Telecom
Cybercriminals Are Doubling Down on Credential Theft, Launching More Innovative Ransomware Attacks – Sophos 2023 Threat Report Reveals
Sophos, a global leader in innovating and delivering cybersecurity as a service, has on Monday published its 2023 Threat Report.
The report details how the cyberthreat landscape has reached a new level of commercialization and convenience for would-be attackers, with nearly all barriers to entry for committing cybercrime removed through the expansion of cybercrime-as-a-service.
The report also addresses how ransomware remains one of the greatest cybercrime threats to organizations with operators innovating their extortion tactics, as well as how demand for stolen credentials continues to grow.
Criminal underground marketplaces like Genesis have long made it possible to buy malware and malware deployment services (“malware-as-a-service”), as well as to sell stolen credentials and other data in bulk. Over the last decade, with the increasing popularity of ransomware, an entire “ransomware-as-a-service” economy sprung up.
Now, in 2022, this “as-a-service” model has expanded, and nearly every aspect of the cybercrime toolkit—from initial infection to ways to avoid detection—is available for purchase.
“This isn’t just the usual fare, such as malware, scamming and phishing kits for sale,” said Sean Gallagher, principal threat researcher, Sophos. “Higher rung cybercriminals are now selling tools and capabilities that once were solely in the hands of some of the most sophisticated attackers as services to other actors.
“For example, this past year, we saw advertisements for OPSEC-as-a-service where the sellers offered to help attackers hide Cobalt Strike infections, and we saw scanning-a-service, which gives buyers access to legitimate commercial tools like Metasploit, so that they can find and then exploit vulnerabilities.
“The commoditization of nearly every component of cybercrime is impacting the threat landscape and opening up opportunities for any type of attacker with any type of skill level.”
With the expansion of the “as-a-service” economy, underground cybercriminal marketplaces are also becoming increasingly commodified and are operating like mainstream businesses. Cybercrime sellers are not just advertising their services but are also listing job offers to recruit attackers with distinct skills. Some marketplaces now have dedicated help-wanted pages and recruiting staff, while job seekers are posting summaries of their skills and qualifications.
“Early ransomware operators were rather limited in how much they could do because their operations were centralized; group members were carrying out every aspect of an attack. But as ransomware became hugely profitable, they looked for ways to scale their productions. So, they began outsourcing parts of their operations, creating an entire infrastructure to support ransomware. Now, other cybercriminals have taken a cue from the success of this infrastructure and are following suit,” said Gallagher.
Indeed, as the cybercrime infrastructure has expanded, ransomware has remained highly popular—and highly profitable. Over the past year, ransomware operators have worked on expanding their potential attack service by targeting platforms other than Windows while also adopting new languages like Rust and Go to avoid detection. Some groups, most notably Lockbit 3.0, have been diversifying their operations and creating more “innovative” ways to extort victims.
“When we talk about the growing sophistication of the criminal underground, this extends to the world of ransomware. For example, Lockbit 3.0 is now offering bug bounty programs for its malware and ‘crowd-sourcing’ ideas to improve its operations from the criminal community. Other groups have moved to a ‘subscription model’ for access to their leak data and others are auctioning it off. Ransomware has become, first and foremost, a business,” said Gallagher.
The evolving economics of the underground has not only incentivized the growth of ransomware and the “as-a-service” industry, but also increased the demand for credential theft. With the expansion of web services, various types of credentials, especially cookies, can be used in numerous ways to gain a deeper foothold in networks, even bypassing MFA. Credential theft also remains one of the easiest ways for novice criminals to gain access to underground marketplaces and begin their “career.”
Sophos also analyzed the following trends:
·The war in Ukraine had global repercussions for the cyberthreat landscape. Immediately following the invasion, there was an explosion of financially motivated scams, while nationalism led to a shake-up of criminal alliances between Ukrainians and Russians, particularly among ransomware affiliates.
· Criminals continue to exploit legitimate executables and utilize “living off the land binaries” (LOLBins) to launch various types of attacks, including ransomware. In some cases, attackers deploy legitimate but vulnerable system drivers in“bring your own driver” attacks to attempt to shut down endpoint detection and response products to evade detection.
· Mobile devices are now at the center of new types of cybercrimes. Not only are attackers still using fake applications to deliver malware injectors, spyware and banking-associated malware, but newer forms of cyberfraud have been growing in popularity, such as “pig butchering” schemes. And this crime is no longer just affecting Android users, but iOS users as well.
· The devaluation of Monero, one of the most popular cryptocurrencies for cryptominers, led to a decrease in one of the oldest and most popular types of cryptocrime—cryptomining. But mining malware continues to spread through automated “bots” on both Windows and Linux systems.
To learn more about the changing threat landscape in 2022 and what it means for security teams in 2023, read the full Sophos 2023 Threat Report.
SHELT, a leading cybersecurity-as-a-service provider, has earned inclusion in the 2025 MSSP 250, the annual ranking of the world’s top 250 Managed Security Service Providers (MSSPs) by MSSP Alert, a CyberRisk Alliance publication.
SHELT
The list evaluates firms on business performance, service breadth, and industry impact, spotlighting those excelling in growth, operational excellence, and advanced managed security amid rising cyber threats. Selection criteria include annual recurring revenue, profitability, workforce expansion, business growth, and the depth of managed security offerings.
SHELT’s recognition underscores its investments in scalable security operations, threat intelligence, and tailored managed services across multiple regions, enabling clients to navigate complex risk landscapes effectively.
“Being recognised in the MSSP 250 is a meaningful milestone for our team,” stated Youssef Abillama, CEO of SHELT. “It validates our focus on building practical, resilient security services that help organisations manage risk and respond effectively to today’s evolving cyber threats.”
The company hailed the honour as testament to its teams’ dedication and expertise worldwide, reaffirming commitment to enhancing capabilities and delivering trusted cybersecurity solutions.
X, the social media platform formerly known as Twitter, has suspended the @Twitter account, replacing its profile with a standard notice citing violation of platform rules.
Musk
The action, which occurred on Sunday, January 11, left users encountering the handle greeted by a bold “Account Suspended” message on a black screen, with no details provided on the specific rules broken or the duration of the suspension.
The development has sparked widespread confusion and nostalgia among users, given that Elon Musk rebranded Twitter to X in July 2023, approximately six months after acquiring the platform for $44 billion in late 2022.
The @Twitter handle had remained dormant since before Musk’s takeover, serving as a legacy remnant of the platform’s original branding, and its suspension appears to mark the final erasure of the Twitter name amid X’s ongoing efforts to combat spam, impersonation, and rule violations.
X’s official statement on the suspended page simply reads: “X suspends accounts that violate our rules,” without offering an appeal process or further explanation, unlike standard user suspensions.
Public reactions on social media ranged from humorous laments of “RIP Twitter” to speculation that the move resulted from automated moderation or a deliberate cleanup of legacy trademarks.
xAI’s Grok AI described it as a purposeful retirement of outdated elements rather than a genuine infraction, while neither Elon Musk nor X spokespeople issued any comment as of Monday morning.
This incident underscores the evolving identity of the platform under Musk’s ownership, which also saw a domain shift to x.com in 2024, further distancing it from its Twitter roots.
Industry observers note that while the suspension aligns with X’s stricter enforcement policies, the lack of transparency has fueled debates on consistency in applying rules to high-profile legacy accounts.
Federal Government plans to channel $460m World bank loan, representing about 92 per cent of a $500m, into the proposed fibre infrastructure company set up to deploy 90,000 kilometres of climate-resilient broadband fibre across the country.
This is contained in the Financing Agreement for the Building Resilient Digital Infrastructure for Growth project between the Federal Government and the International Development Association, the concessional lending arm of the World Bank.
Under the agreement, the World Bank approved a $500m concessional credit to support Nigeria’s drive to expand access to high-quality and climate-resilient broadband internet in unserved and underserved areas.
Of this amount, $460m is earmarked specifically for equity financing and capitalisation of a new Project Company that will drive the fibre rollout. The remaining $40m will cover goods, works, consulting and non-consulting services, training, operating costs, and the refund of a preparation advance used to develop the project framework.
According to the document, the proposed Project Company will be established “as an independent, majority privately-owned and managed special purpose vehicle-joint venture with the objective of the deployment of 90,000 kilometres of climate-resilient fibre infrastructure following a phased approach, limited to provision of wholesale, open access services to licensed telecommunications operators, and management of associated investments, including the carrying out of preparatory activities and provision of transaction advisory services, and provision of equity financing in and capitalization of the Project Company.”
The Federal Government will participate in the company as a shareholder through the Ministry of Finance Incorporated, which manages the government’s investment interests. However, the agreement explicitly caps the government’s shareholding at a maximum of 49 per cent, ensuring that the company remains majority privately owned.
The $460m equity injection is broken into four tranches, tied to strict performance and operational milestones. The first tranche of $150m will be released once the Project Company is incorporated as a joint venture with private partners selected through a process acceptable to the World Bank, and after its memorandum, articles of association, and shareholding agreement are approved.
A second tranche of $100m will only be disbursed after the company adopts fiduciary and administrative procedures approved by the lender and completes at least 5,000 kilometres of fibre deployment. The third tranche of $100m is linked to the completion of an additional 20,000 kilometres of network construction.
The final tranche of $110m will be released after the company launches wholesale open-access services through a published reference offer and completes a further 40,000 kilometres of fibre deployment, bringing the total rollout to at least 65,000 kilometres before the final equity drawdown.
Once each tranche is withdrawn, the agreement requires that the funds be transferred to the Project Company’s dedicated account within five working days, showing the equity nature of the financing rather than traditional budgetary spending.
The project will be implemented under the oversight of the Federal Ministry of Communications, Innovation and Digital Economy, and the Federal Ministry of Finance will receive semi-annual progress updates.
A dedicated Project Implementation Unit will manage day-to-day execution, with overall financial management handled by the Federal Project Financial Management Department in the Office of the Accountant General of the Federation.
Beyond the fibre rollout, the project also includes technical assistance to federal government agencies to support the use of high-quality broadband in targeted areas, as well as funding for project management, monitoring and evaluation, environmental and social safeguards, grievance redress mechanisms and independent audits.
The agreement places strong emphasis on environmental and social standards, requiring compliance with an Environmental and Social Commitment Plan. It also mandates the establishment of an accessible grievance mechanism for affected communities and strict reporting obligations to the World Bank.
Ecobank Joins Trillion-naira Club for the First Time in 20 Years
PalmPay, Premier Cool to Reward 10,000 Nigerians with ₦100 Million in “10k for 10k Campaign”
Nigerian Terra Industries Secures $11.8m for Expansion
Cybersecurity Firm Warns Telecom Threats from 2025 will Carry into 2026 as New Technology Adds New Risk
SHELT Named in Prestigious 2025 MSSP 250 List for Cybersecurity Excellence
Banks quietly move to enforce new ₦50 transfer levy from Jan. 1
FIRS says NIN, CAC Numbers to Serve as Tax IDs from 2026
Nigeria Takes the Lead in the Global WSIS+20 Digital Agenda
PalmPay Launches N400 Million World Travel Carnival, Rewarding Users with Free Global Trips
Nigeria Police Arrest Okitipi, Nigerian Allegedly Linked to Microsoft 365 Hack
General News2 days agoMinistry of Finance Leads FG-Backed Deal to Deliver Quality Homes and Boost Agriculture in Niger State
News2 days agoSERAP Sues INEC Over Alleged ₦55.9Bn Election Funds Diversion
E-Financial2 days agoNDIC Declares Second Liquidation Dividend for Heritage Bank Depositors
Telecom2 days agoFG Plans to Invest $460m World Bank Loan in Fibre Infrastructure
News2 days agoAI Founders and Developers to Converge in Lagos for AI in Action 2026 conference
News2 days agoFG Inaugurates N40Bn CCTV Control Centre for Third Mainland Bridge
Telecom1 day agoX Suspends Twitter Account for Rules Violation
General News2 days agoTax Reforms Panel Rejects KPMG’s Critique of New Laws