E-Business
Cybercriminals Wipe Out Logs in Most Attacks – Sophos
Sophos, a global leader in innovating and delivering cybersecurity as a service, has released its Active Adversary Report for Security Practitioners, which found that telemetry logs were missing in nearly 42 per cent of the attack cases studied.
In 82 per cent of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks. The report covers Incident Response (IR) cases that Sophos analysed from January 2022 through the first half of 2023.
Gaps in telemetry decrease much-needed visibility into organisations’ networks and systems, especially since attacker dwell time (the time from initial access to detection) continues to decline, shortening the time defenders have to effectively respond to an incident.
“Time is critical when responding to an active threat; the time between spotting the initial access event and full threat mitigation should be as short as possible. The farther along in the attack chain an attacker makes it, the bigger the headache for responders. Missing telemetry only adds time to remediations that most organisations can’t afford. This is why complete and accurate logging is essential, but we’re seeing that, all too frequently, organisations don’t have the data they need,” said John Shier, field CTO, Sophos.
In the report, Sophos classifies ransomware attacks with a dwell time of less than or equal to five days as “fast attacks,” which accounted for 38 per cent of the cases studied. “Slow” ransomware attacks are those with a dwell time greater than five days, which accounted for 62 per cent of the cases.
However, defenders do need to be aware that fast attacks and the lack of telemetry can hinder fast response times, leading to more destruction.
“Cybercriminals only innovate when they must, and only to the extent that it gets them to their target. Attackers aren’t going to change what’s working, even if they’re moving faster from access to detection. This is good news for organizations because they don’t have to radically change their defensive strategy as attackers speed up their timelines. The same defenses that detect fast attacks will apply to all attacks, regardless of speed. This includes complete telemetry, robust protections across everything, and ubiquitous monitoring,” said Shier.
“The key is increasing friction whenever possible—if you make the attackers’ job harder, then you can add valuable time to respond, stretching out each stage of an attack.
“For example, in the case of a ransomware attack, if you have more friction, then you can delay the time until exfiltration; exfiltration often occurs just before detection and is often the costliest part of the attack. We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen. Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”
The Sophos Active Adversary Report for Security Practitioners is based on 232 Sophos Incident response (IR) cases across 25 sectors from Jan. 1, 2022, to June 30, 2023.
Targeted organizations were located in 34 different countries across six continents. Eighty-three percent of cases came from organizations with fewer than 1,000 employees.
The Sophos Active Adversary Report for Security Practitioners provides actionable intelligence on how security practitioners should best shape their defensive strategy.
Nigeria Data Protection Commission (NDPC) has launched an investigation into allegations that the confidentiality and integrity of candidates’ personal data may have been compromised by hackers.
The Commission initiated the inquiry following concerns over possible data breaches during examinations.
Preliminary findings indicate that several examination centres may not have implemented adequate technical and organizational measures to safeguard candidates’ personal information, as required under data protection regulations.
Although the incident reportedly affected 379, 997 candidates, the NDPC’s investigation is poised to cover a systemic audit of data processing and third parties.
It will be recalled that JAMB recently admitted that a technical error on its platform affected a total of 379,997 candidates in 157 examination centres across Lagos and the South-East.
Further investigation led to the arrest of at least 20 suspects who are currently in the custody of the Department of State Services and the Nigerian Police Force.
Cyber security firm, Kaspersky, has once again warned that sophisticated cybercriminals increasingly target Africa as ransomware and advanced persistent threats (APTs) escalate across the region.
Speaking at the company’s annual Cyber Security Weekend for the Middle East, Turkiye and Africa (META) region, the cybersecurity firm’s Global Research and Analysis Team highlighted growing digital threats affecting African nations.
Kenya, Nigeria, and South Africa emerged as hotspots, with Kenya recording one of the highest web threat incident rates at 20.1% in first quarter 2025.
“While ransomware is less prevalent in Africa due to lower levels of digitisation and economic constraints, countries like South Africa and Nigeria are seeing a sharp rise in attacks,” said Sergey Lozhkin, head of META and APAC regions at Kaspersky.
Kaspersky noted a 0.01 percentage point increase in African ransomware cases year-on-year, reaching 0.41%, still below global and Middle Eastern averages, but a troubling sign for the continent’s emerging digital infrastructure.
Experts warned that attackers are refining their tactics, shifting focus to unconventional entry points like IoT devices, smart appliances, and misconfigured hardware.
“As these economies expand digitally, sectors such as manufacturing, finance and government are becoming key targets,” said Lozhkin
The cyber-crime landscape is evolving quickly, fuelled by AI tools and dark web access to large language models, which enable less skilled actors to launch convincing phishing and malware campaigns.
Groups like FunkSec, which uses AI-generated code and a low-cost ransom model, are redefining ransomware operations.
“African organisations face the dual challenge of expanding digital footprints and limited cybersecurity awareness. This makes layered defense strategies, including network segmentation, real-time monitoring and regular staff training, essential,” stated Lozhkin
Kaspersky continues to monitor 25 active APT groups in the META region, including SideWinder and MuddyWater, some of which are known to target African institutions.
To bolster defenses, the firm recommends using tools such as its free Anti-Ransomware Tool for Business and the Kaspersky Next suite for threat visibility and response.
Nigeria recently launched a new joint case team to step up its response to cybercrimes that affect people and businesses at home and abroad.
The ‘Joint Case Team on Cybercrime’ brings together Nigeria’s key justice and security agencies to work as one, making it easier to detect, investigate, and prosecute digital offences.
It is supported by the UK National Crime Agency, the UK Foreign, Commonwealth and Development Office, and the Commonwealth Secretariat, as part of a wider effort to promote international cooperation on cybercrime.
Speaking at the launch in Abuja, Prince Lateef Fagbemi SAN, minister of justice and attorney general of the federation described the initiative as “a bold and transformative stride in Nigeria’s justice system.”
He said that although Nigeria has a national legal framework to address cyber offences, laws alone are not enough.
Nigeria is among the countries most affected by cybercrime around the world, with increasing financial losses.
NDPC Probes Suspected Data Breach in Examination Centres
Airtel’s AI Spam Alert Flags 9.6m Spam Attempts
Vitel Wireless Completes Interconnectivity with all Major Telcos in Nigeria
Nigeria Approves $500m for AfDB’s Trust Fund Replenishment over Next 15 Years
Nigeria Among Hotspots as Kaspersky Warns of Rising Ransomware Threat in Africa
E-Business2 days agoNigeria Launches Cybercrime Team with Commonwealth, UK Support
Telecom2 days agoTelecom Subscribers Decline By 43m in One Year
Telecom2 days agoNCC Orders Telcos to Compensate Subscribers for Outages More than 24 Hours
E-Financial2 days agoSERAP Drags CBN to Court over Alleged Failure to Disclose LG Allocations
General News2 days agoHEDA Sues FG, Oil Giants over Alleged Unlawful Oil Licence Transfer
Telecom2 days agoIHS Nigeria, NSCDC Partner to Protect Telecoms Infrastructure
Telecom1 day agoEngr. Ikechukwu Nnamani Receives Two Prestigious @ABoICT Awards
Telecom1 day agoFG to Deploy 80 Percent of 7000 Telecom Towers to North