the full weight of the law.”
Mrs Ukoha, who represented Dr Aminu Maida, executive vice chairman and chief executive officer, added that the NCC has launched a nationwide awareness campaign to sensitise the public about the significance of protecting critical national infrastructure, including telecom, energy and transport facilities.
Expressing concern over rampant damage, she said, “The destruction of fibre cables, theft of generators and fuel, and removal of key components from telecom base stations have become all too common. These acts directly affect the quality of service that millions of Nigerians depend on.”
She identified three major challenges undermining telecom service delivery:
Vandalism and Theft: “We are witnessing frequent attacks on telecom sites. These lead to service outages and cost operators billions in repairs.”
Restricted Site Access: “Operators face obstruction from local communities, touts and even some government officials who demand levies, making it difficult to access sites for maintenance and refuelling.”
Road Construction Damage: “Ongoing road projects often result in accidental damage to underground fibre cables, further compounding the situation.”
Responding to public complaints about fast-depleting data, Mrs Ukoha clarified that “mobile network operators do not steal users’ data. What many people experience is due to automatic app updates, background processes, and hotspots being shared unknowingly.”
She advised users to be proactive: “We encourage consumers to review their phone settings, limit background data, turn off auto-play videos, and regularly change hotspot passwords.”
Commending the media, she added, “Journalists play a vital role in educating the public. We appreciate your efforts and urge continued partnership in disseminating accurate, impactful information.”
She also revealed the Commission’s drive to improve digital inclusion: “The NCC is committed to supporting underserved communities with affordable internet access and has commenced specialised training for journalists, particularly senior editors in Lagos and Abuja.”
Mrs Ukoha emphasised collaboration with government agencies to reduce infrastructure damage: “As construction projects expand nationwide, we must work together to prevent unnecessary damage to telecom assets.”
Also speaking, Mallam Yakubu Musa, head, Corporate Communications, NCC, reinforced the importance of the media in the telecom ecosystem.
He said, “Our partnership with the press is key to promoting transparency, building consumer trust, and supporting regulatory compliance.”
In her remarks, Comrade Grace Ike, chairman, NUJ FCT, commended the NCC’s regulatory efforts and expressed interest in deeper collaboration.
She stated, “We look forward to partnering with the NCC on media training, expanding internet access for journalists, and enhancing public awareness. We also seek your support for our forthcoming Press Week and capacity-building programmes.”
She continued, “The NUJ recognises the importance of digital tools in journalism. Equipping media professionals with access and knowledge will strengthen democratic engagement and promote good governance.”
The NUJ delegation, comprising key executives and media team members, reiterated its commitment to working closely with the NCC to promote national development.
This enforcement initiative—anchored on President Tinubu’s July 2024 Executive Order—provides a solid legal framework for protecting vital telecom infrastructure and ensuring uninterrupted communication services.
Telecom
Africa’s Lawmakers Commit to Strengthening AI, Digital Health and Smart Manufacturing Frameworks
The Pan-African Parliament (PAP) and the African Population Health Research Center (APHRC), in collaboration with the GSMA, have concluded the first Africa Digital Parliamentary Summit focused on building legislative capacity in Artificial Intelligence (AI), data protection, digital health and smart manufacturing, in a bid to promote evidence-based policy-making for Africa’s digital future.
The three-day Summit, held from 9-11 July in Lusaka, convened over 20 Members of Parliament from the Pan-African Parliament Committees on Transport, Industry, Communications, Energy, Science and Technology, and Health, Labour and Social Affairs and was opened by the Zambian Minister of Technology and Science, Honourable Felix Mutati. Strategic partners in attendance included AUDA-NEPAD, Africa CDC, ECOSOCC, and the African Peer Review Mechanism (APRM).
This concluded with the publication of the Lusaka Declaration outlining shared priorities and next steps for ensuring Africa’s digital transformation is inclusive, responsible and grounded in evidence-based policy.
The Lusaka Declaration recognised the vital role of Members of Parliament in shaping laws and policies that drive the continent’s development. The Digital Parliamentary Summit offered a timely platform to enhance the knowledge and capacity of Parliamentarians on critical aspects of digital transformation.
A key highlight of the Summit was the consideration and discussion with Parliamentarians on the draft Africa Digital Health and Smart Manufacturing reports developed by APHRC and the GSMA.
Both reports will be submitted to the Plenary of the PAP when Parliamentarians of the 55 member states of the African Union meet in Midrand later this month on the occasion of the 5th Ordinary Session of the 6th Legislature of the Pan-African Parliament.
Honourable Behdja Mokrani, Chairperson of the Pan-African Parliament Committee on Transport, Industry, Communications, Energy, Science and Technology said “Against the backdrop of global economic uncertainties and the accelerating pace of technological disruption, this Summit has highlighted the critical need to equip African legislators with the foresight and capabilities required to navigate the Fourth Industrial Revolution.
The capacity-building component of the Summit, along with the presentation of the Africa Digital Health and Smart Manufacturing Reports by APHRC and GSMA, reinforced the importance of African policymakers acquiring the relevant skills to address policy issues related to digital transformation – particularly in the areas of Digital Health and Smart Manufacturing – in alignment with the African Union’s Agenda 2063.
Anthony Mveyange, Director of Programs, Synergy, African Population Health Research Center adds “At APHRC, we firmly believe that digital health is a transformative force, holding immense potential for Africa to ‘leapfrog’ traditional development pathways.
This Summit powerfully demonstrates how, by leveraging AI alongside advancements in digital health and smart manufacturing, we can accelerate socio-economic progress and foster deeper continental integration, directly aligning with the ambitious goals of the African Union’s Agenda.”
Key themes explored during the Summit included:
- The potential of AI-driven digital health to accelerate universal health coverage through better data integration and cross-border information exchange
- The role of smart manufacturing in enhancing industrial resilience and job creation through automation and IoT
- The need for harmonised, Africa-led data governance frameworks to ensure responsible AI development and protect privacy and human rights
“AI, digital health, and smart manufacturing have the potential to transform Africa’s economies and improve lives – but unlocking that potential requires the right policy environment.
“This Summit is an important step in equipping lawmakers with the tools to shape secure, inclusive and future-ready digital economies” said Kenechi Okeleke, Senior Director, Regional, Social and Policy Research, GSMA.
Participants reaffirmed their commitment to advancing digital transformation through coordinated reforms, including:
- Strengthening STEM education and digital literacy among policymakers
- Embedding ICT training in public service development
- Establishing cross-sector collaboration between the health, trade and ICT sectors
- Creating enabling conditions for investment in advanced connectivity infrastructure
Draft findings presented during the Summit estimate that Africa’s digital health market could reach $6.5 billion by 2030 under an optimistic scenario, highlighting the urgent need for policy alignment to maximise impact and drive inclusive growth.
The Summit also set out a roadmap for ongoing engagement between the Pan-African Parliament, APHRC and the GSMA, including the establishment of ‘Evidence-to-Policy’ resource units, sustained capacity-building efforts, and regional forums to harmonise legislation on AI, digital health, and data governance across Africa.
Kashifu Inuwa, director general of the National Information Technology Development Agency (NITDA) has called on business leaders to embrace artificial intelligence (AI) as a collaborative partner in driving innovation and economic growth, rather than viewing it as a threat to human jobs.
Speaking during a high-level panel session titled “Builders of the New Nigeria – Stories of Scale, Grit, and Innovation” at the BusinessDay CEO Forum Nigeria, held in Lagos, Inuwa challenged the conventional notion of AI as merely an automation tool, and encouraged CEOs and business leaders to view AI as a thought partner and a strategic ally in generating innovative ideas, discovering new business models, and creating competitive advantages in a rapidly evolving global economy.
“I see artificial intelligence not just as a tool, but as a thought partner,” he said, urging business leaders to integrate AI into their operations not as a replacement for human input, but as a collaborator that can unlock new levels of productivity and creativity.
He explained that while AI can outperform humans in certain tasks, its primary function should not be seen as replacing human workers.
Instead, it is poised to take over specific processes and skills currently relied upon to accomplish routine tasks. This shift, according to him, requires business leaders to reposition themselves at the center of this technological evolution.
“The key is to position yourself at the center of this collaboration. Yes, AI can outperform humans in many tasks, but it will not replace you or me. What AI will replace are the skills and processes we rely on today to perform our work.”
Inuwa emphasised the need for CEOs and decision-makers to proactively redefine their roles in an AI-driven world by evolving their capabilities to work effectively alongside intelligent systems.
He highlighted the importance of learning how to collaborate with AI, rather than competing against it, as the surest way to remain relevant and successful in the digital age.
To get the best out of AI, Inuwa advised that businesses should approach AI systems by assigning them specific roles or personas based on the context of their usage. Whether as a virtual lawyer, doctor, co-founder, or advisor, he said assigning a clear role to AI makes its interaction with humans more purposeful and productive.
Despite his optimism about AI’s potential, Inuwa cautioned that AI systems must be approached with vigilance. He warned business leaders not to assume AI is always accurate or ethical by default, stating that AI should always be treated as the “worst version” of itself until it proves otherwise.
“This is where government’s role becomes critical. As regulators, we need to create policy labs where we can test AI technologies in safe, controlled environments. We must evaluate them thoroughly to ensure they are safe, ethical, and reliable,” he added.
He noted that NITDA has adopted a progressive regulatory approach centered on collaboration, experimentation, and co-creation. Rather than imposing restrictive regulations out of fear or uncertainty, the agency works hand-in-hand with innovators, startups, and the private sector to experiment with emerging technologies like AI.
According to Inuwa, the insights gained from such collaborative initiatives help government agencies like NITDA establish clear, evidence-based benchmarks and policies that both support innovation and safeguard public interests.
“This is our approach to regulation. Rather than rushing to regulate based on fear, we collaborate with the private sector to experiment, learn, and build together.
“We co-create solutions, then use the lessons from these experiments to establish clear benchmarks that will inform future frameworks, guidelines, and regulations,” he added.
Inuwa said, “Nigeria is setting a precedent for balancing technological innovation with societal responsibility, enabling businesses to thrive while ensuring that new technologies benefit the broader society.”
“Our aim is to create an environment where businesses can innovate responsibly, while ensuring society as a whole benefit from these new technologies,” he concluded.
The BusinessDay CEO Forum Nigeria attracted an influential audience of business executives, entrepreneurs, policymakers, and thought leaders from across the country. The event served as a platform for high-impact conversations on scaling businesses, building resilience, and driving sustainable innovation in Nigeria’s challenging economic climate.
Throughout the session, panelists shared personal stories of perseverance, discussed strategies for business growth, and explored how technologies like AI, digital payments, and data analytics are shaping Nigeria’s future economy.
EFCC Says Corrupt Politicians are Using Crypto Wallets to Launder Money
UBA Expands to More African Cities, Stamps Footprint in Saudi Arabia
NCC Speaks of Plans to Secure Telecom Infrastructure Nationwide
Africa’s Lawmakers Commit to Strengthening AI, Digital Health and Smart Manufacturing Frameworks
Ecobank Plans to Raise $250m Capital Through Private Placement
News3 days agoJAMB Accuses Student of Securing Admission through Identity Fraud
News3 days agoCheck Point Report Finds Africa as Top Target for Cyber-attacks
E-Financial3 days agoEFCC Recovers Funds Lost to CBEX Fraud
Telecom2 days agoNCC Speaks of Plans to Secure Telecom Infrastructure Nationwide
General News2 days agoAirtel Nigeria Drives BFSI and Utility Sector Innovation with Industry-wide Workshop
Telecom2 days agoAfrica’s Lawmakers Commit to Strengthening AI, Digital Health and Smart Manufacturing Frameworks
E-Financial2 days agoUBA Expands to More African Cities, Stamps Footprint in Saudi Arabia
E-Financial3 days agoFinancial Fraud in Nigeria Surges by 45 Percent, 70 Percent of Losses Linked to Digital Platforms – CBN